Function at 0x4661a0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d00ab
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2294
call fcn.004b4cc0
mov eax, dword [0x50ac94]
xor eax, esp
mov dword [esp + 0x2290], eax
push ebx
push esi
push edi
mov eax, dword [0x50ac94]
xor eax, esp
push eax
lea eax, [esp + 0x22a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
push str.psapi.dll
mov dword [esp + 0x44], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x466588
push str.SeDebugPrivilege
call fcn.004660d0
add esp, 4
push str.EnumProcesses
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov ecx, dword [esp + 0x1c]
push str.EnumProcessModules
push ecx
mov ebx, eax
call edi
mov edx, dword [esp + 0x1c]
push str.GetModuleFileNameExW
push edx
mov dword [esp + 0x40], eax
call edi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x2c]
push eax
push 0x400
lea ecx, [esp + 0x9c]
push ecx
call ebx
mov ebx, dword [esp + 0x2c]
shr ebx, 2
mov dword [esp + 0x44], ebx
mov dword [esp + 0x30], 0
test ebx, ebx
jle 0x466579
lea edx, [esp + 0x94]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [esp + 0x34], edi
test edi, edi
je 0x466563
lea edx, [esp + 0x2c]
push edx
push 0x10
lea eax, [esp + 0x5c]
push eax
push edi
call dword [esp + 0x48]
xor eax, eax
mov dword [esp + 0x28], eax
jmp 0x4662d4
mov edi, dword [esp + 0x34]
mov edx, dword [esp + eax*4 + 0x54]
push 0x104
lea ecx, [esp + 0x2098]
push ecx
push edx
push edi
call dword [esp + 0x4c]
test eax, eax
jne 0x4662fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x466542
cmp dword [ebp + 0xc], 0
je 0x466360
lea eax, [esp + 0x2094]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x466310
sub eax, edx
sar eax, 1
mov edi, eax
js 0x466357
jmp 0x466330
movzx eax, word [esp + edi*2 + 0x2094]
cmp ax, 0x5c
je 0x466357
movzx eax, ax
push eax
call fcn.004b2986
add esp, 4
sub edi, 1
mov word [esp + edi*2 + 0x2096], ax
jns 0x466330
lea edi, [esp + edi*2 + 0x2096]
jmp 0x466367
lea edi, [esp + 0x2094]
mov ebx, dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edi
push ebx
push str.Looking_for___s_:__s
push ecx
call fcn.00468700
add esp, 0x10
call fcn.00466060
add esp, 4
push ebx
push edi
call fcn.004ae3c3
add esp, 8
test eax, eax
jne 0x466542
push ecx
mov ebx, esp
mov dword [esp + 0x24], esp
mov dword [esp + 0x4c], ebx
call fcn.0049ff8a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4665ac
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, str.____found__adding
mov dword [esp + 0x22b4], 0
test ecx, 0xffff0000
jne 0x4664e2
mov edx, ecx
movzx edi, dx
push edi
call fcn.004a7eac
mov esi, eax
test esi, esi
je 0x4664b8
mov eax, edi
shr eax, 4
inc eax
movzx ecx, ax
push 6
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4664b8
push edi
push eax
push esi
call fcn.004216d6
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4664b8
mov eax, dword [ebx]
movzx esi, word [edi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x46644b
push esi
mov ecx, ebx
call fcn.004214f5
movzx eax, word [edi]
mov edx, dword [ebx]
add edi, 2
mov dword [esp + 0x1c], edx
cmp eax, 0xffffffff
jne 0x466466
push edi
call fcn.004ae67a
add esp, 4
inc eax
add eax, eax
push eax
lea ecx, [esi + esi]
push edi
push ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004ae100
add esp, 0x10
cmp eax, 0x50
ja case.0x46648f.1
movzx edx, byte [eax + 0x4665dc]
jmp dword [edx*4 + 0x4665cc]
test esi, esi
jl 0x4665c0
mov eax, dword [ebx]
cmp esi, dword [eax - 8]
jg 0x4665c0
mov edx, dword [esp + 0x24]
mov dword [eax - 0xc], esi
mov eax, dword [ebx]
xor ecx, ecx
mov word [edx + eax], cx
mov esi, dword [esp + 0x28]
mov dword [esp + 0x22b4], 0xffffffff
call fcn.00466060
mov eax, dword [esi + 0xc]
add esp, 4
mov dword [esp + 0x18], 1
test eax, eax
jne 0x4664fe
xor ecx, ecx
jmp 0x466506
push str.____found__adding
call fcn.004ae67a
add esp, 4
push eax
push str.____found__adding
mov ecx, ebx
call fcn.004241cf
jmp 0x4664bc
mov ecx, dword [esi + 0x14]
sub ecx, eax
sar ecx, 2
mov edi, dword [esi + 0x10]
mov edx, edi
sub edx, eax
sar edx, 2
cmp edx, ecx
jae 0x466524
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov dword [edi], ecx
add edi, 4
mov dword [esi + 0x10], edi
jmp 0x466542
cmp eax, edi
jbe 0x46652d
call fcn.004ae7f1
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
push edi
push eax
push edx
lea eax, [esp + 0x58]
push eax
mov eax, esi
call fcn.00472590
mov eax, dword [esp + 0x28]
inc eax
cmp eax, 1
mov dword [esp + 0x28], eax
jl 0x4662d0
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x44]
mov eax, dword [esp + 0x30]
add dword [esp + 0x14], 4
inc eax
cmp eax, ebx
mov dword [esp + 0x30], eax
jl 0x46628a
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x22a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2290]
xor ecx, esp
call fcn.004add11
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00421000
call fcn.004a04f2
call fcn.004a052a
push 0x80070057
call fcn.00421000
mov edi, edi
xchg esi, eax
inc esi
add byte [esi - 0x44ffb99b], dh
inc esi
add byte [ebx + 0x4665], bh
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3