Function at 0x10007ce0
Capabilities:
Acquire debug privileges
Enumerate gui resources
Enumerate process modules
Enumerate processes
Get file size
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8a4
mov eax, dword [0x10023210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x228
lea eax, [ebp - 0x884]
push esi
push eax
mov dword [ebp - 0x89c], esi
mov dword [ebp - 0x888], esi
call fcn.10014cd0
add esp, 0xc
push 0x206
lea edx, [ebp - 0x416]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x418], cx
call fcn.10014cd0
add esp, 0xc
push 0x206
lea ecx, [ebp - 0x20e]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x210], ax
call fcn.10014cd0
add esp, 0xc
push 0x206
lea eax, [ebp - 0x61e]
xor edx, edx
push esi
push eax
mov word [ebp - 0x620], dx
call fcn.10014cd0
add esp, 0xc
lea ecx, [ebp - 0x88c]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10007de0
lea edx, [ebp - 0x62c]
push edx
push 0x1001fad8
push esi
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x624], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [ebp - 0x88c]
push esi
push esi
push 0x10
lea eax, [ebp - 0x630]
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x88c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x88c], esi
cmp esi, 0xffffffff
jne 0x10007e09
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret
push 0x400
push 0x40
mov dword [ebp - 0x888], 0x22c
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0x894], edi
mov byte [edi], 0x1f
mov ebx, 1
call fcn.1000c790
mov eax, dword [0x10025364]
mov ecx, dword [eax]
mov dword [0x10025384], ecx
cmp ecx, eax
je 0x10007f10
lea ebx, [ebx]
mov esi, dword [ecx + 0x10]
test esi, esi
je 0x10007e97
cmp dword [esi + 0x14], 8
jb 0x10007e68
mov eax, dword [esi]
push eax
call fcn.1000ee67
add esp, 4
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push esi
mov word [esi], cx
call fcn.1000ee67
mov edx, dword [0x10025384]
mov dword [edx + 0x10], 0
mov ecx, dword [0x10025384]
add esp, 4
cmp byte [ecx + 0x15], 0
mov edx, ecx
jne 0x10007eeb
mov eax, dword [ecx + 8]
cmp byte [eax + 0x15], 0
jne 0x10007ec4
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x10007ebc
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x10007eb2
mov dword [0x10025384], ecx
jmp 0x10007eeb
mov eax, dword [ecx + 4]
cmp byte [eax + 0x15], 0
jne 0x10007ee6
lea ecx, [ecx]
cmp ecx, dword [eax + 8]
jne 0x10007ee6
mov ecx, eax
mov dword [0x10025384], ecx
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x10007ed0
mov dword [0x10025384], eax
push edx
lea eax, [ebp - 0x890]
push eax
call fcn.1000c530
mov ecx, dword [0x10025384]
cmp ecx, dword [0x10025364]
jne 0x10007e50
mov esi, dword [ebp - 0x88c]
push 0
push 0x10007b00
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [ebp - 0x888]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100082b0
mov edx, dword [ebp - 0x880]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x898], esi
test eax, eax
je 0x10008287
cmp eax, 4
je 0x10008287
cmp eax, 8
je 0x10008287
lea eax, [ebp - 0x8a4]
push eax
push 4
lea ecx, [ebp - 0x89c]
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
push 0x104
lea edx, [ebp - 0x620]
push edx
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x10007fb1
push 0x1001fbec
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x10007fc2
lea edx, [ebp - 0x418]
lea ecx, [ebp - 0x620]
call fcn.10007780
push 0x208
lea ecx, [ebp - 0x210]
push 0
push ecx
call fcn.10014cd0
lea edx, [ebp - 0x210]
add esp, 0xc
push edx
mov ecx, esi
call fcn.10007900
add esp, 4
test eax, eax
je 0x10008014
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
jne 0x1000802c
push 0x1001fbf4
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000802c
push 0x1001fbfc
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x864]
push eax
call esi
lea ecx, [ebp - 0x210]
push ecx
mov dword [ebp - 0x890], eax
call esi
mov ecx, dword [ebp - 0x890]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [ebp - 0x418]
add ecx, eax
push edx
mov dword [ebp - 0x890], ecx
call esi
add eax, dword [ebp - 0x890]
push edi
lea eax, [eax + eax + 0x223]
add eax, ebx
mov dword [ebp - 0x890], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0x890]
cmp eax, ecx
jae 0x10008099
push 0x42
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 0x894], eax
mov edi, eax
mov eax, dword [ebp - 0x880]
mov dword [ebx + edi], eax
mov ecx, dword [ebp - 0x880]
push ecx
call fcn.10007c00
mov byte [ebx + edi + 4], al
lea edx, [ebp - 0x880]
push edx
lea eax, [ebp - 0x8a0]
add ebx, 5
call fcn.1000c7f0
mov eax, dword [eax]
mov dword [0x10025384], eax
cmp eax, dword [0x10025364]
jne 0x100080f2
add edi, ebx
mov ecx, 0x82
mov esi, 0x1001f97c
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x894]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x10008110
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x10008100
mov eax, dword [eax]
add ecx, ecx
push ecx
push eax
lea edx, [ebx + edi]
push edx
call fcn.10014d50
add esp, 0xc
lea eax, [ebp - 0x864]
push eax
call esi
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x864]
push edx
lea eax, [ebx + edi + 0x208]
push eax
call fcn.10014d50
add esp, 0xc
lea ecx, [ebp - 0x864]
push ecx
call esi
lea edx, [ebp - 0x418]
push edx
lea ebx, [ebx + eax*2 + 0x20a]
call esi
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebx + edi]
push edx
call fcn.10014d50
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call esi
mov ecx, dword [ebp - 0x898]
push ecx
lea esi, [ebx + eax*2 + 2]
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi + edi], eax
mov edx, dword [ebp - 0x874]
lea eax, [ebp - 0x210]
push eax
mov dword [esi + edi + 4], edx
call ebx
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [esi + edi + 8]
push eax
call fcn.10014d50
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
call ebx
lea ebx, [esi + eax*2 + 0xa]
xor eax, eax
push 0x28
mov dword [ebp - 0x658], eax
lea edx, [ebp - 0x658]
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x898]
push edx
push eax
mov dword [ebp - 0x658], 0x28
call dword [sym.imp.PSAPI.DLL_GetProcessMemoryInfo]
test eax, eax
je 0x1000822f
mov eax, dword [ebp - 0x64c]
shr eax, 0xa
jmp 0x10008231
xor eax, eax
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x418]
push ecx
mov dword [ebx + edi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10008278
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
shr eax, 0xa
push esi
mov dword [ebp - 0x890], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x890]
jmp 0x1000827a
xor eax, eax
mov esi, dword [ebp - 0x898]
mov dword [ebx + edi + 4], eax
add ebx, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88c]
lea edx, [ebp - 0x888]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10007f33
mov esi, dword [ebp - 0x88c]
push 0x42
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
lea ecx, [ebp - 0x88c]
push ecx
push 0x28
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000832d
lea edx, [ebp - 0x62c]
push edx
push 0x1001fad8
push 0
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x624], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [ebp - 0x88c]
push 0
push 0
push 0x10
lea eax, [ebp - 0x630]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x88c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ee72
mov esp, ebp
pop ebp
ret