Function at 0x4114c0
Capabilities:
Acquire debug privileges
Enumerate process modules

Disassembly:
sub esp, 0x240
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebp
mov byte [esp + 0x14c], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x14d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x18], ebp
stosb byte es:[edi], al
call fcn.00411750
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 8
push str.CreateToolhelp32Snapshot
push str.kernel32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.Process32First
push str.kernel32.dll
mov esi, eax
call edi
push eax
call ebx
push str.Process32Next
push str.kernel32.dll
mov dword [esp + 0x24], eax
call edi
push eax
call ebx
push ebp
push 2
mov dword [esp + 0x20], eax
call esi
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x14], esi
jne 0x411568
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x240
ret
push 0x400
push 0x40
mov dword [esp + 0x2c], 0x128
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
push ebp
call dword [0x419ed4]
mov ecx, eax
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov ebx, 1
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x24]
mov byte [ebp], 0x7d
push eax
push esi
call dword [esp + 0x24]
test eax, eax
je 0x411721
mov ecx, dword [esp + 0x2c]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x411707
cmp eax, 4
je 0x411707
cmp eax, 8
je 0x411707
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14c]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push 4
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14c]
push 0x104
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x48]
push eax
call edi
lea ecx, [esp + 0x14c]
mov esi, eax
push ecx
call edi
lea esi, [esi + eax + 6]
push ebp
add esi, ebx
call dword [0x419ed4]
cmp eax, esi
jae 0x411657
push 0x42
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebp, eax
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x48]
mov dword [ebx + ebp], edx
push eax
add ebx, 4
call edi
mov ecx, eax
lea esi, [esp + 0x48]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x48]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [ebx + eax + 1]
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jg 0x4116cc
mov edi, 0x4161d8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
lea esi, [esp + 0x14c]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x14c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [ebx + eax + 1]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [esp + 0x20]
test eax, eax
jne 0x4115b5
mov esi, dword [esp + 0x14]
push 0x42
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0
push str.SeDebugPrivilege
mov edi, eax
call fcn.00411750
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x240
ret