Function at 0x100098e0
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
mov eax, dword [0x10047140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x128
mov dword [ebp - 0x54c], eax
xor edi, edi
lea eax, [ebp - 0x544]
push edi
push eax
call fcn.100105b0
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov dword [ebp - 0x548], esi
cmp esi, 0xffffffff
je 0x10009b66
push 0x103
lea eax, [ebp - 0x307]
push edi
push eax
mov dword [ebp - 0x544], 0x128
mov byte [ebp - 0x308], 0
call fcn.100105b0
push 0xff
lea eax, [ebp - 0x203]
push edi
push eax
mov byte [ebp - 0x204], 0
call fcn.100105b0
push 0xff
lea eax, [ebp - 0x103]
push edi
push eax
mov byte [ebp - 0x104], 0
call fcn.100105b0
push 0x103
lea eax, [ebp - 0x40b]
push edi
push eax
mov byte [ebp - 0x40c], 0
call fcn.100105b0
add esp, 0x30
lea eax, [ebp - 0x544]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10009b66
jmp 0x100099c0
push dword [ebp - 0x53c]
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10009a73
mov dword [ebp - 0x550], eax
lea eax, [ebp - 0x550]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10009b43
lea eax, [ebp - 0x418]
push eax
xorps xmm0, xmm0
push str.SeDebugPrivilege
movq qword [ebp - 0x41c], xmm0
push esi
movq qword [ebp - 0x414], xmm0
mov dword [ebp - 0x41c], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push 0x10
lea eax, [ebp - 0x41c]
push eax
push esi
push dword [ebp - 0x550]
mov dword [ebp - 0x410], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push esi
call ebx
push dword [ebp - 0x53c]
push 1
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10009b43
push 0x104
lea eax, [ebp - 0x308]
push 0
push eax
call fcn.100105b0
push 0x100
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.100105b0
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.100105b0
push 0x104
lea eax, [ebp - 0x40c]
push 0
push eax
call fcn.100105b0
add esp, 0x30
lea eax, [ebp - 0x308]
push 0x104
push eax
push 0
push esi
call sub.KERNEL32.dll_K32GetModuleFileNameExA
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
lea eax, [ebp - 0x308]
push 0
push eax
call fcn.1000f47d
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x40c]
push 0x10036d18
push eax
call fcn.1000efbd
push dword [ebp - 0x54c]
lea eax, [ebp - 0x40c]
push eax
call fcn.1000e7e6
add esp, 0x2c
test eax, eax
jne 0x10009b36
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
push esi
call ebx
test edi, edi
je 0x10009b43
cmp byte [ebp + 0xc], 0
je 0x10009b60
mov esi, dword [ebp - 0x548]
lea eax, [ebp - 0x544]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100099c0
jmp 0x10009b66
mov esi, dword [ebp - 0x548]
test esi, esi
je 0x10009b6d
push esi
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000db11
mov esp, ebp
pop ebp
ret