Function at 0x10007d80
Capabilities:
Acquire debug privileges
Enumerate gui resources
Enumerate process modules
Enumerate processes
Get file size
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8a4
mov eax, dword [0x1001f210]
xor eax, esp
mov dword [esp + 0x8a0], eax
push ebx
push esi
push edi
xor esi, esi
push 0x228
lea eax, [esp + 0x30]
push esi
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], esi
call fcn.10012120
add esp, 0xc
push 0x206
lea edx, [esp + 0x49e]
xor ecx, ecx
push esi
push edx
mov word [esp + 0x4a4], cx
call fcn.10012120
add esp, 0xc
push 0x206
lea ecx, [esp + 0x296]
xor eax, eax
push esi
push ecx
mov word [esp + 0x29c], ax
call fcn.10012120
add esp, 0xc
push 0x206
lea eax, [esp + 0x6a6]
xor edx, edx
push esi
push eax
mov word [esp + 0x6ac], dx
call fcn.10012120
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ebx, [esi + 2]
test eax, eax
je 0x10007e84
lea edx, [esp + 0x25c]
push edx
push str.SeDebugPrivilege
push esi
mov dword [esp + 0x264], 1
mov dword [esp + 0x270], ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0xc]
push esi
push esi
push 0x10
lea eax, [esp + 0x264]
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, 0xffffffff
jne 0x10007eae
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8a0]
xor ecx, esp
call fcn.1000bf42
mov esp, ebp
pop ebp
ret
push 0x400
push 0x40
mov dword [esp + 0x30], 0x22c
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [esp + 0x14], edi
mov byte [edi], 1
call fcn.10009880
mov eax, dword [0x1035dc04]
mov ecx, dword [eax]
mov dword [0x1035dc24], ecx
cmp ecx, eax
je 0x10007f9f
mov esi, dword [ecx + 0x10]
test esi, esi
je 0x10007f2d
cmp dword [esi + 0x14], 8
jb 0x10007efe
mov eax, dword [esi]
push eax
call fcn.1000bf37
add esp, 4
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push esi
mov word [esi], cx
call fcn.1000bf37
mov edx, dword [0x1035dc24]
mov dword [edx + 0x10], 0
mov ecx, dword [0x1035dc24]
add esp, 4
cmp byte [ecx + 0x15], 0
mov edx, ecx
jne 0x10007f7e
mov eax, dword [ecx + 8]
cmp byte [eax + 0x15], 0
jne 0x10007f5a
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x10007f52
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x10007f48
mov dword [0x1035dc24], ecx
jmp 0x10007f7e
mov eax, dword [ecx + 4]
cmp byte [eax + 0x15], 0
jne 0x10007f79
cmp ecx, dword [eax + 8]
jne 0x10007f79
mov ecx, eax
mov dword [0x1035dc24], ecx
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x10007f63
mov dword [0x1035dc24], eax
push edx
lea eax, [esp + 0x14]
push eax
call fcn.10009620
mov ecx, dword [0x1035dc24]
cmp ecx, dword [0x1035dc04]
jne 0x10007ee6
mov esi, dword [esp + 0xc]
push 0
push 0x10007c80
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1000831d
mov edx, dword [esp + 0x30]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], esi
test eax, eax
je 0x100082fa
cmp eax, 4
je 0x100082fa
cmp eax, 8
je 0x100082fa
lea eax, [esp + 0x24]
push eax
push 4
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
push 0x104
lea edx, [esp + 0x6a4]
push edx
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x10008036
push 0x1001c9d4
lea eax, [esp + 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x10008049
lea edx, [esp + 0x498]
lea ecx, [esp + 0x6a0]
call fcn.10007a30
push 0x208
lea ecx, [esp + 0x294]
push 0
push ecx
call fcn.10012120
add esp, 0xc
lea edx, [esp + 0x290]
push edx
mov ecx, esi
call fcn.10007850
test eax, eax
je 0x1000809c
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x290]
push eax
call esi
test eax, eax
jne 0x100080b5
push 0x1001c9dc
lea ecx, [esp + 0x294]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x100080b5
push 0x1001c9e4
lea edx, [esp + 0x294]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x4c]
push eax
call esi
lea ecx, [esp + 0x290]
push ecx
mov dword [esp + 0x14], eax
call esi
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 0x498]
add ecx, eax
push edx
mov dword [esp + 0x14], ecx
call esi
add eax, dword [esp + 0x10]
push edi
lea eax, [eax + eax + 0x223]
add eax, ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jae 0x10008114
push 0x42
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [esp + 0x14], eax
mov edi, eax
mov eax, dword [esp + 0x30]
mov dword [ebx + edi], eax
mov ecx, dword [esp + 0x30]
push ecx
call fcn.10007bb0
mov byte [ebx + edi + 4], al
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x24]
add ebx, 5
call fcn.100098e0
mov eax, dword [eax]
mov dword [0x1035dc24], eax
cmp eax, dword [0x1035dc04]
jne 0x10008163
add edi, ebx
mov ecx, 0x82
mov esi, 0x1001c5f0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x10008181
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x10008171
mov eax, dword [eax]
add ecx, ecx
push ecx
push eax
lea edx, [ebx + edi]
push edx
call fcn.100121a0
add esp, 0xc
lea eax, [esp + 0x4c]
push eax
call esi
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [ebx + edi + 0x208]
push eax
call fcn.100121a0
add esp, 0xc
lea ecx, [esp + 0x4c]
push ecx
call esi
lea edx, [esp + 0x498]
push edx
lea ebx, [ebx + eax*2 + 0x20a]
call esi
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x49c]
push ecx
lea edx, [ebx + edi]
push edx
call fcn.100121a0
add esp, 0xc
lea eax, [esp + 0x498]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
lea esi, [ebx + eax*2 + 2]
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi + edi], eax
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x290]
push eax
mov dword [esi + edi + 4], edx
call ebx
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x294]
push edx
lea eax, [esi + edi + 8]
push eax
call fcn.100121a0
add esp, 0xc
lea ecx, [esp + 0x290]
push ecx
call ebx
lea ebx, [esi + eax*2 + 0xa]
xor eax, eax
push 0x28
mov dword [esp + 0x26c], eax
lea edx, [esp + 0x26c]
mov dword [esp + 0x270], eax
mov dword [esp + 0x274], eax
mov dword [esp + 0x278], eax
mov dword [esp + 0x27c], eax
mov dword [esp + 0x280], eax
mov dword [esp + 0x284], eax
mov dword [esp + 0x288], eax
mov dword [esp + 0x28c], eax
mov dword [esp + 0x290], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x274], 0x28
call dword [sym.imp.PSAPI.DLL_GetProcessMemoryInfo]
test eax, eax
je 0x100082a7
mov eax, dword [esp + 0x274]
shr eax, 0xa
jmp 0x100082a9
xor eax, eax
push 0
push 0
push 3
push 0
push 1
push connect
lea ecx, [esp + 0x4b0]
push ecx
mov dword [ebx + edi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100082ed
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
shr eax, 0xa
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
jmp 0x100082ef
xor eax, eax
mov esi, dword [esp + 0x18]
mov dword [ebx + edi + 4], eax
add ebx, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10007fc0
mov esi, dword [esp + 0xc]
push 0x42
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
lea ecx, [esp + 0xc]
push ecx
push 0x28
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10008398
lea edx, [esp + 0x25c]
push edx
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x264], 1
mov dword [esp + 0x270], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea eax, [esp + 0x264]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x8ac]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000bf42
mov esp, ebp
pop ebp
ret