Function at 0x401160
Capabilities:
Acquire debug privileges
Create thread
Enumerate processes
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6bc
mov eax, dword [0x416004]
xor eax, esp
mov dword [esp + 0x6b8], eax
push ebx
push esi
push edi
lea eax, [esp + 0x478]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x401211
mov eax, dword [esp + 0x478]
mov ecx, dword [esp + 0x47c]
mov dword [esp + 0x484], eax
lea eax, [esp + 0x474]
push eax
push 0x20
mov dword [esp + 0x488], 1
mov dword [esp + 0x490], ecx
mov dword [esp + 0x494], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401211
push 0
push 0
push 0x10
lea eax, [esp + 0x48c]
push eax
push 0
push dword [esp + 0x488]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x401241
push dword [esp + 0x474]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Failure
push str.Failed_to_adjust_privileges_to_debug
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6b8]
xor ecx, esp
call fcn.00401ebc
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x474]
cmp eax, 0x514
je 0x40120b
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push 0
push 0
push 0x401600
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [esp + 0x474], eax
nop
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4012a7
push 0x22c
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00403330
jmp 0x40133b
push 0x228
lea eax, [esp + 0x498]
mov dword [esp + 0x494], 0x22c
push 0
push eax
call fcn.00403330
add esp, 0xc
lea eax, [esp + 0x490]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40130c
nop dword [eax]
lea eax, [esp + 0x4b4]
push str.MirrorsEdge.exe
push eax
call fcn.004051e1
add esp, 8
test eax, eax
je 0x401391
lea eax, [esp + 0x490]
push eax
push esi
call ebx
test eax, eax
jne 0x4012e0
push esi
call edi
push 0x22c
lea eax, [esp + 0x244]
push 0
push eax
call fcn.00403330
mov ecx, 0x8b
lea esi, [esp + 0x24c]
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401381
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401403
mov edx, str.mmultiplayer.dll
mov ecx, esi
call fcn.00401610
test al, al
jne 0x4013e7
mov edx, str.openal32.dll
mov ecx, esi
call fcn.00401610
test al, al
jne 0x4013ae
push esi
call edi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401280
push esi
call edi
mov ecx, 0x8b
lea esi, [esp + 0x490]
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40133e
push 0
push dword [esp + 0x478]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.00401430
push esi
mov bl, al
call edi
xor eax, eax
test bl, bl
sete al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6b8]
xor ecx, esp
call fcn.00401ebc
mov esp, ebp
pop ebp
ret 0x10
push esi
call edi
mov ecx, dword [esp + 0x6c4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401ebc
mov esp, ebp
pop ebp
ret 0x10
push 0
push dword [esp + 0x478]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push str.Failure
push str.Failed_to_open_a_handle_to_the_process
jmp 0x40121d