Function at 0x40dbb0
Capabilities:
Acquire debug privileges
Enumerate process modules
Enumerate processes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41142b
push eax
mov dword fs:[0], esp
sub esp, 0xdd0
push ebx
push ebp
push esi
push edi
push str.SeDebugPrivilege
call fcn.0040db50
mov ebp, dword [esp + 0xdf4]
add esp, 4
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 4]
cmp ebx, ebx
mov edi, ebx
je 0x40dc07
push edi
mov ecx, esi
call fcn.004050b0
add edi, 0x53c
add esi, 0x53c
cmp edi, ebx
jne 0x40dbef
mov eax, dword [ebp + 8]
mov ecx, ebp
push eax
push esi
call fcn.00402170
xor ebx, ebx
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x60]
mov dword [esp + 0x5c], ebx
push ebx
rep stosd dword es:[edi], eax
push 0xf
mov dword [ebp + 8], esi
mov dword [esp + 0x1c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x1c], esi
jne 0x40dc47
xor eax, eax
jmp 0x40deed
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40dee4
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x6c1]
mov byte [esp + 0x6c0], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x64]
stosw word es:[edi], ax
push ecx
push ebx
push 0x1f0fff
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dl, byte [esp + 0x13]
mov al, byte [esp + 0x13]
lea ecx, [esp + 0x5ac]
mov byte [esp + 0x5ac], dl
mov byte [esp + 0x5ad], al
mov byte [esp + 0x5b4], bl
call fcn.0040e7e0
cmp esi, ebx
mov dword [esp + 0xde8], ebx
je 0x40dd00
lea ecx, [esp + 0x28]
lea edx, [esp + 0xac0]
push ecx
push 0xc8
push edx
push esi
call sub.PSAPI.DLL_EnumProcessModules
mov eax, dword [esp + 0xac0]
cmp eax, ebx
je 0x40dd00
lea ecx, [esp + 0x6c0]
push 0x400
push ecx
push eax
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea edx, [esp + 0x80]
push 0x41750c
push edx
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 8
test eax, eax
lea eax, [esp + 0x80]
je 0x40dd2d
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x5bc]
push eax
push ecx
call edi
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x34]
push 0x28
push ecx
push esi
mov dword [esp + 0x5b4], edx
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x40], 0x28
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
setne al
cmp al, bl
je 0x40dd82
mov eax, dword [esp + 0x40]
shr eax, 0xa
mov dword [esp + 0x5a4], eax
jmp 0x40dd89
mov dword [esp + 0x5a4], ebx
lea edx, [esp + 0x6c0]
lea eax, [esp + 0x1a4]
push edx
push eax
call edi
mov esi, dword [esp + 0x14]
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x184]
inc esi
push ecx
push 1
push eax
mov ecx, ebp
mov dword [esp + 0x20], esi
call fcn.0040e8e0
mov eax, dword [esp + 0x5b0]
mov edx, dword [esp + 0x5b8]
cmp edx, ebx
mov dword [esp + 0xde8], 0xffffffff
mov ecx, dword [eax]
mov esi, eax
mov dword [esp + 0x18], ecx
je 0x40de38
mov edx, ecx
cmp ecx, edx
jne 0x40de38
mov edx, dword [eax + 4]
lea ecx, [esp + 0x5ac]
push edx
call fcn.00403d30
mov eax, dword [esp + 0x5b0]
mov ecx, dword [0x417a14]
lea edx, [esp + 0x20]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x5b0]
mov dword [esp + 0x5b8], ebx
push edx
mov dword [eax], eax
mov eax, dword [esp + 0x5b4]
lea ecx, [esp + 0x5b0]
mov dword [eax + 8], eax
call fcn.004020f0
mov eax, dword [esp + 0x5b0]
jmp 0x40de72
cmp ecx, eax
je 0x40de6e
lea eax, [esp + 0x30]
push ebx
push eax
lea ecx, [esp + 0x20]
call fcn.0040e880
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push ecx
push edx
lea ecx, [esp + 0x5b4]
call fcn.00403890
mov ecx, dword [esp + 0x18]
cmp ecx, esi
jne 0x40de3c
mov eax, dword [esp + 0x5b0]
mov dword [esp + 0x20], ecx
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x24]
mov dword [esp + 0x5b0], ebx
mov dword [esp + 0x5b8], ebx
xor esi, esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
mov eax, dword [0x417a18]
dec eax
mov dword [0x417a18], eax
jne 0x40deae
mov esi, dword [0x417a14]
mov dword [0x417a14], ebx
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp esi, ebx
je 0x40dec5
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x5c]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40dc62
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0xde0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xddc
ret