Function at 0x1000c6c0
Capabilities:
Acquire debug privileges
Enumerate process modules
Enumerate processes
Get file size
Get process image filename

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb44
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [esp + 0x84]
push 0x228
push ebx
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0x948]
push 0x208
push ebx
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea edi, [esp + 0x20]
xor eax, eax
xor edx, edx
inc edx
push 0xa
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, str.SeDebugPrivilege
mov edi, dword [eax]
mov dword [esp + 0x1c], edi
call fcn.1000e88c
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c9c8
call fcn.100030eb
mov ebx, eax
mov dword [esp + 0x80], 0x22c
lea eax, [esp + 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x1000c933
push dword [esp + 0x88]
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ecx, dword [esp + 0x88]
mov edi, eax
mov dword [esp + 0x10], edi
test ecx, ecx
je 0x1000c90d
cmp ecx, 4
je 0x1000c90d
cmp ecx, 8
je 0x1000c90d
push 0x694
lea eax, [esp + 0x2b4]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
mov eax, dword [esp + 0x88]
push edi
mov dword [esp + 0x4bc], eax
call dword [sym.imp.KERNEL32.DLL_GetPriorityClass]
mov dword [esp + 0x4bc], eax
lea edx, [esp + 0x4c4]
mov eax, dword [esp + 0x94]
mov ecx, edi
mov dword [esp + 0x4c0], eax
call fcn.1000edf7
lea eax, [esp + 0x528]
push eax
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
push 0xa
pop ecx
xor eax, eax
lea edi, [esp + 0x20]
push 0x28
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
pop eax
push eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_K32GetProcessMemoryInfo]
test eax, eax
je 0x1000c84f
mov eax, dword [esp + 0x2c]
shr eax, 0xa
mov dword [esp + 0x52c], eax
jmp 0x1000c857
and dword [esp + 0x52c], 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_K32EnumProcessModules]
push 0x104
lea eax, [esp + 0x94c]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_K32GetProcessImageFileNameW]
test eax, eax
jne 0x1000c897
push 0x1004b0f4
lea eax, [esp + 0x538]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
jmp 0x1000c8aa
lea edx, [esp + 0x534]
lea ecx, [esp + 0x948]
call fcn.1000ec69
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push SysReAllocString
lea eax, [esp + 0x54c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000c8ed
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
shr eax, 0xa
mov dword [esp + 0x530], eax
test edi, edi
je 0x1000c8f5
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1000c8f5
and dword [esp + 0x530], 0
push 0x694
lea eax, [esp + 0x2b4]
push eax
push ebx
call dword [ebx + 0x14]
mov edi, dword [esp + 0x1c]
add esp, 0xc
test edi, edi
je 0x1000c918
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x1000c763
mov edi, dword [esp + 0x1c]
xor edx, edx
mov ecx, str.SeDebugPrivilege
call fcn.1000e88c
test esi, esi
je 0x1000c94a
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x38
lea eax, [esp + 0x4c]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [esp + 0x7c], 0x2072024
mov dword [esp + 0x6c], 0x5000
push ebx
call dword [ebx + 0x18]
and dword [esp + 0x7c], 0
pop ecx
mov dword [esp + 0x70], eax
call fcn.100030eb
mov esi, eax
lea eax, [esp + 0x48]
push 0x38
push eax
push esi
call dword [esi + 0x14]
add esp, 0xc
push ebx
call dword [ebx + 0x18]
pop ecx
push eax
push 0
push ebx
call dword [ebx + 0x1c]
pop ecx
pop ecx
push eax
push esi
call dword [esi + 0x14]
add esp, 0xc
push esi
call dword [esi + 0x18]
pop ecx
push eax
push 0
push esi
call dword [esi + 0x1c]
pop ecx
pop ecx
push eax
push edi
call dword [edi + 0x18]
add esp, 0xc
mov ecx, ebx
call fcn.100031f9
mov ecx, esi
call fcn.100031f9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret