Function at 0x404127
Capabilities:
Acquire debug privileges
Enumerate process modules

Disassembly:
push 0x268
mov eax, 0x448d57
call fcn.004386f7
mov eax, dword [ebp + 8]
push 0x20
mov dword [ebp - 0x250], eax
pop eax
xor edi, edi
mov esi, eax
mov dword [ebp - 0x248], eax
push 4
pop ebx
test edi, edi
je 0x40415a
push edi
call fcn.00439656
pop ecx
add esi, esi
xor ecx, ecx
mov eax, esi
shr eax, 2
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043769c
pop ecx
mov edi, eax
lea eax, [ebp - 0x248]
push eax
push esi
push edi
call sub.PSAPI.DLL_EnumProcesses
mov ebx, dword [ebp - 0x248]
cmp esi, ebx
jbe 0x40414c
push 1
shr ebx, 2
push str.SeDebugPrivilege
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x25c], ebx
call fcn.00404ebd
pop ecx
pop ecx
test eax, eax
jne 0x4041c4
push str.SetTokenPrivileges_failed._n
push str.GetProcessModuleFileNames
push 4
pop eax
push eax
call fcn.00405a24
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x244], eax
test ebx, ebx
je 0x404533
mov esi, dword [edi + eax*4]
push esi
push str.GetProcessID___1_d___n
push str.GetProcessModuleFileNames
push 4
pop eax
push eax
call fcn.00405a24
add esp, 0x10
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x234], eax
test eax, eax
jne 0x404228
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_failed.___1_d___n
push str.GetProcessModuleFileNames
push 4
pop eax
push eax
call fcn.00405a24
add esp, 0x10
jmp 0x40451e
push str.GetProcessHandle.__n
push str.GetProcessModuleFileNames
push 4
pop eax
push eax
call fcn.00405a24
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x23c], ebx
mov esi, ebx
call fcn.00438dc0
add esp, 0x18
xor eax, eax
push ebx
push 0x44d8ac
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.00401db2
mov edi, dword [ebp - 0x234]
push 0x20
pop eax
mov dword [ebp - 4], ebx
mov ebx, eax
mov dword [ebp - 0x23c], eax
test esi, esi
je 0x4042ac
push esi
call fcn.00439656
pop ecx
add ebx, ebx
xor ecx, ecx
push 4
mov eax, ebx
shr eax, 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043769c
pop ecx
mov esi, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
push esi
push edi
call sub.PSAPI.DLL_EnumProcessModules
mov eax, dword [ebp - 0x23c]
cmp ebx, eax
jbe 0x4042a1
and dword [ebp - 0x238], 0
mov edi, dword [ebp - 0x24c]
shr eax, 2
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x258], eax
test eax, eax
je 0x4044ee
mov edi, dword [ebp - 0x238]
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [esi + edi*4]
push dword [ebp - 0x234]
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.00439299
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4044d5
mov eax, dword [ebp + 0xc]
add ebx, 2
test eax, eax
je 0x404440
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [ebp - 0x240], edx
cmp edx, ecx
je 0x4044d5
mov edi, dword [ebp - 0x250]
mov esi, eax
mov eax, dword [edx + 0x20]
add edx, 0x10
cmp dword [edx + 0x14], 8
jb 0x404377
mov edx, dword [edx]
push eax
push edx
push ebx
call fcn.004394ab
add esp, 0xc
test eax, eax
jne 0x404416
cmp word [ebp - 0x218], ax
je 0x4043a0
lea eax, [ebp - 0x218]
push eax
call fcn.0043860f
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401db2
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push 0x4391c3
lea eax, [ecx + eax*2]
lea edx, [ebp - 0x230]
cmovae edx, dword [ebp - 0x230]
push edx
push eax
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push ecx
lea eax, [ebp - 0x264]
push eax
call fcn.00403375
add esp, 0x14
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x26c]
push eax
mov ecx, edi
call fcn.00405858
lea ecx, [ebp - 0x240]
call fcn.004138a8
mov edx, dword [ebp - 0x240]
cmp edx, dword [esi]
jne 0x404369
mov esi, dword [ebp - 0x254]
mov edi, dword [ebp - 0x238]
jmp 0x4044d5
cmp word [ebp - 0x218], 0
jne 0x40444e
xor eax, eax
jmp 0x40445b
lea eax, [ebp - 0x218]
push eax
call fcn.0043860f
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401db2
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push 0x4391c3
lea eax, [ecx + eax*2]
lea edx, [ebp - 0x230]
cmovae edx, dword [ebp - 0x230]
push edx
push eax
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push ecx
lea eax, [ebp - 0x260]
push eax
call fcn.00403375
mov ecx, dword [ebp - 0x250]
add esp, 0x14
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.00405858
inc edi
mov dword [ebp - 0x238], edi
cmp edi, dword [ebp - 0x258]
jb 0x40430d
mov edi, dword [ebp - 0x24c]
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x404505
push esi
call fcn.00439656
pop ecx
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00401ba5
mov ebx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp eax, ebx
jb 0x4041d4
push 0
push str.SeDebugPrivilege
call fcn.00404ebd
pop ecx
pop ecx
test eax, eax
jne 0x40455b
push str.SetTokenPrivileges_failed._n
push str.GetProcessModuleFileNames
push 4
pop eax
push eax
call fcn.00405a24
add esp, 0xc
test edi, edi
je 0x404566
push edi
call fcn.00439656
pop ecx
xor eax, eax
inc eax
call fcn.004386a6
ret