Function at 0x100099c0
Capabilities:
Acquire debug privileges
Enumerate process modules
Enumerate processes

Disassembly:
sub rsp, 0x2c8
mov rax, qword [0x1001b2a8]
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x2b8], r12
xor r12d, r12d
lea rcx, [rsp + 0x64]
xor edx, edx
mov r8d, 0x12c
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x60], r12d
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x190], r12b
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
lea edx, [r12 + 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10009a8d
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x30]
lea r9d, [r12 + 0x10]
lea r8, [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov qword [rsp + 0x2e8], rsi
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rsi, rax
jne 0x10009aaf
xor eax, eax
jmp 0x10009ce5
mov qword [rsp + 0x2d8], rbx
mov edx, 0x400
mov ecx, 0x40
mov qword [rsp + 0x2e0], rbp
mov dword [rsp + 0x60], 0x130
mov qword [rsp + 0x2c0], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov byte [rax], 0x7d
mov rdi, rax
mov ebp, 1
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10009c3c
nop
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [rsp + 0x68]
test ecx, ecx
mov rbx, rax
je 0x10009c27
cmp ecx, 4
je 0x10009c27
cmp ecx, 8
je 0x10009c27
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
mov rdx, qword [rsp + 0x48]
lea r8, [rsp + 0x190]
mov r9d, 0x104
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExA
lea rcx, [rsp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x190]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rdi
lea ebx, [rbx + rax + 6]
add ebx, ebp
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp rax, rbx
jae 0x10009bad
mov r8d, 0x42
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rdi, rax
mov eax, dword [rsp + 0x68]
mov ecx, ebp
add ebp, 4
mov dword [rcx + rdi], eax
lea rcx, [rsp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, ebp
lea rdx, [rsp + 0x8c]
inc eax
add rcx, rdi
movsxd r8, eax
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x190]
lea ebx, [rbp + rax + 1]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, ebx
inc eax
lea rdx, [rsp + 0x190]
add rcx, rdi
movsxd r8, eax
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [rbx + rax + 1]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10009b00
mov edx, ebp
mov r8d, 0x42
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rdi, qword [rsp + 0x2c0]
mov rbp, qword [rsp + 0x2e0]
test eax, eax
je 0x10009cd1
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], r12d
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, reloc.WS2_32.dll_recv
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x2d8]
mov r12, qword [rsp + 0x2b8]
mov rsi, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2a0]
call fcn.100120f0
add rsp, 0x2c8
ret