Function at 0x1000ca10
Capabilities:
Access peb ldr_data
Acquire debug privileges
Get system information on windows
Make suspicious ntquerysysteminformation call
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov eax, dword [0x1004a9ec]
test eax, eax
jne 0x1000ca39
call fcn.100044b0
mov al, byte [ebp - 0xd]
push ebx
push esi
push edi
push 0
lea ecx, [ebp - 0x6c]
mov byte [ebp - 0x6c], al
call fcn.10014b10
mov ecx, str.Process
test ecx, ecx
jne 0x1000ca59
xor edi, edi
jmp 0x1000ca77
mov cl, byte [str.Process]
mov eax, str.Process
test cl, cl
je 0x1000ca70
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000ca68
sub eax, str.Process
mov edi, eax
push 1
push edi
lea ecx, [ebp - 0x6c]
call fcn.100163c0
test al, al
je 0x1000cab0
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x1000caa7
mov edx, str.Process
test edx, edx
je 0x1000caa7
test edi, edi
je 0x1000caa7
mov ecx, edx
lea esi, [edi]
mov dl, byte [ecx]
mov byte [eax], dl
inc eax
inc ecx
dec esi
jne 0x1000ca9e
push edi
lea ecx, [ebp - 0x6c]
call fcn.100163a0
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x58]
push eax
push ecx
mov ecx, 0x1004a9e0
mov dword [ebp - 4], 0
call fcn.10015a10
mov esi, dword [eax]
push 1
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 0xffffffff
call fcn.10014b10
cmp esi, dword [0x1004a9e4]
je 0x1000d093
mov edx, dword [esi + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x1000
push 0x40
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x20], 0x1000
call esi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x1000d093
mov edi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x20]
push eax
push ecx
push ebx
push 0x10
call edi
test eax, eax
jge 0x1000cb5c
cmp eax, 0xc0000004
jne 0x1000d089
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x20]
push edx
push 0x40
call esi
mov ebx, eax
test ebx, ebx
jne 0x1000cb17
pop edi
mov dword [ebp - 0x18], ebx
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 1
push str.SeDebugPrivilege
mov dword [ebp - 0x18], ebx
call fcn.1002e3d0
mov eax, dword [ebx]
add esp, 8
xor edi, edi
test eax, eax
mov dword [ebp - 0x38], edi
jbe 0x1000d08c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0x3c]
shl eax, 4
lea esi, [eax + ebx]
mov eax, dword [eax + ebx + 4]
cmp eax, ecx
je 0x1000d067
mov edx, dword [ebp - 0x40]
xor ecx, ecx
mov cl, byte [esi + 8]
cmp ecx, edx
jne 0x1000d067
push eax
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x1000d067
push 2
xor edi, edi
mov di, word [esi + 0xa]
push 0
lea edx, [ebp - 0x14]
push 0
push edx
push 0xffffffffffffffff
push edi
push eax
mov dword [ebp - 0x54], edi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1000d05a
mov eax, dword [0x1004b4f4]
test eax, eax
jne 0x1000d00b
mov ecx, str.kernel32.dll
xor edi, edi
test ecx, ecx
mov dword [ebp - 0x1c], edi
je 0x1000cc42
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
push edi
push 0xffffffffffffffff
push ecx
push edi
push edi
call ebx
mov esi, eax
test esi, esi
je 0x1000cc42
lea edx, [esi + esi + 2]
push edx
call fcn.10030d66
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push esi
push edi
push 0xffffffffffffffff
push str.kernel32.dll
push 0
push 0
call ebx
mov word [edi + esi*2], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
test edi, edi
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x48], eax
jne 0x1000cc69
mov esi, dword [ecx + 0x18]
mov dword [ebp - 0x28], esi
jmp 0x1000ce6c
mov edx, ecx
cmp ecx, eax
mov dword [ebp - 0x28], edx
je 0x1000ce5b
jmp 0x1000cc7b
mov edi, dword [ebp - 0x1c]
mov ecx, dword [edx + 0x30]
cmp word [edi], 0
mov dword [ebp - 0x24], ecx
mov eax, edi
je 0x1000cc92
add eax, 2
cmp word [eax], 0
jne 0x1000cc89
mov edi, dword [ebp - 0x1c]
sub eax, edi
sar eax, 1
lea esi, [eax + eax + 2]
push esi
call fcn.10030d66
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [ebp - 0x34], ebx
mov ecx, esi
je 0x1000ccec
test ecx, ecx
je 0x1000ccc6
dec ecx
mov edx, edi
sub edx, ebx
lea esi, [ecx + 1]
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
dec esi
jne 0x1000ccbd
cmp word [ebx], 0
mov eax, ebx
je 0x1000ccec
mov cx, word [eax]
cmp cx, 0x61
jb 0x1000cce3
cmp cx, 0x7a
ja 0x1000cce3
add ecx, 0xffffffe0
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x1000ccce
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x1000ccf7
xor eax, eax
jmp 0x1000cd0c
cmp word [ecx], 0
mov eax, ecx
je 0x1000cd08
add eax, 2
cmp word [eax], 0
jne 0x1000ccff
sub eax, ecx
sar eax, 1
lea esi, [eax + eax + 2]
push esi
call fcn.10030d66
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp - 0x30], edi
mov ecx, esi
je 0x1000cd69
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x1000cd43
test ecx, ecx
je 0x1000cd43
mov edx, dword [ebp - 0x24]
dec ecx
mov eax, edi
sub edx, edi
lea esi, [ecx + 1]
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
dec esi
jne 0x1000cd3a
cmp word [edi], 0
mov eax, edi
je 0x1000cd69
mov cx, word [eax]
cmp cx, 0x61
jb 0x1000cd60
cmp cx, 0x7a
ja 0x1000cd60
add ecx, 0xffffffe0
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x1000cd4b
test ebx, ebx
jne 0x1000cd71
xor ecx, ecx
jmp 0x1000cd88
cmp word [ebx], 0
mov eax, ebx
je 0x1000cd82
add eax, 2
cmp word [eax], 0
jne 0x1000cd79
sub eax, ebx
sar eax, 1
mov ecx, eax
test edi, edi
jne 0x1000cd90
xor eax, eax
jmp 0x1000cda5
cmp word [edi], 0
mov eax, edi
je 0x1000cda1
add eax, 2
cmp word [eax], 0
jne 0x1000cd98
sub eax, edi
sar eax, 1
cmp ecx, eax
jle 0x1000cdb1
xor esi, esi
mov si, word [ebx + eax*2]
jmp 0x1000ce27
jge 0x1000cdbd
xor esi, esi
mov si, word [edi + ecx*2]
neg esi
jmp 0x1000ce27
test ebx, ebx
je 0x1000d077
test edi, edi
je 0x1000d077
lea edx, [ecx + ecx]
push 4
push edx
call fcn.1003114a
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
mov ebx, edx
add esp, 8
xor edx, edx
test eax, eax
jle 0x1000cdfc
mov ecx, dword [esi]
add esi, 4
sub ecx, dword [edi]
add edi, 4
test ecx, ecx
jne 0x1000ce4f
inc edx
cmp edx, eax
jl 0x1000cde9
test ebx, ebx
je 0x1000ce1d
xor edx, edx
mov ecx, esi
test ebx, ebx
jle 0x1000ce1d
sub edi, esi
movsx esi, byte [edi + ecx]
movsx eax, byte [ecx]
sub eax, esi
inc ecx
test eax, eax
jne 0x1000ce1f
inc edx
cmp edx, ebx
jl 0x1000ce0a
xor eax, eax
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x34]
mov esi, eax
push ebx
call fcn.10030d5b
push edi
call fcn.10030d5b
add esp, 8
test esi, esi
je 0x1000ce53
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov eax, dword [ebp - 0x48]
cmp edx, eax
mov dword [ebp - 0x28], edx
jne 0x1000cc78
jmp 0x1000ce5b
mov eax, ecx
jmp 0x1000ce1f
mov ecx, dword [ebp - 0x28]
mov esi, dword [ecx + 0x18]
jmp 0x1000ce5d
xor esi, esi
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], esi
push edx
call fcn.10030d5b
add esp, 4
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x7c]
lea eax, [eax + esi + 0x78]
test ecx, ecx
je 0x1000cffa
mov eax, dword [eax]
test eax, eax
je 0x1000cffa
mov ecx, dword [eax + esi + 0x20]
mov edx, dword [eax + esi + 0x24]
mov ebx, dword [eax + esi + 0x1c]
mov edi, dword [eax + esi + 0x14]
lea eax, [eax + esi + 0x14]
add ecx, esi
add edx, esi
add ebx, esi
test edi, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x50], eax
jbe 0x1000cffa
mov eax, str.GetProcessId
mov dword [ebp - 0x24], ecx
and eax, 0xffff0000
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x48], eax
jmp 0x1000ced0
mov eax, dword [ebp - 0x48]
mov dx, word [edx]
test eax, eax
mov dword [ebp - 0x4c], edx
jne 0x1000cef3
mov ecx, edx
and ecx, 0xffff
cmp ecx, str.GetProcessId
je 0x1000cfed
jmp 0x1000cfc1
mov eax, dword [ebp - 0x24]
mov ecx, str.GetProcessId
mov edi, dword [eax]
add edi, esi
test ecx, ecx
jne 0x1000cf07
xor eax, eax
jmp 0x1000cf23
mov cl, byte [str.GetProcessId]
mov eax, str.GetProcessId
test cl, cl
je 0x1000cf1e
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000cf16
sub eax, str.GetProcessId
test edi, edi
jne 0x1000cf2b
xor ecx, ecx
jmp 0x1000cf3a
cmp byte [edi], 0
mov ecx, edi
je 0x1000cf38
inc ecx
cmp byte [ecx], 0
jne 0x1000cf32
sub ecx, edi
cmp eax, ecx
jle 0x1000cf47
movsx eax, byte [ecx + str.GetProcessId]
jmp 0x1000cfbd
jge 0x1000cf51
movsx eax, byte [eax + edi]
neg eax
jmp 0x1000cfbd
mov edx, str.GetProcessId
test edx, edx
je 0x1000d080
test edi, edi
je 0x1000d080
push 4
push eax
call fcn.1003114a
mov ebx, edx
add esp, 8
xor edx, edx
mov esi, str.GetProcessId
test eax, eax
jle 0x1000cf91
mov ecx, dword [esi]
add esi, 4
sub ecx, dword [edi]
add edi, 4
test ecx, ecx
jne 0x1000cfe9
inc edx
cmp edx, eax
jl 0x1000cf7e
test ebx, ebx
je 0x1000cfb2
xor edx, edx
mov ecx, esi
test ebx, ebx
jle 0x1000cfb2
sub edi, esi
movsx esi, byte [edi + ecx]
movsx eax, byte [ecx]
sub eax, esi
inc ecx
test eax, eax
jne 0x1000cfb4
inc edx
cmp edx, ebx
jl 0x1000cf9f
xor eax, eax
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x4c]
test eax, eax
je 0x1000cfed
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
add ecx, 4
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x50]
inc eax
add edx, 2
mov edi, dword [ecx]
mov dword [ebp - 0x34], eax
cmp eax, edi
mov dword [ebp - 0x30], edx
jb 0x1000cecd
jmp 0x1000cffa
mov eax, ecx
jmp 0x1000cfb4
and edx, 0xffff
mov eax, dword [ebx + edx*4]
add eax, esi
jmp 0x1000cffc
xor eax, eax
test eax, eax
mov dword [0x1004b4f4], eax
je 0x1000d04d
mov edi, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x18]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [0x1004b4f4]
cmp eax, dword [ebp - 0x58]
jne 0x1000d050
mov ecx, dword [ebp - 0x2c]
push 1
push 0
lea eax, [ebp - 0x5c]
push 0
push eax
push 0xffffffffffffffff
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1000d050
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000d050
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x38]
mov eax, dword [ebx]
inc edi
cmp edi, eax
mov dword [ebp - 0x38], edi
jb 0x1000cb7d
jmp 0x1000d08c
push 0
push 0
call fcn.1003116f
push 0
push 0
call fcn.1003116f
mov dword [ebp - 0x18], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret