Function at 0x4cb110
Capabilities:
Acquire debug privileges
Check os version
Get common file path
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x6083bb
mov eax, dword fs:[0]
push eax
mov eax, 0x2678
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x2674], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6aae14]
xor eax, esp
push eax
lea eax, [esp + 0x268c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x269c]
mov edi, dword [esp + 0x26a4]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x48], eax
mov dword [esp + 0x14], edi
call fcn.004f29c0
xor ebp, ebp
push 0x90
lea ecx, [esp + 0x1118]
push ebp
push ecx
mov dword [esp + 0x26a0], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x111c], ebp
call fcn.005dfd60
mov dword [esp + 0x24], ebp
call fcn.004d96c0
push 0x103
lea edx, [esp + 0x1595]
push ebp
push edx
mov dword [esp + 0x50], eax
mov byte [esp + 0x159c], 0
call fcn.005dfd60
add esp, 0x18
push 0x643dcc
push 0x61bed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [esp + 0x40], eax
lea eax, [esp + 0x1110]
push eax
mov dword [esp + 0x1114], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4cb215
cmp edi, ebp
je 0x4cbc2e
push str.GetVersion_Failed_
push edi
call fcn.004f0f30
add esp, 8
jmp 0x4cbc2e
push 0x104
lea ecx, [esp + 0x1588]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [esp + 0x1584], 0
je 0x4cb242
lea edx, [esp + 0x1584]
push edx
call fcn.004e24e0
add esp, 4
mov eax, dword [esp + 0x1120]
cmp eax, 2
jne 0x4cb9bf
push 0x643dac
call fcn.004f4be0
mov ebx, eax
mov dword [esp + 0x58], ebx
cmp ebx, ebp
jne 0x4cb281
cmp edi, ebp
je 0x4cbc2e
push str.Load_Library_of_psapi.dll_failed_
push edi
call fcn.004f0f30
add esp, 8
jmp 0x4cbc2e
push str.VDMDBG.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x643d6c
mov ebp, eax
push ebx
mov dword [esp + 0x44], ebp
call esi
push 0x643d58
push ebx
mov edi, eax
call esi
push 0x643d40
push ebx
mov dword [esp + 0x5c], eax
call esi
push 0x643d2c
push ebx
mov dword [esp + 0x30], eax
call esi
push 0x643d10
push ebx
call esi
mov dword [esp + 0x4c], eax
test edi, edi
je 0x4cb990
cmp dword [esp + 0x54], 0
je 0x4cb990
cmp dword [esp + 0x28], 0
je 0x4cb990
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ebp, ebp
mov eax, 0x400
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x1c], eax
jmp 0x4cb300
test ebp, ebp
je 0x4cb31e
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
add eax, eax
mov dword [esp + 0x1c], eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
mov ebp, eax
test ebp, ebp
je 0x4cb4e5
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
push eax
push ecx
push ebp
call edi
test eax, eax
je 0x4cb518
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4cb300
shr ecx, 2
cmp dword [esp + 0x14], 0
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ecx
je 0x4cb37e
mov edx, dword [esp + 0x14]
push ecx
push str.No_of_processes:__d
push edx
call fcn.004f0f30
mov ecx, dword [esp + 0x38]
add esp, 0xc
mov eax, dword [esp + 0x26a8]
test eax, eax
je 0x4cb38f
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], 0
test ecx, ecx
jbe 0x4cb95f
mov ebp, dword [esp + 0x34]
cmp dword [esp + 0x18], 0
jne 0x4cb95f
cmp dword [ebp], 0
jbe 0x4cb94b
mov eax, dword [esp + 0x26a8]
test eax, eax
je 0x4cb3c9
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1688], 0
mov edx, dword [ebp]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x4cb5db
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edi, eax
cmp edi, 5
jne 0x4cb5aa
push 0x90
lea eax, [esp + 0x12d4]
push 0
push eax
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 0x12cc]
push ecx
mov dword [esp + 0x12d0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebx, 2
cmp dword [esp + 0x12dc], ebx
jne 0x4cb5aa
lea edx, [esp + 0x20]
push edx
push 0
push 0x28
mov dword [esp + 0x50], 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4cb48c
call esi
cmp eax, 0x3f0
jne 0x4cb5aa
lea eax, [esp + 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4cb5aa
lea ecx, [esp + 0x60]
push ecx
push 0x643ce8
push 0
mov dword [esp + 0x68], 1
mov dword [esp + 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea edx, [esp + 0x44]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x104]
push eax
push 0x10
lea ecx, [esp + 0x68]
push ecx
push 0
push edx
call ebx
test eax, eax
jne 0x4cb55b
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4cb5aa
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4cb4fb
push str.HeadAlloc_for_lpdwPIDs_failed_
push eax
call fcn.004f0f30
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call esi
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4cbc2e
push eax
call esi
jmp 0x4cbc2e
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4cb52e
push str.lpfEnumProcesses_failed_
push eax
call fcn.004f0f30
add esp, 8
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call esi
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4cbc2e
push eax
call esi
jmp 0x4cbc2e
call esi
cmp eax, 0x514
jne 0x4cb571
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4cb5aa
mov edx, dword [ebp]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x20]
push 0
push 0
push 0x10
mov esi, eax
lea eax, [esp + 0x10c]
push eax
push 0
push ecx
call ebx
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x4cb5db
call fcn.004d9b00
test eax, eax
je 0x4cb929
cmp edi, 5
jne 0x4cb929
mov eax, dword [ebp]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4cb929
xor ebx, ebx
cmp dword [esp + 0x38], ebx
je 0x4cb606
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x4cb606
lea ecx, [esp + 0x50]
push ecx
push esi
mov dword [esp + 0x58], ebx
call eax
test eax, eax
je 0x4cb606
xor edx, edx
cmp dword [esp + 0x50], ebx
sete dl
mov ebx, edx
cmp dword [0x72bb8c], 1
mov edi, dword [esp + 0x4c]
je 0x4cb61b
test edi, edi
jne 0x4cb7f7
lea eax, [esp + 0x1c]
push eax
push 0x1000
lea ecx, [esp + 0x118]
push ecx
push esi
call dword [esp + 0x64]
test eax, eax
je 0x4cb7ef
xor edi, edi
test dword [esp + 0x1c], 0xfffffffc
jbe 0x4cb91e
lea ebx, [ebx]
cmp dword [esp + 0x18], 0
jne 0x4cb91e
mov eax, dword [esp + 0x26a8]
test eax, eax
je 0x4cb66c
mov edx, dword [eax]
mov dword [esp + 0x18], edx
mov ecx, dword [esp + edi*4 + 0x110]
push 0x400
lea eax, [esp + 0x168c]
push eax
push ecx
push esi
call dword [esp + 0x38]
test eax, eax
jne 0x4cb691
mov byte [esp + 0x1688], al
lea edx, [esp + 0x1688]
push 0x7e
push edx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4cb6e2
push 0x800
lea eax, [esp + 0x1e8c]
push eax
lea ecx, [esp + 0x1690]
push ecx
call fcn.004d8160
dec eax
add esp, 0xc
cmp eax, 0x3fe
ja 0x4cb6e2
lea edx, [esp + 0x1e88]
push edx
lea eax, [esp + 0x168c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x1688], 0
je 0x4cb7da
lea ecx, [esp + 0x1688]
push 0x5c
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4cb7da
cmp dword [esp + 0x38], 0
je 0x4cb754
test ebx, ebx
jne 0x4cb754
cmp byte [esp + 0x1584], bl
je 0x4cb754
lea edx, [esp + 0x1584]
push edx
lea eax, [esp + 0x168c]
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4cb754
push str.SysWOW64_
lea ecx, [esp + 0x168c]
push 0x61b108
push ecx
call fcn.004e9030
add esp, 0xc
test edi, edi
jne 0x4cb789
mov ecx, dword [ebp]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x70]
push eax
push ecx
push 0x72c268
push edx
push 1
lea eax, [esp + 0x16a0]
push eax
push 0x72bb88
call fcn.004cb040
add esp, 0x20
jmp 0x4cb7d0
lea ecx, [esp + 0x1688]
push ecx
lea edx, [esp + 0x1e8c]
push 0x643c9c
push edx
call fcn.005dfb23
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x7c]
push ecx
push 0
push 0x72c268
push edx
push 1
lea eax, [esp + 0x1eac]
push eax
push 0x72bb88
call fcn.004cb040
add esp, 0x2c
test eax, eax
je 0x4cb7da
inc dword [0x7495a4]
mov ecx, dword [esp + 0x1c]
inc edi
shr ecx, 2
cmp edi, ecx
jb 0x4cb650
jmp 0x4cb91e
test edi, edi
je 0x4cb91e
push 0x400
lea edx, [esp + 0x168c]
push edx
push esi
call edi
cmp byte [esp + 0x1688], 0
je 0x4cb91e
lea eax, [esp + 0x1688]
push eax
call fcn.00502ab0
lea ecx, [esp + 0x1688]
push 0x7e
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4cb873
push 0x400
lea edx, [esp + 0x1a8c]
push edx
lea eax, [esp + 0x1690]
push eax
call fcn.004d8160
dec eax
add esp, 0xc
cmp eax, 0x3fe
ja 0x4cb873
lea ecx, [esp + 0x1a88]
push ecx
lea edx, [esp + 0x168c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x1688], 0
je 0x4cb91e
lea eax, [esp + 0x1688]
push 0x5c
push eax
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4cb91e
cmp dword [esp + 0x38], 0
je 0x4cb8e5
test ebx, ebx
jne 0x4cb8e5
cmp byte [esp + 0x1584], bl
je 0x4cb8e5
lea ecx, [esp + 0x1584]
push ecx
lea edx, [esp + 0x168c]
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4cb8e5
push str.SysWOW64_
lea eax, [esp + 0x168c]
push 0x61b108
push eax
call fcn.004e9030
add esp, 0xc
mov eax, dword [ebp]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x70]
push edx
push eax
push 0x72c268
push ecx
push 1
lea edx, [esp + 0x16a0]
push edx
push 0x72bb88
call fcn.004cb040
add esp, 0x20
test eax, eax
je 0x4cb91e
inc dword [0x7495a4]
test esi, esi
je 0x4cb929
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x26a0]
mov edx, dword [ebp]
push eax
lea ecx, [esp + 0x168c]
push ecx
push 0
push edx
call dword [esp + 0x58]
test eax, eax
je 0x4cb95f
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
inc eax
add ebp, 4
mov dword [esp + 0x30], eax
cmp eax, ecx
jb 0x4cb3a3
mov eax, dword [esp + 0x34]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4cbc20
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x58]
push ecx
jmp 0x4cbc28
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4cb9a6
push str.One_of_the_EnumProcesses_functions_is_NULL_
push eax
call fcn.004f0f30
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call esi
test ebp, ebp
je 0x4cbc2e
push ebp
call esi
jmp 0x4cbc2e
cmp eax, 1
jne 0x4cbc2e
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
mov dword [esp + 0x58], ebp
test ebp, ebp
je 0x4cbc2e
push str.CreateToolhelp32Snapshot
push ebp
call esi
push str.Process32First
push ebp
mov dword [esp + 0x38], eax
call esi
push str.Process32Next
push ebp
mov edi, eax
call esi
push str.Module32First
mov ebx, eax
push ebp
mov dword [esp + 0x4c], ebx
call esi
push str.Module32Next
push ebp
mov dword [esp + 0x30], eax
call esi
mov dword [esp + 0x40], eax
test ebx, ebx
je 0x4cbc27
test edi, edi
je 0x4cbc27
cmp dword [esp + 0x28], 0
je 0x4cbc27
test eax, eax
je 0x4cbc27
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4cbc27
push 0
push 2
call eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4cbc27
lea ecx, [esp + 0x11a4]
push ecx
push ebx
mov dword [esp + 0x11ac], 0x128
call edi
mov edi, dword [esp + 0x26a8]
test edi, edi
je 0x4cba84
mov edx, dword [edi]
mov dword [esp + 0x18], edx
test eax, eax
je 0x4cbc19
mov ebp, 0x224
cmp dword [esp + 0x18], 0
jne 0x4cbc19
test edi, edi
je 0x4cbaa6
mov eax, dword [edi]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x26a0]
mov eax, dword [esp + 0x11ac]
push ecx
lea edx, [esp + 0x11cc]
push edx
push 0
push eax
call dword [esp + 0x58]
test eax, eax
je 0x4cbc19
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x11c8]
mov byte [esp + eax + 0x1688], cl
inc eax
test cl, cl
jne 0x4cbad0
cmp byte [esp + 0x1688], cl
je 0x4cbb3f
lea ecx, [esp + 0x1688]
push 0x5c
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4cbb3f
mov ecx, dword [esp + 0x11ac]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x70]
push eax
push ecx
push 0x72c268
push edx
push 1
lea eax, [esp + 0x16a0]
push eax
push 0x72bb88
call fcn.004cb040
add esp, 0x20
test eax, eax
je 0x4cbb3f
inc dword [0x7495a4]
mov ecx, dword [esp + 0x11ac]
push ecx
push 8
call dword [esp + 0x38]
mov esi, eax
cmp esi, 0xffffffff
je 0x4cbbf9
lea edx, [esp + 0x1360]
push edx
push esi
mov dword [esp + 0x1368], ebp
call dword [esp + 0x30]
test eax, eax
je 0x4cbbf2
cmp dword [esp + 0x18], 0
jne 0x4cbbf2
test edi, edi
je 0x4cbb85
mov eax, dword [edi]
mov dword [esp + 0x18], eax
xor eax, eax
jmp 0x4cbb90
mov cl, byte [esp + eax + 0x1380]
mov byte [esp + eax + 0x1688], cl
inc eax
test cl, cl
jne 0x4cbb90
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x70]
push edx
push 0
push 0x72c268
push eax
push 1
lea ecx, [esp + 0x16a0]
push ecx
push 0x72bb88
call fcn.004cb040
add esp, 0x20
test eax, eax
je 0x4cbbda
inc dword [0x7495a4]
lea edx, [esp + 0x1360]
push edx
push esi
mov dword [esp + 0x1368], ebp
call dword [esp + 0x48]
test eax, eax
jne 0x4cbb74
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x11a4]
push eax
push ebx
mov dword [esp + 0x11ac], 0x128
call dword [esp + 0x4c]
test eax, eax
jne 0x4cba91
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x58]
push ecx
jmp 0x4cbc28
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x6c]
call fcn.004fb1f0
mov esi, dword [0x7495a4]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x2694], 0xffffffff
call fcn.00503fb0
mov eax, esi
mov ecx, dword [esp + 0x268c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2674]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x2684
ret 0x10