Function at 0x97d640
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0xe1c]
sub esp, 0xe1c
push 0xfffffffffffffffe
push 0xb13e58
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1040
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xe18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0xe24]
mov dword [ebp - 0x30], eax
mov esi, dword [ebp + 0xe28]
mov dword [ebp - 0x3c], esi
mov edi, dword [ebp + 0xe2c]
mov dword [ebp - 0x44], edi
mov ecx, dword [ebp + 0xe30]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp + 0xe38]
mov dword [ebp - 0x2c], edx
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4c], ebx
mov byte [ebp + 0xa08], bl
push 0x207
push ebx
lea eax, [ebp + 0xa09]
push eax
call fcn.00a7ffb0
mov byte [ebp + 0xc10], bl
push 0x207
push ebx
lea ecx, [ebp + 0xc11]
push ecx
call fcn.00a7ffb0
add esp, 0x18
mov dword [ebp - 0x20], ebx
cmp esi, ebx
je 0x97d702
mov dword [esi], ebx
cmp edi, ebx
je 0x97d708
mov byte [edi], bl
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x97dc26
cmp byte [eax], bl
je 0x97dc26
push 0x5c
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x97d731
mov dword [ebp - 0x4c], 1
mov eax, dword [0xc00c94]
cmp eax, ebx
jne 0x97d751
mov ecx, str.PSAPI.DLL
call fcn.0094c620
mov dword [0xc00c94], eax
cmp eax, ebx
je 0x97dc26
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0xc00c80], ebx
jne 0x97d771
push str.EnumProcesses
push eax
call esi
mov dword [0xc00c80], eax
mov eax, dword [0xc00c94]
cmp dword [0xc00c84], ebx
jne 0x97d78b
push str.EnumProcessModules
push eax
call esi
mov dword [0xc00c84], eax
mov eax, dword [0xc00c94]
cmp dword [0xc00c88], ebx
jne 0x97d7a5
push str.GetModuleBaseNameA
push eax
call esi
mov dword [0xc00c88], eax
mov eax, dword [0xc00c94]
cmp dword [0xc00c8c], ebx
jne 0x97d7bf
push str.GetModuleFileNameExA
push eax
call esi
mov dword [0xc00c8c], eax
mov eax, dword [0xc00c94]
cmp dword [0xc00c90], ebx
jne 0x97d7d9
push str.GetProcessImageFileNameA
push eax
call esi
mov dword [0xc00c90], eax
mov eax, dword [0xc00c94]
cmp dword [0xc00c80], ebx
je 0x97dc01
cmp dword [0xc00c88], ebx
je 0x97dc01
cmp dword [0xc00c84], ebx
je 0x97dc01
cmp dword [0xc00c8c], ebx
je 0x97dc01
mov ecx, str.SeDebugPrivilege
call fcn.0095fcc0
lea edx, [ebp - 0x54]
push edx
push 0x1000
lea eax, [ebp - 0x1058]
push eax
call dword [0xc00c80]
mov edi, dword [ebp - 0x54]
shr edi, 2
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x20], edi
jge 0x97dc49
mov byte [ebp + 0xc10], bl
mov byte [ebp + 0xa08], bl
mov eax, dword [ebp - 0x20]
lea eax, [ebp + eax*4 - 0x1058]
mov dword [ebp - 0x24], eax
mov ecx, dword [eax]
push ecx
push 0x20410
call fcn.0097af50
add esp, 8
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x97dacb
lea edx, [ebp - 0x58]
push edx
push 4
lea eax, [ebp - 0x40]
push eax
push esi
call dword [0xc00c84]
test eax, eax
je 0x97d969
push 0x208
lea ecx, [ebp + 0xa08]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push esi
call dword [0xc00c88]
push 0x208
lea eax, [ebp + 0xc10]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
push esi
call dword [0xc00c8c]
cmp byte [ebp + 0xc10], bl
je 0x97da24
push 4
push str.___
lea edx, [ebp + 0xc10]
push edx
call fcn.00a891c8
add esp, 0xc
test eax, eax
jne 0x97d8f2
lea eax, [ebp + 0xc14]
push eax
lea ecx, [ebp + 0xc10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea edx, [ebp + 0xc10]
push edx
call fcn.00977760
push 0x7e
lea eax, [ebp + 0xc10]
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x97da24
mov byte [ebp], bl
push 0x3ff
push ebx
lea ecx, [ebp + 1]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp], bl
push 0x400
lea edx, [ebp]
push edx
lea eax, [ebp + 0xc10]
push eax
call dword [str.__0uBlocked]
dec eax
cmp eax, 0x102
ja 0x97da24
lea ecx, [ebp]
push ecx
lea edx, [ebp + 0xc10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x97da24
mov eax, dword [0xc00c90]
cmp eax, ebx
je 0x97da24
push 0x208
lea ecx, [ebp + 0xc10]
push ecx
push esi
call eax
cmp byte [ebp + 0xc10], bl
je 0x97da24
lea ecx, [ebp + 0xc10]
call fcn.00971e30
push 0x7e
lea edx, [ebp + 0xc10]
push edx
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x97da07
mov byte [ebp + 0x400], bl
push 0x3ff
push ebx
lea eax, [ebp + 0x401]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp + 0x400], bl
push 0x400
lea ecx, [ebp + 0x400]
push ecx
lea edx, [ebp + 0xc10]
push edx
call dword [str.__0uBlocked]
dec eax
cmp eax, 0x206
ja 0x97da07
lea eax, [ebp + 0x400]
push eax
lea ecx, [ebp + 0xc10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp + 0xc10], bl
je 0x97da24
lea edx, [ebp + 0xa08]
push edx
lea ecx, [ebp + 0xc10]
call fcn.0095af90
add esp, 4
cmp dword [ebp - 0x4c], ebx
jne 0x97db25
cmp byte [ebp + 0xa08], bl
je 0x97dabc
mov eax, dword [ebp - 0x30]
lea ecx, [ebp + 0xa08]
cmp dword [ebp + 0xe34], ebx
jne 0x97da9e
call fcn.0094c330
mov edi, eax
mov dword [ebp - 0x28], edi
cmp edi, ebx
jne 0x97dabc
cmp dword [ebp - 0x2c], ebx
je 0x97dae4
push 0x8000
call fcn.00a7a155
add esp, 4
mov esi, eax
cmp esi, ebx
je 0x97dae4
mov byte [esi], bl
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
push eax
mov ecx, esi
call fcn.0097b4b0
cmp byte [esi], bl
je 0x97dad3
push ebx
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x97dad3
xor edi, edi
jmp 0x97dad8
push ebx
push eax
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x97dab5
xor edi, edi
mov dword [ebp - 0x28], edi
jmp 0x97da58
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x1c]
push eax
call fcn.00985290
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp - 0x50]
inc dword [ebp - 0x20]
jmp 0x97d832
mov edi, 1
mov dword [ebp - 0x28], edi
push esi
call fcn.00a78fec
add esp, 4
cmp edi, ebx
jne 0x97dabc
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x97daf6
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x44]
cmp ecx, ebx
je 0x97db0d
mov eax, dword [ebp - 0x48]
cmp eax, ebx
je 0x97db0d
push eax
mov edx, dword [ebp - 0x1c]
call fcn.0097d260
lea edx, [ebp - 0x1c]
push edx
call fcn.00985290
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], 1
jmp 0x97dc49
cmp byte [ebp + 0xc10], bl
je 0x97dabc
mov dword [ebp - 0x34], 1
mov byte [ebp + 0x800], bl
push 0x207
push ebx
lea eax, [ebp + 0x801]
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp + 0xc10]
push ecx
lea edx, [ebp + 0x800]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp + 0x800]
call fcn.00958390
push ebx
mov esi, dword [ebp - 0x30]
push esi
lea eax, [ebp + 0xc10]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x97dba1
push ebx
push esi
lea ecx, [ebp + 0x800]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x97dabc
xor edi, edi
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x2c], ebx
je 0x97dae4
push 0x8000
call fcn.00a7a155
add esp, 4
mov esi, eax
cmp esi, ebx
je 0x97dae4
mov byte [esi], bl
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
push eax
mov ecx, esi
call fcn.0097b4b0
cmp byte [esi], bl
je 0x97dbf4
push ebx
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x97dbf4
mov dword [ebp - 0x34], edi
jmp 0x97dadb
mov edi, 1
mov dword [ebp - 0x34], edi
jmp 0x97dadb
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0xc00c94], ebx
mov dword [0xc00c80], ebx
mov dword [0xc00c88], ebx
mov dword [0xc00c84], ebx
mov dword [0xc00c8c], ebx
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x97dc53
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe18]
xor ecx, ebp
call fcn.00a78f21
add ebp, 0xe1c
mov esp, ebp
pop ebp
ret 0x18