Function at 0x466720
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d141b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2294
call fcn.004b5fc0
mov eax, dword [0x50cc94]
xor eax, esp
mov dword [esp + 0x2290], eax
push ebx
push esi
push edi
mov eax, dword [0x50cc94]
xor eax, esp
push eax
lea eax, [esp + 0x22a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
push str.psapi.dll
mov dword [esp + 0x44], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x466b08
push str.SeDebugPrivilege
call fcn.00466650
add esp, 4
push str.EnumProcesses
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov ecx, dword [esp + 0x1c]
push str.EnumProcessModules
push ecx
mov ebx, eax
call edi
mov edx, dword [esp + 0x1c]
push str.GetModuleFileNameExW
push edx
mov dword [esp + 0x40], eax
call edi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x2c]
push eax
push 0x400
lea ecx, [esp + 0x9c]
push ecx
call ebx
mov ebx, dword [esp + 0x2c]
shr ebx, 2
mov dword [esp + 0x44], ebx
mov dword [esp + 0x30], 0
test ebx, ebx
jle 0x466af9
lea edx, [esp + 0x94]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [esp + 0x34], edi
test edi, edi
je 0x466ae3
lea edx, [esp + 0x2c]
push edx
push 0x10
lea eax, [esp + 0x5c]
push eax
push edi
call dword [esp + 0x48]
xor eax, eax
mov dword [esp + 0x28], eax
jmp 0x466854
mov edi, dword [esp + 0x34]
mov edx, dword [esp + eax*4 + 0x54]
push 0x104
lea ecx, [esp + 0x2098]
push ecx
push edx
push edi
call dword [esp + 0x4c]
test eax, eax
jne 0x46687a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x466ac2
cmp dword [ebp + 0xc], 0
je 0x4668e0
lea eax, [esp + 0x2094]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x466890
sub eax, edx
sar eax, 1
mov edi, eax
js 0x4668d7
jmp 0x4668b0
movzx eax, word [esp + edi*2 + 0x2094]
cmp ax, 0x5c
je 0x4668d7
movzx eax, ax
push eax
call fcn.004b3c86
add esp, 4
sub edi, 1
mov word [esp + edi*2 + 0x2096], ax
jns 0x4668b0
lea edi, [esp + edi*2 + 0x2096]
jmp 0x4668e7
lea edi, [esp + 0x2094]
mov ebx, dword [esp + 0x40]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edi
push ebx
push str.Looking_for___s_:__s
push ecx
call fcn.00468c80
add esp, 0x10
call fcn.004665e0
add esp, 4
push ebx
push edi
call fcn.004af6c3
add esp, 8
test eax, eax
jne 0x466ac2
push ecx
mov ebx, esp
mov dword [esp + 0x24], esp
mov dword [esp + 0x4c], ebx
call fcn.004a1286
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x466b2c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, str.____found__adding
mov dword [esp + 0x22b4], 0
test ecx, 0xffff0000
jne 0x466a62
mov edx, ecx
movzx edi, dx
push edi
call fcn.004a91be
mov esi, eax
test esi, esi
je 0x466a38
mov eax, edi
shr eax, 4
inc eax
movzx ecx, ax
push 6
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x466a38
push edi
push eax
push esi
call fcn.00421708
mov edi, eax
add esp, 0xc
test edi, edi
je 0x466a38
mov eax, dword [ebx]
movzx esi, word [edi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x4669cb
push esi
mov ecx, ebx
call fcn.00421527
movzx eax, word [edi]
mov edx, dword [ebx]
add edi, 2
mov dword [esp + 0x1c], edx
cmp eax, 0xffffffff
jne 0x4669e6
push edi
call fcn.004af97a
add esp, 4
inc eax
add eax, eax
push eax
lea ecx, [esi + esi]
push edi
push ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004af400
add esp, 0x10
cmp eax, 0x50
ja case.0x466a0f.1
movzx edx, byte [eax + 0x466b5c]
jmp dword [edx*4 + 0x466b4c]
test esi, esi
jl 0x466b40
mov eax, dword [ebx]
cmp esi, dword [eax - 8]
jg 0x466b40
mov edx, dword [esp + 0x24]
mov dword [eax - 0xc], esi
mov eax, dword [ebx]
xor ecx, ecx
mov word [edx + eax], cx
mov esi, dword [esp + 0x28]
mov dword [esp + 0x22b4], 0xffffffff
call fcn.004665e0
mov eax, dword [esi + 0xc]
add esp, 4
mov dword [esp + 0x18], 1
test eax, eax
jne 0x466a7e
xor ecx, ecx
jmp 0x466a86
push str.____found__adding
call fcn.004af97a
add esp, 4
push eax
push str.____found__adding
mov ecx, ebx
call fcn.0042423a
jmp 0x466a3c
mov ecx, dword [esi + 0x14]
sub ecx, eax
sar ecx, 2
mov edi, dword [esi + 0x10]
mov edx, edi
sub edx, eax
sar edx, 2
cmp edx, ecx
jae 0x466aa4
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov dword [edi], ecx
add edi, 4
mov dword [esi + 0x10], edi
jmp 0x466ac2
cmp eax, edi
jbe 0x466aad
call fcn.004afaf1
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
push edi
push eax
push edx
lea eax, [esp + 0x58]
push eax
mov eax, esi
call fcn.00473430
mov eax, dword [esp + 0x28]
inc eax
cmp eax, 1
mov dword [esp + 0x28], eax
jl 0x466850
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x44]
mov eax, dword [esp + 0x30]
add dword [esp + 0x14], 4
inc eax
cmp eax, ebx
mov dword [esp + 0x30], eax
jl 0x46680a
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x22a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2290]
xor ecx, esp
call fcn.004af011
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00421000
call fcn.004a17ee
call fcn.004a1826
push 0x80070057
call fcn.00421000
mov edi, edi
push ss
push 70
add byte [esi], dh
imul eax, dword [esi], 0x3b
imul eax, dword [esi], 0x3b
imul eax, dword [esi], 0
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3