Function at 0x411c2d
Capabilities:
Acquire debug privileges

Disassembly:
push 0x46c
mov eax, 0x468201
call fcn.00452603
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push 0x410
push eax
mov dword [ebp - 0x478], ecx
call fcn.004119d5
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00451260
add esp, 0xc
push str.SeDebugPrivilege
call fcn.004114b0
or edi, 0xffffffff
xor ebx, ebx
test byte [0x4a36dc], 1
mov dword [ebp - 0x460], edi
mov dword [ebp - 0x464], edi
jne 0x411ca3
or dword [0x4a36dc], 1
push 0x46aac4
mov dword [ebp - 4], ebx
call fcn.0041156d
mov dword [0x4a36d8], eax
mov dword [ebp - 4], edi
push ebx
push 0x1000
push 0x10
call fcn.00411618
mov dword [ebp - 0x474], eax
cmp eax, ebx
jne 0x411cc8
push edi
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov eax, edi
jmp 0x411f19
mov dword [ebp - 0x45c], edi
lea esi, [eax + 4]
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x470], ebx
cmp dword [eax], ebx
jbe 0x411ef2
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x411cf5
cmp dword [esi], eax
jne 0x411ec1
mov edi, dword [esi]
call dword [sym.imp.___total_physical_size__lu_MB_GetCurrentProcessId]
cmp edi, eax
je 0x411ec1
movzx ecx, byte [esi + 4]
mov eax, dword [0x4a36d8]
cmp ecx, eax
je 0x411d1a
cmp eax, ebx
jne 0x411ec1
cmp dword [ebp - 0x464], edi
je 0x411d4f
cmp dword [ebp - 0x460], 0xffffffff
je 0x411d37
push dword [ebp - 0x460]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov eax, dword [esi]
push eax
push ebx
push 0x40
mov dword [ebp - 0x464], eax
call dword [sym.imp.___total_physical_size__lu_MB_OpenProcess]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0xffffffff
je 0x411ec1
push 2
push ebx
push ebx
lea eax, [ebp - 0x45c]
push eax
movzx eax, word [esi + 6]
push 0xffffffffffffffff
push eax
push dword [ebp - 0x460]
call dword [sym.imp.___total_physical_size__lu_MB_DuplicateHandle]
test eax, eax
je 0x411ec1
lea eax, [ebp - 0x46c]
push eax
push 0x38
lea eax, [ebp - 0x458]
push eax
push ebx
push dword [ebp - 0x45c]
call dword [0x4d24d4]
mov eax, dword [ebp - 0x430]
add eax, 2
push eax
push dword [ebp - 0x468]
mov dword [ebp - 0x46c], eax
call fcn.0045366b
pop ecx
pop ecx
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 0x46c]
push dword [ebp - 0x468]
push 2
push dword [ebp - 0x45c]
call dword [0x4d24d4]
push 0x46aac4
push dword [ebp - 0x468]
call fcn.0042f56d
push eax
call fcn.00450597
pop ecx
pop ecx
test eax, eax
jne 0x411eb5
movzx eax, byte [esi + 4]
mov dword [0x4a36d8], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x46c], 0x208
cmp eax, ebx
je 0x411e26
mov dword [ebp - 0x46c], eax
push dword [ebp - 0x45c]
call fcn.00411748
mov edi, eax
cmp edi, ebx
je 0x411e97
cmp byte [edi], bl
je 0x411e97
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.0041d338
test eax, eax
je 0x411e97
cmp dword [ebp + 0x10], ebx
je 0x411ede
push edi
call fcn.00411a4d
push eax
push dword [ebp - 0x464]
cmp dword [ebp - 0x478], ebx
je 0x411e7e
call fcn.0041184f
push eax
push dword [ebp - 0x464]
call dword [ebp - 0x478]
jmp 0x411e97
push dword [ebp - 0x464]
call fcn.0041184f
push eax
push str.process__s__d__file__s_n
call fcn.00450f5c
add esp, 0x10
cmp dword [ebp - 0x45c], 0xffffffff
je 0x411ec1
push dword [ebp - 0x45c]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
or dword [ebp - 0x45c], 0xffffffff
jmp 0x411ec1
push dword [ebp - 0x45c]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
inc dword [ebp - 0x470]
mov eax, dword [ebp - 0x474]
mov ecx, dword [ebp - 0x470]
add esi, 0x10
cmp ecx, dword [eax]
jb 0x411ce5
cmp dword [ebp - 0x468], ebx
je 0x411ef2
push dword [ebp - 0x468]
call fcn.0045038b
pop ecx
push dword [ebp - 0x474]
call fcn.0045038b
cmp dword [ebp - 0x460], 0xffffffff
pop ecx
je 0x411f13
push dword [ebp - 0x460]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov eax, dword [ebp - 0x45c]
call fcn.0045264d
ret 0x10