Function at 0x10007361
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
mov eax, 0x100134e4
call fcn.1000c73c
sub esp, 0x818
mov al, byte [ebp - 0x21]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x3c], al
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.10008891
push str.OpenProcess
call fcn.10005618
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.TerminateProcess
mov dword [ebp - 0x48], eax
call fcn.10005618
push eax
call esi
push str.CloseHandle
call fcn.10005618
push eax
call esi
push str.CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
call fcn.10005618
push eax
call esi
push str.Process32FirstW
mov dword [ebp - 0x14], eax
call fcn.10005618
push eax
call esi
push str.Process32NextW
mov dword [ebp - 0x1c], eax
call fcn.10005618
push eax
call esi
push str.Advapi32.dll
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.OpenProcessToken
push edi
call esi
push str.GetTokenInformation
push edi
mov dword [ebp - 0x4c], eax
call esi
push str.LookupAccountSidW
push edi
mov dword [ebp - 0x40], eax
call esi
push ebx
push 2
mov dword [ebp - 0x44], eax
call dword [ebp - 0x14]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x10007640
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 1
push 0x40
mov dword [ebp - 0x304], 0x22c
call esi
lea eax, [ebp - 0x304]
push eax
push dword [ebp - 0x14]
call dword [ebp - 0x1c]
test eax, eax
je 0x100075bc
push dword [ebp - 0x2fc]
mov ecx, 0x127
xor eax, eax
lea edi, [ebp - 0x7a0]
mov dword [ebp - 0x7a4], ebx
push ebx
rep stosd dword es:[edi], eax
push 0x410
call dword [ebp - 0x48]
mov edi, eax
mov eax, dword [ebp - 0x2fc]
cmp eax, ebx
mov dword [ebp - 0x1c], edi
je 0x100075a4
cmp eax, 4
je 0x100075a4
cmp eax, 8
je 0x100075a4
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x2e8]
push edi
mov dword [ebp - 0x798], eax
call fcn.10007319
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x79c], eax
pop ecx
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x794]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x50c]
push eax
push edi
call fcn.1000729d
pop ecx
lea eax, [ebp - 0x28]
pop ecx
mov word [ebp - 0xd8], bx
push eax
push 8
push edi
call dword [ebp - 0x4c]
test eax, eax
je 0x10007581
mov eax, 0x1000
mov dword [ebp - 0x18], eax
push eax
push 0x40
call esi
mov edi, eax
cmp edi, ebx
je 0x1000757b
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push edi
push 1
push dword [ebp - 0x28]
call dword [ebp - 0x40]
test eax, eax
jne 0x1000754b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000754b
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x18]
jmp 0x10007516
push 0x40
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xd8]
push eax
push dword [edi]
push ebx
call dword [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x28]
call dword [ebp - 0x10]
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x58c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x7a4]
lea ecx, [ebp - 0x3c]
push eax
call fcn.10008880
push dword [ebp - 0x1c]
call dword [ebp - 0x10]
lea eax, [ebp - 0x304]
push eax
push dword [ebp - 0x14]
call dword [ebp - 0x20]
jmp 0x10007459
push ebx
push str.SeDebugPrivilege
call fcn.1000726e
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [ebp - 0x10]
cmp dword [ebp - 0x38], ebx
mov esi, 0x4a0
jne 0x100075de
mov dword [ebp - 0x10], ebx
jmp 0x100075ec
mov eax, dword [ebp - 0x34]
mov ecx, esi
sub eax, dword [ebp - 0x38]
cdq
idiv ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
imul eax, eax, 0x4a0
inc eax
push eax
mov dword [ebp - 0x20], eax
call fcn.1000723d
mov edi, eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov byte [edi], 0x81
jbe 0x10007634
mov dword [ebp - 0x10], ebx
lea ebx, [edi + 1]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
add ecx, eax
push esi
push ecx
push ebx
call sub.MSVCRT.dll_memcpy
add dword [ebp - 0x10], esi
add esp, 0xc
add ebx, esi
dec dword [ebp - 0x14]
jne 0x10007617
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
push edi
call fcn.10004d90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.10008860
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret