Function at 0x401099
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [0x456008]
xor eax, ebp
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40119c
push dword [esp + 0x14]
push str.Open_process_token:__p_n
call fcn.004011ef
add esp, 8
lea eax, [esp + 8]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4011a5
push dword [esp + 8]
push dword [esp + 0x10]
push str.Priv._look_up_succesfull:__ld___ld_n
call fcn.004011ef
add esp, 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
lea edi, [esp + 0x28]
mov eax, 0x10
lea esi, [esp + 4]
lea ebx, [esp + 0x18]
mov dword [edi], 1
mov dword [esi], eax
mov dword [edi + 4], ecx
xor ecx, ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], ecx
push esi
push ebx
push eax
push edi
push ecx
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4011b6
push str.Privilege_retrieved_succesfully
call fcn.0042d99e
add esp, 4
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 2
push esi
push edi
push 0x10
push ebx
push 0
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4011c6
push str.Privilege_adjusted_succesfully
call fcn.0042d99e
add esp, 4
jmp 0x4011dc
push 0
push str.Cannot_open_process_token:__lx_n
jmp 0x4011ac
push 0
push str.Cannot_open_look_up_priv._value:__lx_n
call fcn.004011ef
add esp, 8
jmp 0x4011dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push str.Cannot_retrieve_privilege:__lx__error:_lu__n
jmp 0x4011d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push str.Cannot_adjust_privilege:__lx__error:_lu__n
call fcn.004011ef
add esp, 0xc
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.004077dd
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401244
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.00407bb0
mov eax, dword [0x456008]
lea edi, [ebp - 0x1010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1014]
push eax
push 0x1000
push edi
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x4012d6
mov ebx, dword [ebp - 0x1014]
shr ebx, 2
je 0x4012d6
mov eax, dword [edi]
test eax, eax
je 0x4012d0
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4012d0
mov esi, eax
lea eax, [ebp - 0x101c]
push eax
push 4
lea eax, [ebp - 0x1018]
push eax
push esi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x4012c9
push dword [ebp + 0xc]
push dword [ebp - 0x1018]
push esi
call dword [ebp + 8]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 4
dec ebx
jne 0x401285
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004077dd
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret