Function at 0x10061890
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0xe1c]
sub esp, 0xe1c
push 0xfffffffffffffffe
push 0x1016d710
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1030
call fcn.10126240
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xe18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov esi, edx
mov dword [ebp - 0x34], esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], ebx
mov byte [ebp + 0xa08], bl
push 0x207
push ebx
lea eax, [ebp + 0xa09]
push eax
call fcn.10116880
mov byte [ebp + 0xc10], bl
push 0x207
push ebx
lea ecx, [ebp + 0xc11]
push ecx
call fcn.10116880
add esp, 0x18
mov dword [ebp - 0x1c], ebx
cmp esi, ebx
je 0x1006192f
mov dword [esi], ebx
cmp edi, ebx
je 0x10061e78
cmp byte [edi], bl
je 0x10061e78
push 0x5c
push edi
call fcn.1010d780
add esp, 8
test eax, eax
je 0x10061955
mov dword [ebp - 0x38], 1
mov eax, dword [0x101a2184]
cmp eax, ebx
jne 0x10061975
mov ecx, str.PSAPI.DLL
call fcn.10032000
mov dword [0x101a2184], eax
cmp eax, ebx
je 0x10061e78
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x101a2170], ebx
jne 0x10061995
push str.EnumProcesses
push eax
call esi
mov dword [0x101a2170], eax
mov eax, dword [0x101a2184]
cmp dword [0x101a2174], ebx
jne 0x100619af
push str.EnumProcessModules
push eax
call esi
mov dword [0x101a2174], eax
mov eax, dword [0x101a2184]
cmp dword [0x101a2178], ebx
jne 0x100619c9
push str.GetModuleBaseNameA
push eax
call esi
mov dword [0x101a2178], eax
mov eax, dword [0x101a2184]
cmp dword [0x101a217c], ebx
jne 0x100619e3
push str.GetModuleFileNameExA
push eax
call esi
mov dword [0x101a217c], eax
mov eax, dword [0x101a2184]
cmp dword [0x101a2180], ebx
jne 0x100619fd
push str.GetProcessImageFileNameA
push eax
call esi
mov dword [0x101a2180], eax
mov eax, dword [0x101a2184]
cmp dword [0x101a2170], ebx
je 0x10061e53
cmp dword [0x101a2178], ebx
je 0x10061e53
cmp dword [0x101a2174], ebx
je 0x10061e53
cmp dword [0x101a217c], ebx
je 0x10061e53
xor ebx, ebx
mov ecx, str.SeDebugPrivilege
call fcn.10048c40
lea edx, [ebp - 0x40]
push edx
push 0x1000
lea eax, [ebp - 0x1048]
push eax
call dword [0x101a2170]
mov eax, dword [ebp - 0x40]
shr eax, 2
mov dword [ebp - 0x44], eax
jmp 0x10061a60
cmp dword [ebp - 0x1c], eax
jge 0x10061e9b
mov byte [ebp + 0xc10], 0
mov byte [ebp + 0xa08], 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + ecx*4 - 0x1048]
push edx
push 0x20410
call fcn.1005f650
add esp, 8
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x10061e48
lea eax, [ebp - 0x48]
push eax
push 4
lea ecx, [ebp - 0x3c]
push ecx
push edi
call dword [0x101a2174]
test eax, eax
je 0x10061b98
push 0x208
lea edx, [ebp + 0xa08]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push edi
call dword [0x101a2178]
push 0x208
lea ecx, [ebp + 0xc10]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
push edi
call dword [0x101a217c]
cmp byte [ebp + 0xc10], 0
je 0x10061c59
push 4
push str.___
lea eax, [ebp + 0xc10]
push eax
call fcn.1011c70c
add esp, 0xc
test eax, eax
jne 0x10061b1e
lea ecx, [ebp + 0xc14]
push ecx
lea edx, [ebp + 0xc10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp + 0xc10]
push eax
call sym.EncDec.dll_IsItEnvStringType
push 0x7e
lea ecx, [ebp + 0xc10]
push ecx
call fcn.1010d780
add esp, 8
test eax, eax
je 0x10061c59
mov byte [ebp], 0
push 0x3ff
push 0
lea edx, [ebp + 1]
push edx
call fcn.10116880
add esp, 0xc
mov byte [ebp], 0
push 0x400
lea eax, [ebp]
push eax
lea ecx, [ebp + 0xc10]
push ecx
call dword [0x1017eafc]
dec eax
cmp eax, 0x102
ja 0x10061c59
lea edx, [ebp]
push edx
lea eax, [ebp + 0xc10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10061c59
mov eax, dword [0x101a2180]
test eax, eax
je 0x10061c59
push 0x208
lea ecx, [ebp + 0xc10]
push ecx
push edi
call eax
cmp byte [ebp + 0xc10], 0
je 0x10061c59
lea edx, [ebp + 0xc10]
push edx
call sym.EncDec.dll_ConvertDeviceName
push 0x7e
lea eax, [ebp + 0xc10]
push eax
call fcn.1010d780
add esp, 8
test eax, eax
je 0x10061c3b
mov byte [ebp + 0x400], 0
push 0x3ff
push 0
lea ecx, [ebp + 0x401]
push ecx
call fcn.10116880
add esp, 0xc
mov byte [ebp + 0x400], 0
push 0x400
lea edx, [ebp + 0x400]
push edx
lea eax, [ebp + 0xc10]
push eax
call dword [0x1017eafc]
dec eax
cmp eax, 0x206
ja 0x10061c3b
lea ecx, [ebp + 0x400]
push ecx
lea edx, [ebp + 0xc10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp + 0xc10], 0
je 0x10061c59
lea eax, [ebp + 0xa08]
push eax
lea ecx, [ebp + 0xc10]
call fcn.10045a10
add esp, 4
cmp dword [ebp - 0x38], 0
jne 0x10061d1b
cmp byte [ebp + 0xa08], 0
je 0x10061e34
xor eax, eax
jne 0x10061ce4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp + 0xa08]
call fcn.10031890
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x10061e34
xor eax, eax
je 0x10061df2
push 0x8000
call fcn.1010dced
add esp, 4
mov esi, eax
test esi, esi
je 0x10061df2
mov byte [esi], 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + edx*4 - 0x1048]
push eax
mov ecx, esi
call fcn.1005fc50
cmp byte [esi], 0
je 0x10061d0e
xor eax, eax
push eax
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10061d0e
xor ebx, ebx
mov dword [ebp - 0x24], ebx
jmp 0x10061de9
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp + 0xa08]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10061d02
xor ebx, ebx
mov dword [ebp - 0x24], ebx
jmp 0x10061c8f
mov dword [ebp - 0x24], 1
jmp 0x10061e34
mov ebx, 1
mov dword [ebp - 0x24], ebx
jmp 0x10061de9
cmp byte [ebp + 0xc10], 0
je 0x10061e34
mov dword [ebp - 0x30], 1
mov byte [ebp + 0x800], 0
push 0x207
push 0
lea ecx, [ebp + 0x801]
push ecx
call fcn.10116880
add esp, 0xc
lea edx, [ebp + 0xc10]
push edx
lea eax, [ebp + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp + 0x800]
push ecx
call fcn.10042c70
mov esi, dword [ebp - 0x2c]
push esi
lea ecx, [ebp + 0xc10]
call fcn.10047020
add esp, 8
cmp eax, 0xffffffff
jne 0x10061d9b
push esi
lea ecx, [ebp + 0x800]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10061e34
xor ebx, ebx
mov dword [ebp - 0x30], ebx
xor eax, eax
je 0x10061df2
push 0x8000
call fcn.1010dced
add esp, 4
mov esi, eax
test esi, esi
je 0x10061df2
mov byte [esi], bl
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + edx*4 - 0x1048]
push eax
mov ecx, esi
call fcn.1005fc50
cmp byte [esi], bl
je 0x10061de1
xor eax, eax
push eax
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10061de6
mov ebx, 1
mov dword [ebp - 0x30], ebx
push esi
call fcn.1010dc10
add esp, 4
test ebx, ebx
jne 0x10061e34
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x10061e09
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + ecx*4 - 0x1048]
mov dword [eax], edx
xor ecx, ecx
je 0x10061e19
xor eax, eax
je 0x10061e19
push eax
push ecx
push edi
call sym.EncDec.dll_GetProcessUserFromHandle
lea eax, [ebp - 0x20]
push eax
call fcn.100673f0
xor edi, edi
mov dword [ebp - 0x20], edi
xor eax, eax
mov dword [ebp - 0x28], 1
je 0x10061e9b
inc dword [eax]
test edi, edi
je 0x10061e48
lea ecx, [ebp - 0x20]
push ecx
call fcn.100673f0
mov dword [ebp - 0x20], 0
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
jmp 0x10061a60
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x101a2184], ebx
mov dword [0x101a2170], ebx
mov dword [0x101a2178], ebx
mov dword [0x101a2174], ebx
mov dword [0x101a217c], ebx
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x10061ea5
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe18]
xor ecx, ebp
call fcn.1010d699
add ebp, 0xe1c
mov esp, ebp
pop ebp
ret