Function at 0x428b70
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8440
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.ProcessKiller
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], esi
call fcn.00401ff0
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00428ab0
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428be0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0x521844], 0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 0x24], 0
jne 0x428cc0
call fcn.004292c0
test al, al
jne 0x428c9d
mov edi, dword [0x521340]
mov eax, 0xaf3addc7
imul edi
add edx, edi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0xbb
mov eax, edi
sub eax, ecx
xor ebx, ebx
cmp eax, 0x6f
je 0x428c8b
mov eax, edi
or eax, 0xffffff2f
add edi, eax
mov eax, edi
imul eax, edi
inc ebx
cmp ebx, eax
jg 0x428c8b
mov eax, 0xaf3addc7
imul edi
add edx, edi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0xbb
mov eax, edi
sub eax, ecx
cmp eax, 0x6f
jne 0x428c56
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x521340], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4da45c
call edi
test eax, eax
je 0x428cb7
push str.OpenProcessToken
push eax
call ebx
mov dword [0x521844], eax
jmp 0x428cbc
mov eax, dword [0x521844]
test eax, eax
je 0x428d25
lea eax, [ebp - 0x24]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x521844]
test eax, eax
je 0x428d25
lea eax, [ebp - 0x30]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x428d25
mov eax, dword [ebp - 0x30]
push 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
push 0
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x428d25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Kernel32
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x428d61
push 0x4dc970
push eax
call ebx
push 0x4dcc08
push dword [esi + 0x10]
mov dword [esi + 0x14], eax
call ebx
push 0x4dcc18
push dword [esi + 0x10]
mov dword [esi + 0x18], eax
call ebx
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x14], 0
je 0x428d73
cmp dword [esi + 0x18], 0
je 0x428d73
cmp dword [esi + 0x1c], 0
jne 0x428de4
call fcn.0044fca0
test al, al
jne 0x428d9a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp dword [esi + 0x10], 0
je 0x428de4
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0xc], eax
test eax, eax
je 0x428de4
push str.ZwQuerySystemInformation
push eax
call ebx
push 0x4dcc50
push dword [esi + 0x10]
mov dword [esi + 0x20], eax
call ebx
push 0x4dcc60
push dword [esi + 0x10]
mov dword [esi + 0x24], eax
call ebx
push 0x4dcc6c
push dword [esi + 0x10]
mov dword [esi + 0x28], eax
call ebx
mov dword [esi + 0x2c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret