Function at 0x407060
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x95c
mov eax, dword [0x41e008]
xor eax, esp
mov dword [esp + 0x958], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x4070a7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x958]
xor ecx, esp
call fcn.00412814
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0x128
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, 1
test eax, eax
je 0x40741e
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
lea edx, [esp + 0x560]
sub edx, eax
nop dword [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x4070f0
lea ecx, [esp + 0x560]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407107
sub ecx, edx
je 0x4073ff
push 0xf
lea eax, [esp + 0x564]
push str.VirtualPortSetup
push eax
call ebx
add esp, 0xc
test eax, eax
je 0x40714a
push 0xa
lea eax, [esp + 0x564]
push str.VSPStartup
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x4073ff
push 0xa
lea eax, [esp + 0x564]
mov byte [esp + 0x17], 0
push str.VSPStartup
push eax
call ebx
movzx ebx, byte [esp + 0x1f]
add esp, 0xc
test eax, eax
lea eax, [esp + 0x14]
cmove ebx, edi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4071e1
lea eax, [esp + 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4071e1
mov eax, dword [esp + 0x1c]
push 0
push 0
mov dword [esp + 0x15c], eax
mov eax, dword [esp + 0x28]
push 0
mov dword [esp + 0x164], eax
lea eax, [esp + 0x15c]
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x168], 1
mov dword [esp + 0x174], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x30]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4072ad
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4073f9
call esi
push eax
lea eax, [esp + 0x164]
test bl, bl
je 0x407267
push str.Problems_encountered_terminating_VSPStartup_for_upgrade__error_d_._n
push eax
call fcn.004010e0
lea edi, [esp + 0x16c]
add esp, 0xc
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407230
mov ecx, 0x10
mov esi, str.You_will_need_to_manually_stop_VSPStartup_via_the_Task_Manager_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x160]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407250
push 0x50000
push str.VSPStartup_Termination
jmp 0x4073d2
push str.Problems_encountered_terminating_VirtualPortSetup_for_upgrade__error_d_._n
push eax
call fcn.004010e0
lea edi, [esp + 0x16c]
add esp, 0xc
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407280
mov ecx, 0x11
mov esi, str.You_will_need_to_manually_stop_VirtualPortSetup_via_the_Task_Manager_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x160]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4072a0
jmp 0x4073c8
call esi
lea edi, [esp + 0x160]
dec edi
test bl, bl
je 0x407347
movups xmm0, xmmword [str.Problems_encountered_stopping_VSPStartup_for_upgrade._n]
mov eax, dword [0x419db8]
mov dword [esp + 0x190], eax
mov ax, word [0x419dbc]
movups xmmword [esp + 0x160], xmm0
mov word [esp + 0x194], ax
movups xmm0, xmmword [0x419d98]
mov al, byte [0x419dbe]
mov byte [esp + 0x196], al
movups xmmword [esp + 0x170], xmm0
movups xmm0, xmmword [0x419da8]
movups xmmword [esp + 0x180], xmm0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407312
mov ecx, 0x10
mov esi, str.You_will_need_to_manually_stop_VSPStartup_via_the_Task_Manager_n
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x160]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407330
push 0x50000
push str.VSPStartup_Termination
jmp 0x4073d2
movups xmm0, xmmword [str.Problems_encountered_stopping_VirtualPortSetup_for_upgrade._n]
mov eax, dword [0x419df8]
mov dword [esp + 0x198], eax
mov al, byte [0x419dfc]
movups xmmword [esp + 0x160], xmm0
mov byte [esp + 0x19c], al
movups xmm0, xmmword [0x419dd0]
movups xmmword [esp + 0x170], xmm0
movups xmm0, xmmword [0x419de0]
movups xmmword [esp + 0x180], xmm0
movq xmm0, qword [0x419df0]
movq qword [esp + 0x190], xmm0
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4073a0
mov ecx, 0x11
mov esi, str.You_will_need_to_manually_stop_VirtualPortSetup_via_the_Task_Manager_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x160]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4073c0
push 0x50000
push str.VirtualPortSetup_Termination
lea eax, [esp + 0x168]
mov ecx, 0x11
push eax
mov esi, str.before_proceeding_in_order_to_ensure_the_upgrade_completes_cleanly.
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 1
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0x128
push ecx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4070d4
mov ecx, dword [esp + 0x964]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00412814
mov esp, ebp
pop ebp
ret