Function at 0x40b841
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x130]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x134], ebx
call fcn.004a8c80
add esp, 0xc
cmp edi, ebx
je 0x40b8bb
cmp byte [edi], bl
je 0x40b8bb
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
or eax, 0xffffffff
cmp esi, eax
mov dword [ebp - 0x14c], esi
je 0x40b8be
lea eax, [ebp - 0x134]
push eax
push esi
mov dword [ebp - 0x134], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40b8cd
call fcn.0041c426
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret
or dword [ebp - 0x13c], 0xffffffff
jmp 0x40b8dc
mov edi, dword [ebp - 0x148]
cmp dword [ebp + 8], ebx
push edi
lea eax, [ebp - 0x110]
push eax
je 0x40b93a
call fcn.004a9160
test eax, eax
pop ecx
pop ecx
jne 0x40ba83
push dword [ebp - 0x12c]
xor esi, esi
push ebx
inc esi
push esi
mov dword [ebp - 0x13c], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x140], eax
je 0x40b941
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp - 0x140]
mov edi, eax
neg edi
sbb edi, edi
neg edi
call fcn.0041c426
xor esi, esi
inc esi
jmp 0x40b943
call fcn.004a8a6f
jmp 0x40b8ee
xor edi, edi
cmp edi, ebx
jne 0x40ba83
xor eax, eax
mov dword [ebp - 0x15c], ebx
lea edi, [ebp - 0x158]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x16c], ebx
lea edi, [ebp - 0x168]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
stosd dword es:[edi], eax
pop edi
lea eax, [ebp - 0x138]
push eax
push ebx
push 0x28
mov dword [ebp - 0x144], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40b9c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x40b9b8
lea eax, [ebp - 0x138]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40b9c3
mov dword [ebp - 0x13c], esi
jmp 0x40ba83
lea eax, [ebp - 0x158]
push eax
push str.SeDebugPrivilege
push ebx
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x150], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x16c]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [ebp - 0x15c]
push eax
push ebx
push dword [ebp - 0x138]
call edi
test eax, eax
jne 0x40ba28
mov dword [ebp - 0x13c], esi
mov esi, dword [ebp - 0x138]
call fcn.0041c426
mov dword [ebp - 0x138], ebx
jmp 0x40ba83
push dword [ebp - 0x12c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x140], eax
jne 0x40ba46
mov dword [ebp - 0x13c], esi
push ebx
push ebx
push 0x10
lea eax, [ebp - 0x16c]
push eax
push ebx
push dword [ebp - 0x138]
call edi
mov esi, dword [ebp - 0x138]
call fcn.0041c426
mov esi, dword [ebp - 0x140]
cmp esi, ebx
mov dword [ebp - 0x138], ebx
je 0x40ba83
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.0041c426
mov esi, dword [ebp - 0x14c]
lea eax, [ebp - 0x134]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40b8d6
call fcn.0041c426
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x13c]
jmp 0x40b8be