Function at 0x40e5e0
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push 0xffffffffffffffff
push 0x45d25b
mov eax, dword fs:[0]
push eax
sub esp, 0x880
mov eax, dword [0x483ca0]
xor eax, esp
mov dword [esp + 0x87c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x483ca0]
xor eax, esp
push eax
lea eax, [esp + 0x894]
mov dword fs:[0], eax
mov esi, dword [esp + 0x8a4]
test esi, esi
je 0x40e9df
cmp byte [esi], 0
je 0x40e9df
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00401403
lea eax, [esp + 0x290]
push eax
call fcn.0040ea10
push esi
push str.sProcessName___s
push 0x776
push 0x46360c
push 0
push str.Utility::TerminateProcessByName
push dword [0x4868e8]
mov dword [esp + 0x8d4], 0
call fcn.0040a4c0
push 0x200
lea eax, [esp + 0x4cc]
push eax
push esi
call fcn.0040fa60
add esp, 0x44
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e971
mov esi, dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x40e6c0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x22c
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40e9c0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
test eax, eax
jne 0x40e788
call ebp
cmp eax, 0x3f0
jne 0x40e758
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x40e72a
call ebp
mov esi, eax
push esi
call fcn.004031d0
push eax
push esi
push str.ImpersonateSelf_SecurityImpersonation__failed:__d___s
push 0x79a
jmp 0x40e76e
lea eax, [esp + 0x14]
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
test eax, eax
jne 0x40e788
call ebp
mov esi, eax
push esi
call fcn.004031d0
push eax
push esi
push str.OpenThreadToken___failed:__d___s
push 0x7a2
jmp 0x40e76e
call ebp
mov esi, eax
push esi
call fcn.004031d0
push eax
push esi
push str.OpenThreadToken___failed:__d___s
push 0x7aa
push 0x46360c
push 3
push str.Utility::TerminateProcessByName
push dword [0x4868e8]
call fcn.0040a4c0
add esp, 0x24
cmp dword [esp + 0x14], 0
je 0x40e811
lea eax, [esp + 0x18]
mov dword [esp + 0x250], 0
push eax
push str.SeDebugPrivilege
xorps xmm0, xmm0
mov dword [esp + 0x264], 0
push 0
movq qword [esp + 0x260], xmm0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40e811
mov eax, dword [esp + 0x18]
push 0
push 0
mov dword [esp + 0x25c], eax
mov eax, dword [esp + 0x24]
push 0x10
mov dword [esp + 0x264], eax
lea eax, [esp + 0x25c]
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x268], 1
mov dword [esp + 0x274], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x2c]
push 0
push 0x1fffff
call edi
mov esi, eax
test esi, esi
jne 0x40e83a
push dword [esp + 0x2c]
push eax
push 0x411
call edi
mov esi, eax
test esi, esi
je 0x40e90c
push 0x200
lea eax, [esp + 0x294]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.0040f9f0
sub esp, 0xc
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esp + 0x2a8], 0
jne 0x40e875
xor eax, eax
jmp 0x40e88f
lea eax, [esp + 0x2a8]
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e880
sub eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
lea eax, [esp + 0x2ac]
mov ecx, edx
push eax
call fcn.00401eb7
lea eax, [esp + 0x278]
push eax
call fcn.0040ea10
cmp dword [esp + 0x290], 0x10
lea ecx, [esp + 0x27c]
lea eax, [esp + 0x294]
cmovae ecx, dword [esp + 0x27c]
cmp dword [esp + 0x2a8], 0x10
push ecx
cmovae eax, dword [esp + 0x298]
push eax
call fcn.00439380
add esp, 0x24
test eax, eax
jne 0x40e92e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [esp + 0x274], 0x10
jb 0x40e914
push dword [esp + 0x260]
call fcn.004167f4
add esp, 4
jmp 0x40e914
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x24]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40e811
push ebx
call esi
mov bl, 1
jmp 0x40e9a3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0x274], 0x10
jb 0x40e957
push dword [esp + 0x260]
call fcn.004167f4
add esp, 4
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e6c0
call ebp
mov esi, eax
push esi
call fcn.004031d0
push eax
push esi
push str.hProcessSnap__INVALID_HANDLE_VALUE:__d___s
push 0x782
push 0x46360c
push 3
push str.Utility::TerminateProcessByName
push dword [0x4868e8]
call fcn.0040a4c0
add esp, 0x24
xor bl, bl
cmp dword [esp + 0x28c], 0x10
jb 0x40e9bc
push dword [esp + 0x278]
call fcn.004167f4
add esp, 4
mov al, bl
jmp 0x40e9e1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
mov esi, eax
push esi
call fcn.004031d0
push eax
push esi
push str._Process32First__:__d___s
push 0x78e
jmp 0x40e987
xor al, al
mov ecx, dword [esp + 0x894]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x87c]
xor ecx, esp
call fcn.004396df
add esp, 0x88c
ret