Function at 0x583c80
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a504a
mov eax, dword fs:[0]
push eax
sub esp, 0x994
mov eax, dword [0x61c850]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.00405d60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x958]
call fcn.004018f0
mov dword [ebp - 0x974], eax
mov ecx, dword [ebp - 0x974]
mov dword [ebp - 0x978], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x978]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.0040c3c0
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x958]
call fcn.00401920
lea ecx, [ebp - 0x5c]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x583d4c
mov dword [ebp - 0x95c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00405ea0
mov eax, dword [ebp - 0x95c]
jmp 0x58422e
lea edx, [ebp - 0x50]
push edx
push 0x602ddc
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x583d88
mov dword [ebp - 0x960], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00405ea0
mov eax, dword [ebp - 0x960]
jmp 0x58422e
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d4], 1
mov dword [ebp - 0x2c8], 2
push 0
push 0
push 0
lea edx, [ebp - 0x2d4]
push edx
push 0
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x2c]
push edx
call fcn.0046e400
add esp, 4
mov dword [ebp - 0x97c], eax
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x980], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x980]
push ecx
lea edx, [ebp - 0x78]
push edx
call fcn.00469030
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.004058b0
lea ecx, [ebp - 0x964]
call fcn.004018f0
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x988], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x988]
push ecx
lea edx, [ebp - 0x78]
push edx
call fcn.0040c3c0
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x964]
call fcn.00401920
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2c4], 0
push 0x228
push 0
lea eax, [ebp - 0x2c0]
push eax
call fcn.00496f40
add esp, 0xc
mov dword [ebp - 0x2c4], 0x22c
xor ecx, ecx
mov word [ebp - 0x4dc], cx
push 0x206
push 0
lea edx, [ebp - 0x4da]
push edx
call fcn.00496f40
add esp, 0xc
lea eax, [ebp - 0x2c4]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x5841f7
lea edx, [ebp - 0x2c4]
push edx
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x5841f7
lea ecx, [ebp - 0x2a0]
push ecx
lea ecx, [ebp - 0x4f8]
call fcn.00405df0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x968]
call fcn.004018f0
mov dword [ebp - 0x98c], eax
mov edx, dword [ebp - 0x98c]
mov dword [ebp - 0x990], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x990]
push eax
lea ecx, [ebp - 0x4f8]
push ecx
call fcn.0040c3c0
add esp, 8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x968]
call fcn.00401920
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x4f8]
push eax
call fcn.0040c400
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x5841e3
cmp dword [ebp + 0xc], 0
jne 0x583fa8
mov edx, dword [ebp - 0x2bc]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x94c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4f8]
call fcn.00405ea0
jmp 0x583ec4
mov edx, dword [ebp - 0x2bc]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x944], 0
push 0x424
push 0
lea eax, [ebp - 0x940]
push eax
call fcn.00496f40
add esp, 0xc
mov dword [ebp - 0x944], 0x428
lea ecx, [ebp - 0x944]
push ecx
mov edx, dword [ebp - 0x518]
push edx
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
mov eax, dword [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x724]
push ecx
lea ecx, [ebp - 0x514]
call fcn.00405df0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x96c]
call fcn.004018f0
mov dword [ebp - 0x994], eax
mov edx, dword [ebp - 0x994]
mov dword [ebp - 0x998], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x998]
push eax
lea ecx, [ebp - 0x514]
push ecx
call fcn.0040c3c0
add esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x96c]
call fcn.00401920
mov edx, dword [0x60543c]
push edx
push 0x6007b4
lea ecx, [ebp - 0x514]
call fcn.00405f00
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x948]
cmp eax, dword [0x60543c]
je 0x5841d4
mov ecx, dword [ebp - 0x948]
add ecx, 1
push ecx
push 0
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x514]
call fcn.00405f30
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0x9a0], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x9a0]
push ecx
lea ecx, [ebp - 0x514]
call fcn.00405e70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x48]
call fcn.00405ea0
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x514]
push eax
call fcn.0040c400
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x58413b
cmp dword [ebp + 0xc], 1
jne 0x58413b
mov edx, dword [ebp - 0x2bc]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x950]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
jmp 0x5841d4
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x514]
push eax
call fcn.0040c420
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x584191
cmp dword [ebp + 0xc], 2
jne 0x584191
mov edx, dword [ebp - 0x2bc]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x954]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
neg eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
jmp 0x5841d4
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x514]
push eax
call fcn.0040c400
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x5841d4
cmp dword [ebp + 0xc], 2
jne 0x5841d4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x514]
call fcn.00405ea0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4f8]
call fcn.00405ea0
jmp 0x583ec4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x514]
call fcn.00405ea0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4f8]
call fcn.00405ea0
jmp 0x583ec4
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x970], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.00405ea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00405ea0
mov eax, dword [ebp - 0x970]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493f9c
mov esp, ebp
pop ebp
ret