Function at 0x40cb80
Capabilities:
Acquire debug privileges
Enumerate processes
Get common file path
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1074
call fcn.00416680
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x61e]
push ecx
mov word [ebp - 0x620], ax
call fcn.00414930
add esp, 0xc
push 0x104
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x429938
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cbd2
sub eax, edx
sar eax, 1
jne 0x40cc03
push 0x423340
call fcn.004033d0
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1064]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40cc61
lea ecx, [ebp - 0xe2c]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x1064]
push 0
push 0
push 0x10
lea edx, [ebp - 0xe30]
push edx
push 0
push eax
mov dword [ebp - 0xe30], 1
mov dword [ebp - 0xe24], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0xe1e]
push edx
mov word [ebp - 0xe20], cx
call fcn.00414930
add esp, 0xc
push 0
push 0xf
mov dword [ebp - 0x1060], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x106c], esi
cmp esi, 0xffffffff
jne 0x40ccd1
mov eax, dword [ebp - 0x1064]
test eax, eax
je 0x40ccb1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4233d8
call fcn.004033d0
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1060]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40cd20
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40ccf0
push esi
call edi
mov eax, dword [ebp - 0x1064]
test eax, eax
je 0x40ccfd
push eax
call edi
push 0x423470
call fcn.004033d0
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1058]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
mov ecx, 0x200
lea edi, [ebp - 0xe20]
or eax, edx
rep stosd dword es:[edi], eax
mov esi, 0x4278c8
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x103c]
push ecx
call fcn.0040daf6
add esp, 8
test eax, eax
je 0x40cdce
add esi, 4
cmp esi, 0x427944
jl 0x40cd44
lea eax, [ebp - 0x103c]
push eax
call fcn.00403020
add esp, 4
mov edx, dword [ebp - 0x106c]
lea ecx, [ebp - 0x1060]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40cd20
mov eax, dword [ebp - 0x106c]
test eax, eax
je 0x40cd9d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1064]
test eax, eax
je 0x40cdae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._t_t_t_Terminate_All_Process__done.
call fcn.004033d0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40cd74
push 0x800
lea edx, [ebp - 0xe20]
push edx
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
lea eax, [ebp - 0xe20]
push eax
call fcn.004033d0
lea eax, [ebp - 0xe20]
add esp, 4
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ce10
sub eax, edx
sar eax, 1
je 0x40cf0b
lea ecx, [ebp - 0xe20]
push ecx
call fcn.0040cf90
add esp, 4
cmp al, 1
jne 0x40cf84
lea edx, [ebp - 0x1068]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x1068]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40cf24
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x416]
push edx
mov word [ebp - 0x418], cx
call fcn.00414930
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00414930
add esp, 0xc
push 0xa
lea edx, [ebp - 0x210]
push edx
push ebx
call fcn.0040e924
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x418]
push str._u__V
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x418]
add esp, 0xc
push edx
call fcn.004033d0
add esp, 4
push 0x3c
push str.tskill.exe
lea edx, [ebp - 0x620]
lea ecx, [ebp - 0x418]
call fcn.0040d1f0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40cd74
push 0x4234e8
call fcn.004033d0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40cd74
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00414930
add esp, 0xc
xor eax, eax
jmp 0x40cf50
movzx ecx, word [ebp + eax - 0x103c]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x40cf50
lea edx, [ebp - 0x210]
push edx
call fcn.004033d0
add esp, 4
push str._t_t_tTerminateProcess_TRUE.
call fcn.004033d0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40cd74