Function at 0x407050
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
mov eax, 0x1340
call fcn.0040e020
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push str.psapi.dll
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
jne 0x40708a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1340
ret
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push esi
call ebp
mov edx, eax
cmp edx, ebx
jne 0x4070ab
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1340
ret
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x350]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
lea ecx, [esp + 0x350]
push eax
push 0x1000
push ecx
call edx
mov edi, dword [esp + 0x34]
xor dx, dx
mov dl, al
shr edi, 2
mov word [esp + 0x14], dx
mov dword [esp + 0x28], edi
jne 0x4070f3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1340
ret
push str.GetModuleFileNameExA
push esi
call ebp
cmp eax, ebx
mov dword [esp + 0x2c], eax
jne 0x407110
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1340
ret
cmp edi, ebx
mov dword [esp + 0x24], ebx
jle 0x40725e
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ebp, [esp + eax*4 + 0x350]
mov eax, dword [esp + eax*4 + 0x350]
push eax
push 0
push 0x410
call esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4071c2
lea ecx, [esp + 0x30]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40717b
push eax
push str.TEMP
push str.false
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [esp + 0x3c]
push edx
push str.SeDebugPrivilege
push 0
call ebx
mov ecx, dword [esp + 0x30]
push 0
push 0
lea eax, [esp + 0x40]
push 0
push eax
push 0
push ecx
mov dword [esp + 0x50], 1
mov dword [esp + 0x5c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [ebp]
push edx
push 0
push 0x410
call esi
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x24c]
push 0x104
push eax
push 0
push ecx
call dword [esp + 0x3c]
movzx ax, al
test ax, ax
mov dword [esp + 0x14], eax
je 0x40724a
push 0x15c
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, eax
add esp, 4
test edx, edx
je 0x4074fc
mov ecx, 0x57
xor eax, eax
mov edi, edx
lea esi, [esp + 0x24c]
rep stosd dword es:[edi], eax
lea edi, [edx + 4]
mov ecx, 0x41
mov dword [edx + 0x158], eax
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp]
mov dword [edx], eax
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x407238
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], edx
jmp 0x407246
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], edx
mov dword [ecx + 0x158], edx
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
movsx eax, ax
cmp eax, edi
jl 0x407124
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], ebp
add ebp, 4
test ebp, ebp
je 0x4074fc
mov ebx, dword [sym.imp.MSVCRT.dll_strrchr]
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4074fc
push 4
push ebp
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
je 0x4072a9
push ebp
call fcn.004056a0
add esp, 4
mov dword [esp + 0x14], eax
mov al, byte [0x4164cc]
test al, al
je 0x4074e7
mov eax, dword [0x41618c]
cmp eax, 0x64
je 0x4072ce
cmp eax, 0x65
je 0x4072ce
cmp eax, 0x66
jne 0x4074e7
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4072dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push edx
push 0
push 0x401
call esi
test eax, eax
mov dword [esp + 0x20], eax
je 0x407314
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x407314
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], 0
mov al, byte [0x4164cc]
test al, al
je 0x4074b8
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407330
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
push eax
push 0
push 0x401
call esi
test eax, eax
mov dword [esp + 0x20], eax
je 0x407409
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x407362
mov dword [esp + 0x20], 0
jmp 0x4074c0
call fcn.004076b0
cmp eax, 6
mov dword [0x418140], eax
je 0x40737a
cmp eax, 5
jne 0x4074b8
push 0x5c
push ebp
call ebx
add esp, 8
test eax, eax
je 0x407389
inc eax
jmp 0x40738b
mov eax, ebp
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c]
push ecx
call ebx
add esp, 8
test eax, eax
je 0x4073c1
mov byte [eax], 0
mov esi, 1
lea edx, [esp + 0x48]
push esi
push edx
call fcn.00407560
add esp, 8
test eax, eax
jne 0x40747f
lea ecx, [esp + 0x48]
push ecx
call fcn.00407720
add esp, 4
test eax, eax
je 0x4073f3
mov dword [0x418130], esi
push ebp
call fcn.00406500
add esp, 4
test eax, eax
je 0x4074b8
jmp 0x4074b2
call fcn.004076b0
cmp eax, 6
mov dword [0x418140], eax
je 0x407421
cmp eax, 5
jne 0x4074b8
push 0x5c
push ebp
call ebx
add esp, 8
test eax, eax
je 0x407430
inc eax
jmp 0x407432
mov eax, ebp
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2e
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4c]
push ecx
call ebx
add esp, 8
test eax, eax
je 0x407468
mov byte [eax], 0
mov esi, 1
lea edx, [esp + 0x48]
push esi
push edx
call fcn.00407560
add esp, 8
test eax, eax
je 0x40748e
lea eax, [esp + 0x48]
push eax
call fcn.00407720
add esp, 4
jmp 0x4074c0
lea ecx, [esp + 0x48]
push ecx
call fcn.00407720
add esp, 4
test eax, eax
je 0x4074a5
mov dword [0x418130], esi
push ebp
call fcn.00406500
add esp, 4
test eax, eax
je 0x4074b8
mov dword [0x418130], esi
cmp word [esp + 0x14], 0
je 0x4074e3
mov edx, dword [0x41618c]
push ebp
mov dword [0x417d78], edx
call fcn.004056a0
add esp, 4
mov dword [esp + 0x14], eax
mov dword [0x417d78], 0
mov edi, dword [esp + 0x10]
mov ebp, dword [edi + 0x158]
mov dword [esp + 0x10], ebp
add ebp, 4
test ebp, ebp
jne 0x407277
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40750b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40751a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x407542
mov esi, dword [sym.imp.MSVCRT.dll_free]
mov ecx, dword [esp + 0x18]
push eax
mov edi, dword [ecx + 0x158]
mov dword [esp + 0x1c], edi
call esi
add esp, 4
mov eax, edi
test edi, edi
jne 0x407528
movsx eax, word [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1340
ret