Function at 0x42f3a0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.0046d4f0
test eax, eax
je 0x42f42a
push 0
push str.CFileUtils::TerminateApp1_n
push 0x65f1b0
call fcn.00599ee3
mov eax, dword [str.ENTRY:]
mov ecx, dword [0x5ccf7c]
mov dword [0x65f0b0], eax
mov eax, 0x65f1b0
mov dword [0x65f0b4], ecx
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f3e6
mov edi, 0x65f0b0
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x42f3f7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d500
push 0x65f0b0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d4f0
mov ebx, dword [ebp + 8]
test eax, eax
je 0x42f460
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx]
push edx
push eax
push str.csFileNamePath___s__dwProcessID___d_n
push 0x65efb0
call fcn.00599ee3
add esp, 0x10
push 0x65efb0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [ebp - 4]
push ecx
push 0
push 0x28
mov dword [ebp + 8], 0
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
push eax
call edi
test eax, eax
jne 0x42f521
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x42f4fc
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x42f4c6
call fcn.0046d4f0
test eax, eax
je 0x42f4bb
push str._ImpersonateSelf_n
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea edx, [ebp - 4]
push edx
push 0
push 0x28
call esi
push eax
call edi
test eax, eax
jne 0x42f521
call fcn.0046d4f0
test eax, eax
je 0x42f4bb
push str._OpenThreadToken_n
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0046d4f0
test eax, eax
je 0x42f4bb
push str.GetLastError____ERROR_NO_TOKEN_n
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
push 1
push str.SeDebugPrivilege
push eax
mov ecx, esi
call fcn.0042dcb0
test eax, eax
jne 0x42f569
call fcn.0046d4f0
test eax, eax
je 0x42f554
push str._SetPrivilege_n
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x42f5a9
call fcn.0046d4f0
test eax, eax
je 0x42f4bb
push str._OpenProcess_n
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
push 0
push str.SeDebugPrivilege
push eax
mov ecx, esi
call fcn.0042dcb0
mov eax, dword [ebx]
push edi
push ecx
sub eax, 0x10
mov dword [ebp + 0xc], esp
mov esi, esp
push eax
call fcn.004022e0
mov ecx, dword [ebp - 8]
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0042efc0
test eax, eax
je 0x42f611
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x42f5f7
mov dword [ebp + 8], 1
jmp 0x42f611
call fcn.0046d4f0
test eax, eax
je 0x42f611
push str._TerminateProcess_n
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
mov ecx, dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push edi
call esi
call fcn.0046d4f0
test eax, eax
je 0x42f6a4
mov edx, dword [ebp + 8]
push edx
push str.CFileUtils::TerminateApp1_:_bRetVal___d_n
push 0x65eeb0
call fcn.00599ee3
mov eax, dword [str.EXIT:]
mov ecx, dword [0x5ccefc]
mov dword [0x65edb0], eax
mov eax, 0x65eeb0
mov dword [0x65edb4], ecx
add esp, 0xc
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f660
mov edi, 0x65edb0
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x42f671
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x65edb0
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d510
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8