Function at 0x40b710
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push 0xffffffffffffffff
push 0x44905b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88c
mov eax, dword [0x4668f4]
xor eax, esp
push ebx
push ebp
push esi
mov esi, dword [esp + 0x8a8]
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 0x894], eax
push edi
je 0x40bb22
cmp byte [esi], bl
je 0x40bb22
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call fcn.00401531
lea eax, [esp + 0x6c]
push eax
call fcn.0040ab70
mov ecx, dword [0x467980]
push esi
push str.sProcessName___s
push 0x6d4
push str..Utility.cpp
push ebx
push str.Utility::TerminateProcessByName
push ecx
mov dword [esp + 0x8e0], ebx
call fcn.0040ebc0
add esp, 0x3c
push 0x200
lea edx, [esp + 0x49c]
push edx
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
je 0x40bad5
jmp 0x40b7d4
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x6c]
push eax
push esi
mov dword [esp + 0x74], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40bb4b
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0x28
mov dword [esp + 0x20], ebx
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
push eax
call esi
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x40b8b4
call edi
cmp eax, 0x3f0
jne 0x40b883
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x40b847
call edi
mov esi, eax
push esi
call fcn.0040f290
push eax
push esi
push str.ImpersonateSelf_SecurityImpersonation__failed:__d___s
push 0x6f8
jmp 0x40b899
lea eax, [esp + 0x14]
push eax
push ebx
push 0x28
call ebp
push eax
call esi
test eax, eax
jne 0x40b8b4
call edi
mov esi, eax
push esi
call fcn.0040f290
mov ecx, dword [0x467980]
push eax
push esi
push str.OpenThreadToken___failed:__d___s
push 0x700
push str..Utility.cpp
push 3
push str.Utility::TerminateProcessByName
push ecx
jmp 0x40b8ac
call edi
mov esi, eax
push esi
call fcn.0040f290
push eax
push esi
push str.OpenThreadToken___failed:__d___s
push 0x708
mov edx, dword [0x467980]
push str..Utility.cpp
push 3
push str.Utility::TerminateProcessByName
push edx
call fcn.0040ebc0
add esp, 0x24
cmp dword [esp + 0x14], ebx
je 0x40b920
xor eax, eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x20], eax
push str.SeDebugPrivilege
mov dword [esp + 0x28], eax
push ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40b920
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
push ebx
push ebx
push 0x10
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x24]
push ebx
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x40b920
mov eax, dword [esp + 0x74]
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push ebx
push 0x1f0fff
call esi
mov ebp, eax
cmp ebp, ebx
jne 0x40b950
mov ecx, dword [esp + 0x74]
push ecx
push ebx
push 0x411
call esi
mov ebp, eax
cmp ebp, ebx
je 0x40ba53
lea edx, [esp + 0x90]
push edx
call fcn.004216cf
add esp, 4
push ebx
push ebx
push ebx
push ebx
mov edi, eax
push edi
lea eax, [esp + 0xa4]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
cmp esi, 0x200
jge 0x40b9ac
push ebx
push ebx
push esi
lea ecx, [esp + 0x2a4]
push ecx
push edi
lea edx, [esp + 0xa4]
push edx
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [esp + esi + 0x298], bl
sub esp, 0x1c
mov ecx, esp
mov edi, 0xf
lea eax, [esp + 0x2b4]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x4c], esp
mov byte [ecx + 4], bl
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40b9d0
sub eax, esi
push eax
lea eax, [esp + 0x2b8]
push eax
call fcn.004014a5
lea ecx, [esp + 0x50]
push ecx
call fcn.0040ab70
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x58]
mov esi, 0x10
add esp, 0x20
cmp eax, esi
jae 0x40ba09
lea ecx, [esp + 0x38]
cmp dword [esp + 0x68], esi
mov eax, dword [esp + 0x54]
jae 0x40ba17
lea eax, [esp + 0x54]
push ecx
push eax
call fcn.00422370
add esp, 8
test eax, eax
jne 0x40ba8e
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x4c], esi
jb 0x40ba3f
mov edx, dword [esp + 0x38]
push edx
call fcn.0043beef
add esp, 4
mov dword [esp + 0x4c], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
jmp 0x40ba55
call edi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x6c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40b920
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x68], 0x10
jb 0x40ba87
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0043beef
add esp, 4
mov al, 1
jmp 0x40bb24
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0x4c], esi
jb 0x40bab4
mov edx, dword [esp + 0x38]
push edx
call fcn.0043beef
add esp, 4
push ebx
push 2
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x40b7d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.0040f290
push eax
mov eax, dword [0x467980]
push esi
push str.hProcessSnap__INVALID_HANDLE_VALUE:__d___s
push 0x6e0
push str..Utility.cpp
push 3
push str.Utility::TerminateProcessByName
push eax
call fcn.0040ebc0
mov eax, dword [esp + 0x8c]
add esp, 0x24
cmp eax, 0x10
jb 0x40bb22
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0043beef
add esp, 4
xor al, al
mov ecx, dword [esp + 0x89c]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x890]
pop ebp
pop ebx
xor ecx, esp
call fcn.004205fd
add esp, 0x898
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.0040f290
mov edx, dword [0x467980]
push eax
push esi
push str._Process32First__:__d___s
push 0x6ec
push str..Utility.cpp
push 3
push str.Utility::TerminateProcessByName
push edx
call fcn.0040ebc0
mov eax, dword [esp + 0x8c]
add esp, 0x24
cmp eax, 0x10
jb 0x40bb22
mov eax, dword [esp + 0x54]
push eax
jmp 0x40bb1a