Function at 0x439de0
Capabilities:
Acquire debug privileges
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2233
mov eax, dword fs:[0]
push eax
mov eax, 0x4168
call fcn.004cf3e0
mov eax, dword [0x61df80]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4034], 0
push 0x3ffc
push 0
lea eax, [ebp - 0x4030]
push eax
call fcn.004ce490
add esp, 0xc
mov dword [ebp - 0x10], 0
push 0x5e58ec
lea ecx, [ebp - 0x30]
call fcn.00403100
mov dword [ebp - 4], 0
push 0x4000
push 0
lea ecx, [ebp - 0x4034]
push ecx
call fcn.004ce490
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
push 0x4000
lea eax, [ebp - 0x4034]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x439f06
call fcn.00401ff0
mov dword [ebp - 0x4038], eax
cmp dword [ebp - 0x4038], 0
je 0x439eee
push 3
call fcn.00405d70
movzx ecx, al
push ecx
mov edx, dword [ebp - 0x4038]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4038]
mov edx, dword [eax + 0xc]
call edx
movzx eax, al
test eax, eax
je 0x439eee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_enum_process__d__n
push 0x57a
push 0x5e591c
push 3
call fcn.00405d70
movzx ecx, al
push ecx
mov edx, dword [ebp - 0x4038]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4038]
push ecx
mov edx, dword [eax + 0x10]
call edx
add esp, 0x1c
xor eax, eax
jne 0x439e7d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00403180
jmp 0x43a0f1
mov ecx, dword [ebp - 0x10]
shr ecx, 2
mov dword [ebp - 0x10], ecx
push 1
push 0x5e5928
call fcn.00439d50
add esp, 8
mov dword [ebp - 0x403c], 0
jmp 0x439f39
mov edx, dword [ebp - 0x403c]
add edx, 1
mov dword [ebp - 0x403c], edx
mov eax, dword [ebp - 0x403c]
cmp eax, dword [ebp - 0x10]
jae 0x43a0d3
mov ecx, dword [ebp - 0x403c]
mov edx, dword [ebp + ecx*4 - 0x4034]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4040], eax
cmp dword [ebp - 0x4040], 0
jne 0x439f74
jmp 0x439f2a
mov dword [ebp - 0x4150], 0
mov byte [ebp - 0x414c], 0
push 0x103
push 0
lea eax, [ebp - 0x414b]
push eax
call fcn.004ce490
add esp, 0xc
mov dword [ebp - 0x4154], 0
push 0x104
push 0
lea ecx, [ebp - 0x414c]
push ecx
call fcn.004ce490
add esp, 0xc
lea edx, [ebp - 0x4150]
push edx
push 4
lea eax, [ebp - 0x4154]
push eax
mov ecx, dword [ebp - 0x4040]
push ecx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x43a0c1
push 0x103
lea edx, [ebp - 0x414c]
push edx
mov eax, dword [ebp - 0x4154]
push eax
mov ecx, dword [ebp - 0x4040]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jbe 0x43a0c1
lea edx, [ebp - 0x414c]
push edx
lea ecx, [ebp - 0x4170]
call fcn.00403100
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4170]
call fcn.0043a520
cmp eax, dword [0x5f0818]
je 0x43a0b2
call fcn.00401ff0
mov dword [ebp - 0x4174], eax
cmp dword [ebp - 0x4174], 0
je 0x43a09f
push 1
call fcn.00405d70
movzx ecx, al
push ecx
mov edx, dword [ebp - 0x4174]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4174]
mov edx, dword [eax + 0xc]
call edx
movzx eax, al
test eax, eax
je 0x43a09f
push str.Find_previous_accelerator_process__terminate_it_n
push 0x593
push str..Util.cpp
push 1
call fcn.00405d70
movzx ecx, al
push ecx
mov edx, dword [ebp - 0x4174]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4174]
push ecx
mov edx, dword [eax + 0x10]
call edx
add esp, 0x18
xor eax, eax
jne 0x43a035
push 0
mov ecx, dword [ebp - 0x4040]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4170]
call fcn.00403180
mov edx, dword [ebp - 0x4040]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x439f2a
push 0
push str.SeDebugPrivilege
call fcn.00439d50
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00403180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c7d13
mov esp, ebp
pop ebp
ret