Function at 0x40b6b7
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x130]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x134], ebx
call fcn.004c05d0
add esp, 0xc
cmp edi, ebx
je 0x40b731
cmp byte [edi], bl
je 0x40b731
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
or eax, 0xffffffff
cmp esi, eax
mov dword [ebp - 0x14c], esi
je 0x40b734
lea eax, [ebp - 0x134]
push eax
push esi
mov dword [ebp - 0x134], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40b743
call fcn.0041cc21
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret
or dword [ebp - 0x13c], 0xffffffff
jmp 0x40b752
mov edi, dword [ebp - 0x148]
cmp dword [ebp + 8], ebx
push edi
lea eax, [ebp - 0x110]
push eax
je 0x40b7b0
call fcn.004c0ab0
test eax, eax
pop ecx
pop ecx
jne 0x40b8f9
push dword [ebp - 0x12c]
xor esi, esi
push ebx
inc esi
push esi
mov dword [ebp - 0x13c], ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x140], eax
je 0x40b7b7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp - 0x140]
mov edi, eax
neg edi
sbb edi, edi
neg edi
call fcn.0041cc21
xor esi, esi
inc esi
jmp 0x40b7b9
call fcn.004c03bf
jmp 0x40b764
xor edi, edi
cmp edi, ebx
jne 0x40b8f9
xor eax, eax
mov dword [ebp - 0x15c], ebx
lea edi, [ebp - 0x158]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x16c], ebx
lea edi, [ebp - 0x168]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
stosd dword es:[edi], eax
pop edi
lea eax, [ebp - 0x138]
push eax
push ebx
push 0x28
mov dword [ebp - 0x144], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40b839
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x40b82e
lea eax, [ebp - 0x138]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40b839
mov dword [ebp - 0x13c], esi
jmp 0x40b8f9
lea eax, [ebp - 0x158]
push eax
push str.SeDebugPrivilege
push ebx
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x150], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x16c]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [ebp - 0x15c]
push eax
push ebx
push dword [ebp - 0x138]
call edi
test eax, eax
jne 0x40b89e
mov dword [ebp - 0x13c], esi
mov esi, dword [ebp - 0x138]
call fcn.0041cc21
mov dword [ebp - 0x138], ebx
jmp 0x40b8f9
push dword [ebp - 0x12c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x140], eax
jne 0x40b8bc
mov dword [ebp - 0x13c], esi
push ebx
push ebx
push 0x10
lea eax, [ebp - 0x16c]
push eax
push ebx
push dword [ebp - 0x138]
call edi
mov esi, dword [ebp - 0x138]
call fcn.0041cc21
mov esi, dword [ebp - 0x140]
cmp esi, ebx
mov dword [ebp - 0x138], ebx
je 0x40b8f9
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.0041cc21
mov esi, dword [ebp - 0x14c]
lea eax, [ebp - 0x134]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40b74c
call fcn.0041cc21
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x13c]
jmp 0x40b734