[semiono]

Вот мой файл который можно использовать так: killsys.exe calc.exe.
Код 32-битный, но он может закрывать 64-битные приложения.
Работает рекурсивно, то-есть закроет все процессы.

Исходник:

Код:

include '%fasm%/win32ax.inc'
section '.code' executable
start:
        invoke GetCommandLine
        invoke CommandLineToArgv,eax,a
        cmp dword [a],1
        push eax
        jbe exit
        push dword [eax+4]
        call AdjustMyToken
        stdcall findProcessID
        test eax,eax
        jz exit
        invoke OpenProcess,PROCESS_TERMINATE,FALSE,eax
        push eax
        invoke TerminateProcess,eax,1
        invoke CloseHandle,[b]
        jmp start
exit:
        invoke ExitProcess,NULL

        SE_PRIVILEGE_ENABLED = 2
        TOKEN_ADJUST_PRIVILEGES = 32
        TOKEN_QUERY = 8
        TH32CS_SNAPPROCESS = 2

AdjustMyToken:

        invoke LookupPrivilegeValue,NULL,NULL,tokenPriv.LUID1
        mov dword [tokenPriv.PrivilegeCount],1
        mov dword [tokenPriv.Attributes],SE_PRIVILEGE_ENABLED
        invoke OpenProcessToken,-1,TOKEN_ADJUST_PRIVILEGES OR TOKEN_QUERY,b
        invoke AdjustTokenPrivileges,[b],FALSE,tokenPriv,NULL,NULL,NULL
        invoke CloseHandle,[b]
ret

findProcessID:

        push ebp
        invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,NULL
        mov ebp,eax
        mov dword [procEntry.dwSize],sizeof.PROCESSENTRY32W
        invoke Process32First,eax,procEntry
@@:
        invoke Process32Next,ebp,procEntry
        test eax,eax
        jz @f
        invoke lstrcmpi,procEntry.szExeFile,dword [esp+8]
        test eax,eax
        jnz @r
        mov eax,dword [procEntry.th32ProcessID]
@@:
        pop ebp
ret

section '.data' readable writeable

        a rd MAX_PATH
        b rd MAX_PATH

struct TOKEN_PRIVILEGES

        PrivilegeCount dd NULL
        LUID1 dd NULL
        LUID2 dd NULL
        Attributes dd NULL
ends
        tokenPriv TOKEN_PRIVILEGES

struct PROCESSENTRY32W

        dwSize dd NULL
        cntUsage dd NULL
        th32ProcessID dd NULL
        th32DefaultHeapID dd NULL
        th32ModuleID dd NULL
        cntThreads dd NULL
        th32ParentProcessID dd NULL
        pcPriClassBase dd NULL
        dwFlags dd NULL
        szExeFile dw MAX_PATH dup NULL
ends
        procEntry PROCESSENTRY32W

section '.idata' import readable

        library advapi32,'ADVAPI32.DLL',kernel32,'KERNEL32.DLL',shell32,'SHELL32.DLL'
        include '%fasm%/api/advapi32.inc'
        import kernel32,CloseHandle,'CloseHandle',CreateToolhelp32Snapshot,'CreateToolhelp32Snapshot',\
               ExitProcess,'ExitProcess',GetCommandLine,'GetCommandLineW',lstrcmpi,'lstrcmpiW',\
               OpenProcess,'OpenProcess',Process32First,'Process32FirstW',Process32Next,'Process32NextW',\
               TerminateProcess,'TerminateProcess'
        import shell32,CommandLineToArgv,'CommandLineToArgvW'