Function at 0x10007e70
Capabilities:
Enumerate processes
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x100b93c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
sub esp, 8
call fcn.10004a30
push ecx
call fcn.10005010
movzx eax, byte [0x100b9992]
add esp, 0xc
mov dl, byte [0x100b99a9]
mov cl, byte [0x100b99b0]
push eax
movzx eax, byte [0x100b9991]
push eax
movzx eax, byte [0x100b9993]
push eax
movzx eax, byte [0x100b999a]
push eax
movzx eax, byte [0x100b99a0]
push eax
movzx eax, byte [0x100b99a8]
push eax
movzx eax, byte [0x100b99ad]
push eax
movzx eax, byte [0x100b99a7]
push eax
movzx eax, byte [0x100b99aa]
push eax
movzx eax, byte [0x100b9999]
push eax
movzx eax, byte [0x100b99b2]
push eax
movzx eax, byte [0x100b99b1]
push eax
movzx eax, byte [0x100b9995]
push eax
movzx eax, byte [0x100b99ae]
push eax
call fcn.10005780
add esp, 0x34
call fcn.100070d0
sub esp, 0xc
call fcn.100075c0
add esp, 0x10
call fcn.10006e50
call fcn.10004800
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10007f67
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_create_snapshot.
call fcn.100088f0
push 0x10008ad0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x10008037
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10008013
mov esi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
mov eax, str.Taskmgr.exe
lea ecx, [ebp - 0x11c]
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10007fc0
test dl, dl
je 0x10007fbc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10007fc0
add ecx, 2
add eax, 2
test dl, dl
jne 0x10007fa0
xor eax, eax
jmp 0x10007fc5
sbb eax, eax
or eax, 1
test eax, eax
je 0x10007fd9
lea eax, [ebp - 0x140]
push eax
push edi
call esi
test eax, eax
jne 0x10007f90
jmp 0x10008030
push dword [ebp - 0x138]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000800c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Task_Manager_closed_successfully.
jmp 0x1000801e
mov edx, str.Failed_to_open_Task_Manager_process.
jmp 0x10008018
mov edx, str.Failed_to_retrieve_process_information.
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.100088f0
push 0x10008ad0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10003e00
cmp byte [0x100b9430], 1
jne 0x100080a4
mov al, byte [0x100af004]
movups xmm0, xmmword [str.zBloodStrike.exe]
mov byte [ebp - 8], al
lea eax, [ebp - 0x18]
push 0x100ae720
push eax
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x1000809c
push 2
push 0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov esi, eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
cmp esi, 0xac00
je 0x100080a4
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x87
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x100080c1
cmp byte [0x100b9430], 0
sete byte [0x100b9430]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1009ca62
mov esp, ebp
pop ebp
ret