Function at 0x100f7500
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x724
mov eax, dword [0x10226180]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100f7190
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call fcn.100010f0
mov dword [0x10229c3c], eax
mov dword [0x4efa7e], 0x89
mov dword [0x4e97d1], 0x89
mov dword [0x4eb736], 0x89
mov dword [0x4ec31e], 0x89
mov dword [0x4eb652], 0x89
mov dword [0x4eb8ed], 0x89
mov dword [0x4ec61e], 0x89
mov dword [0x4eb9c6], 0x89
call fcn.100fd040
nop
lea ecx, [ebp - 0x51c]
push ecx
call fcn.100f6da0
add esp, 4
push eax
mov ecx, 0x102afa48
call fcn.10012020
lea ecx, [ebp - 0x51c]
call fcn.10008ea0
nop
movzx edx, byte [ebp - 0x6b0]
push edx
push str.KnightOnLine.exe
lea ecx, [ebp - 0x544]
call fcn.100fa2a0
mov ecx, eax
call fcn.10015070
push eax
push 0x102afa48
lea eax, [ebp - 0x484]
push eax
call fcn.1000d2a0
add esp, 0xc
lea ecx, [ebp - 0x484]
push ecx
call fcn.100f6d50
add esp, 4
movzx edx, al
test edx, edx
jne 0x100f767f
push 0x30
movzx eax, byte [ebp - 0x6b1]
push eax
push 0x101f3ec0
lea ecx, [ebp - 0x48c]
call fcn.100fa850
mov ecx, eax
call fcn.1001d290
push eax
movzx ecx, byte [ebp - 0x6b2]
push ecx
push str.KnightOnLine.exe_name_invalid
lea ecx, [ebp - 0x584]
call fcn.100fa4c0
mov ecx, eax
call fcn.10084bd0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
push 0
push str.Error:_KnightOnLine.exe_name_invalid
mov ecx, dword [0x10229c40]
call fcn.100ca050
nop
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x720], esp
push 0x101d1967
call fcn.10008f80
call fcn.100f6ec0
add esp, 0x1c
lea ecx, [ebp - 0x484]
call fcn.10008ea0
nop
jmp 0x100f7ee1
mov byte [ebp - 0x6ad], 0
mov dword [ebp - 0x6ac], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x6d4], eax
lea edx, [ebp - 0x6ac]
push edx
mov eax, dword [ebp - 0x6d4]
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x100f7745
lea ecx, [ebp - 0x6ac]
push ecx
mov edx, dword [ebp - 0x6d4]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x100f7745
lea eax, [ebp - 0x688]
push eax
lea ecx, [ebp - 0x4c4]
call fcn.10008f80
nop
push 0
movzx ecx, byte [ebp - 0x6b8]
push ecx
push 0x101f3e78
lea ecx, [ebp - 0x530]
call fcn.100e2dc0
mov ecx, eax
call fcn.1003f8c0
push eax
lea ecx, [ebp - 0x4c4]
call fcn.1008b8a0
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 0xffffffff
je 0x100f7734
mov dl, byte [ebp - 0x6ad]
add dl, 1
mov byte [ebp - 0x6ad], dl
lea ecx, [ebp - 0x4c4]
call fcn.10008ea0
nop
jmp 0x100f76bd
movzx eax, byte [ebp - 0x6ad]
cmp eax, 3
jle 0x100f77ca
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ecx, byte [ebp - 0x6b3]
push ecx
push 0x101f3f0c
lea ecx, [ebp - 0x500]
call fcn.1005c7d0
mov ecx, eax
call fcn.1003f7c0
push eax
push 0x102afa48
lea edx, [ebp - 0x4e0]
push edx
call fcn.1000d2a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x484]
call fcn.10012020
lea ecx, [ebp - 0x4e0]
call fcn.10008ea0
nop
lea eax, [ebp - 0x484]
push eax
call fcn.100f6d50
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100f78bc
push 0x30
movzx edx, byte [ebp - 0x6b4]
push edx
push str.Need_This_File_In_Directory
lea ecx, [ebp - 0x564]
call fcn.100faaa0
mov ecx, eax
call fcn.100f7ef0
push eax
movzx eax, byte [ebp - 0x6b5]
push eax
push 0x101f3f4c
lea ecx, [ebp - 0x4f0]
call fcn.100fa910
mov ecx, eax
call fcn.1003f7c0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
push 0
push str.Error:_Need_This_File_In_Directory._RPGuarD.Acs
mov ecx, dword [0x10229c40]
call fcn.100ca050
nop
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x710], esp
push 0x101d1975
call fcn.10008f80
call fcn.100f6ec0
add esp, 0x1c
lea ecx, [ebp - 0x484]
call fcn.10008ea0
nop
jmp 0x100f7ee1
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea edx, [ebp - 0x68]
push edx
lea ecx, [ebp - 0x4a8]
call fcn.10008f80
nop
push 0x44d0
call fcn.10150df0
add esp, 4
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 0
je 0x100f7950
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x714], esp
movzx eax, byte [ebp - 0x6b6]
push eax
push 0x101f3edc
lea ecx, [ebp - 0x6ec]
call fcn.10054c00
mov ecx, eax
call fcn.10049e40
push eax
push 0x102afa48
push esi
call fcn.1000d2a0
add esp, 0xc
mov ecx, dword [ebp - 0x6d0]
call fcn.100c40f0
mov dword [ebp - 0x6cc], eax
jmp 0x100f795a
mov dword [ebp - 0x6cc], 0
mov ecx, dword [ebp - 0x6cc]
mov dword [ebp - 0x6e0], ecx
mov edx, dword [ebp - 0x6e0]
mov dword [0x10229c40], edx
push 0x30
call fcn.10150df0
add esp, 4
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 0
je 0x100f79d7
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x718], esp
movzx eax, byte [ebp - 0x6b7]
push eax
push 0x101f3eec
lea ecx, [ebp - 0x6f0]
call fcn.10054c40
mov ecx, eax
call fcn.10049e40
push eax
push 0x102afa48
push esi
call fcn.1000d2a0
add esp, 0xc
mov ecx, dword [ebp - 0x6c8]
call fcn.10055490
mov dword [ebp - 0x6c4], eax
jmp 0x100f79e1
mov dword [ebp - 0x6c4], 0
mov ecx, dword [ebp - 0x6c4]
mov dword [ebp - 0x6dc], ecx
mov edx, dword [ebp - 0x6dc]
mov dword [0x10229c20], edx
call fcn.100c9f90
mov ecx, dword [0x10229c40]
call fcn.100ca190
push 0x400
push 0
lea eax, [ebp - 0x468]
push eax
call fcn.10153ba0
add esp, 0xc
mov ecx, dword [0x102afa38]
add ecx, 0x925
xor ecx, 0xbb
imul edx, ecx, 0x94
and edx, 0xcc
push edx
push str._KK___x_
lea eax, [ebp - 0x468]
push eax
call fcn.100ebe50
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100ca050
mov edx, dword [0x102afa38]
mov eax, dword [edx + 0xb0]
xor eax, 0xac
imul ecx, eax, 0x75
and ecx, 0x5d
push ecx
push str._SZ1___x_
lea edx, [ebp - 0x468]
push edx
call fcn.1001e200
add esp, 0xc
push 0
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [0x10229c40]
call fcn.100ca050
mov ecx, dword [0x102afa38]
mov edx, dword [ecx + 0xac]
xor edx, 0xb2
imul eax, edx, 0x36
and eax, 0x14
push eax
push str._SZ2___x_
lea ecx, [ebp - 0x468]
push ecx
call fcn.100ebe50
add esp, 0xc
push 0
lea edx, [ebp - 0x468]
push edx
mov ecx, dword [0x10229c40]
call fcn.100ca050
mov eax, dword [0x102afa38]
mov ecx, dword [eax + 0xb4]
xor ecx, 0xde
imul edx, ecx, 0x71
and edx, 0x4e
push edx
push str._SZ3___x_
lea eax, [ebp - 0x468]
push eax
call fcn.100ebe50
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100ca050
mov edx, dword [0x102afa38]
mov eax, dword [edx + 0xc]
push eax
push str.CSRSS_process_id:__i
lea ecx, [ebp - 0x468]
push ecx
call fcn.100ebe50
add esp, 0xc
push 0
lea edx, [ebp - 0x468]
push edx
mov ecx, dword [0x10229c40]
call fcn.100ca050
mov eax, dword [0x102afa38]
mov ecx, dword [eax + 0x10]
push ecx
push str.WLG_process_id:__i
lea edx, [ebp - 0x468]
push edx
call fcn.100ebe50
add esp, 0xc
push 0
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [0x10229c40]
call fcn.100ca050
mov ecx, dword [0x102afa38]
mov edx, dword [ecx + 0xa0]
xor edx, 0x72
imul eax, edx, 0x41
and eax, 0x21
push eax
push str._SM1___x_
lea ecx, [ebp - 0x468]
push ecx
call fcn.100ebe50
add esp, 0xc
push 0
lea edx, [ebp - 0x468]
push edx
mov ecx, dword [0x10229c40]
call fcn.100ca050
mov eax, dword [0x102afa38]
mov ecx, dword [eax + 0x14]
xor ecx, 0x67
imul edx, ecx, 0x88
and edx, 0xe3
push edx
push str._SM2___x_
lea eax, [ebp - 0x468]
push eax
call fcn.100ebe50
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100ca050
nop
mov ecx, dword [0x10229c40]
call fcn.100ca530
movzx edx, al
test edx, edx
je 0x100f7c52
push 0
push str._x64__sistem_belirlendi
mov ecx, dword [0x10229c40]
call fcn.100ca050
push 0
push str.Sistem_servisi_ba
mov ecx, dword [0x10229c40]
call fcn.100ca050
push 0
push 0x101f4050
mov ecx, dword [0x10229c40]
call fcn.100ca050
nop
push 0
push str.Islemci_calisma_kumesi_olusturuldu.
mov ecx, dword [0x10229c40]
call fcn.100ca050
push 0
push str.Bellek_arayuzu_entegrasyonu_basladi
mov ecx, dword [0x10229c40]
call fcn.100ca050
push 0
push str.Bellek_arayuzu_entegrasyonu_tamamlandi
mov ecx, dword [0x10229c40]
call fcn.100ca050
push 0
push str.Essiz_kimlik_olusturuldu
mov ecx, dword [0x10229c40]
call fcn.100ca050
mov eax, dword [0x102afa38]
mov ecx, dword [eax + 0x2c]
xor ecx, 0x72
imul edx, ecx, 0x41
and edx, 0x21
push edx
push str.Yans
lea eax, [ebp - 0x468]
push eax
call fcn.100ebe50
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100ca050
push 0
push str.AA_sistemi_aktif_edildi
mov ecx, dword [0x10229c40]
call fcn.100ca050
push 0
push str.Haklar_al
mov ecx, dword [0x10229c40]
call fcn.100ca050
mov ecx, dword [0x10229c40]
call fcn.100ca590
push 0
push str.Haklar_elde_edildi
mov ecx, dword [0x10229c40]
call fcn.100ca050
push 0
push str.Sistem_ayarlar
mov ecx, dword [0x10229c40]
call fcn.100ca050
push 0x101f4140
push 0x101f40ec
mov ecx, dword [0x10229c40]
call fcn.100ca4e0
push 0x101f40d8
push 0x101f410c
mov ecx, dword [0x10229c40]
call fcn.100ca4e0
push 0x101f40fc
push 0x101f41c0
mov ecx, dword [0x10229c40]
call fcn.100ca4e0
push 0x101f41b4
push str.kernel32.dll
mov ecx, dword [0x10229c40]
call fcn.100ca4e0
push 0x101f41d0
push 0x101f4188
mov ecx, dword [0x10229c40]
call fcn.100ca4e0
push 0x101f4170
push 0x101f41a4
mov ecx, dword [0x10229c40]
call fcn.100ca4e0
push 0x101f4198
push str.Winmm.dll
mov ecx, dword [0x10229c40]
call fcn.100ca4e0
call fcn.100f8780
push 0
push 0x101f4224
mov ecx, dword [0x10229c40]
call fcn.100ca050
nop
push 0x3c
call fcn.10150df0
add esp, 4
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0
je 0x100f7dfe
mov ecx, dword [ebp - 0x6c0]
call fcn.10006820
mov dword [ebp - 0x6bc], eax
jmp 0x100f7e08
mov dword [ebp - 0x6bc], 0
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x6d8], edx
mov eax, dword [ebp - 0x6d8]
mov dword [0x10229c28], eax
mov ecx, dword [0x10229c28]
call fcn.10007080
mov byte [ebp - 0x6ae], al
mov ecx, dword [0x10229c28]
call fcn.10007160
mov byte [ebp - 0x6af], al
push 0
push str.PC_ban_sistemi_kontrol_ediliyor.
mov ecx, dword [0x10229c40]
call fcn.100ca050
nop
movzx ecx, byte [ebp - 0x6ae]
test ecx, ecx
jne 0x100f7e6a
movzx edx, byte [ebp - 0x6af]
test edx, edx
je 0x100f7eb3
push 1
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
mov ecx, dword [0x10229c40]
call fcn.100ca050
nop
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x71c], esp
push str.Pc_Blocked.
call fcn.10008f80
call fcn.100f6ec0
add esp, 0x1c
lea ecx, [ebp - 0x4a8]
call fcn.10008ea0
lea ecx, [ebp - 0x484]
call fcn.10008ea0
nop
jmp 0x100f7ee1
call fcn.100fcfd0
push 0
push str.ClientPlugin_aktif_edildi.
mov ecx, dword [0x10229c40]
call fcn.100ca050
lea ecx, [ebp - 0x4a8]
call fcn.10008ea0
lea ecx, [ebp - 0x484]
call fcn.10008ea0
nop
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10150c60
mov esp, ebp
pop ebp
ret