Function at 0x10001280
Capabilities:
Enumerate processes
Get common file path
Terminate process
Terminate process by name

Disassembly:
mov eax, 0x13d0
call fcn.1001a200
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebp
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.10001200
test eax, eax
je 0x100012b5
mov ecx, esi
call fcn.10001260
lea eax, [esp + 0x144]
mov dword [esp + 0x144], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x154]
mov ecx, esi
cmp eax, 1
jne 0x100012f2
call fcn.100010c0
test eax, eax
jne 0x10001306
mov ecx, esi
call fcn.10001100
test eax, eax
je 0x1000130d
jmp 0x10001306
call fcn.10001230
test eax, eax
jne 0x10001306
mov ecx, esi
call fcn.100011d0
test eax, eax
je 0x1000130d
mov ecx, esi
call fcn.10001260
mov dword [esp + 0x1c], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebp
push 2
mov edi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x1c]
mov esi, eax
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1000137e
lea edx, [esp + 0x1c]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1000137e
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x40]
push str.explorer.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [esp + 0x24]
jne 0x10001365
mov dword [esp + 0x10], eax
cmp eax, edi
jne 0x1000136d
mov ebx, dword [esp + 0x34]
lea ecx, [esp + 0x1c]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10001349
jmp 0x10001382
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ebx, eax
je 0x100013af
cmp eax, ebp
je 0x100013af
push ebx
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x13d0
ret
cmp dword [esp + 0x154], 1
je 0x100014f1
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebp
je 0x100014f1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcessModules
push edi
call esi
push str.GetModuleFileNameExA
push edi
mov dword [0x1011ea10], eax
call esi
lea edx, [esp + 0x1d8]
push 0x105
push edx
mov dword [0x1011ea14], eax
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x1d8]
push 0x1010d0b4
push eax
call esi
lea ecx, [esp + 0x1d8]
push str.EXPLORER.EXE
push ecx
call esi
push ebx
push ebp
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
je 0x100014f1
lea edx, [esp + 0x18]
lea eax, [esp + 0x3e0]
push edx
push 0x1000
push eax
push esi
call dword [0x1011ea10]
test eax, eax
je 0x100014c0
test dword [esp + 0x18], 0xfffffffc
jbe 0x100014c0
lea ebx, [esp + 0x3e0]
mov edx, dword [ebx]
lea ecx, [esp + 0x2dc]
push 0x104
push ecx
push edx
push esi
call dword [0x1011ea14]
test eax, eax
je 0x100014a7
lea eax, [esp + 0x2dc]
lea ecx, [esp + 0x1d8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100014b8
mov edx, dword [esp + 0x18]
inc ebp
shr edx, 2
add ebx, 4
cmp ebp, edx
jb 0x10001472
jmp 0x100014c0
mov dword [esp + 0x14], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x100014f1
mov eax, dword [esp + 0x10]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x13d0
ret