Function at 0x1003e060
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017f1e1
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x101fd398]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x241], dl
test ecx, ecx
jne 0x1003e09f
xor eax, eax
jmp 0x1003e31d
push ecx
lea ecx, [ebp - 0x248]
call fcn.1000af00
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.1000a8b0
mov esi, eax
lea ecx, [ebp - 0x248]
push esi
call fcn.1000abc0
lea ecx, [esi + 1]
push ecx
push eax
call fcn.10166c33
add esp, 8
lea ecx, [ebp - 0x248]
push esi
call fcn.1000adb0
lea ecx, [ebp - 0x248]
call fcn.10005500
push 0x22c
lea eax, [ebp - 0x23c]
push 0
push eax
call fcn.10155de0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1003e123
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1003e310
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1003e153
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003e310
mov ecx, 1
call fcn.1003dc10
nop dword [eax]
push dword [ebp - 0x234]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1003e2e8
lea ecx, [ebp - 0x240]
call fcn.10007cc0
push 0x400
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.1000abc0
push 0x400
lea ecx, [ebp - 0x240]
mov esi, eax
call fcn.1000ad60
push 0x400
push esi
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x240]
call fcn.10005540
lea ecx, [ebp - 0x240]
call fcn.1000a8b0
mov esi, eax
lea ecx, [ebp - 0x240]
push esi
call fcn.1000abc0
lea ecx, [esi + 1]
push ecx
push eax
call fcn.10166c33
add esp, 8
lea ecx, [ebp - 0x240]
push esi
call fcn.1000adb0
lea ecx, [ebp - 0x240]
call fcn.10005500
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea ecx, [ebp - 0x248]
call fcn.100055d0
push eax
lea ecx, [ebp - 0x240]
call fcn.100063f0
test eax, eax
jne 0x1003e2d7
push dword [ebp - 0x234]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1003e281
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp byte [ebp - 0x241], 0
je 0x1003e26d
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call fcn.10009c10
jmp 0x1003e2ee
lea ecx, [ebp - 0x24c]
call fcn.10007cc0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24c]
push dword [ebp - 0x234]
push str._c_taskkill__f__PID___d
push eax
call fcn.10012d60
add esp, 0xc
lea ecx, [ebp - 0x24c]
push 0
push 0
call fcn.100055d0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x24c]
call fcn.10009c10
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call fcn.10009c10
jmp 0x1003e2ee
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1003e160
xor ecx, ecx
call fcn.1003dc10
push ebx
call edi
xor esi, esi
lea ecx, [ebp - 0x248]
call fcn.10009c10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10153588
mov esp, ebp
pop ebp
ret