Function at 0x1002b588
Capabilities:
Link many functions at runtime
Read file via mapping
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x714]
sub esp, 0x794
mov eax, dword [0x10084500]
push ebx
push esi
push edi
mov esi, 0x420
xor ebx, ebx
push esi
mov dword [ebp + 0x710], eax
lea eax, [ebp - 0x5c]
push ebx
push eax
mov byte [ebp - 0x5d], bl
call fcn.10056960
add esp, 0xc
push dword [ebp + 0x71c]
push esi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
push ebx
push ebx
push 0xf001f
push eax
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x1002b8b4
push esi
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.10056df0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x5c], ebx
je 0x1002b631
push dword [ebp - 0x5c]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x1002b8b4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1002b62b
mov byte [ebp - 0x5d], 1
push esi
jmp 0x1002b8ae
call fcn.1001e3c3
test al, al
je 0x1002b755
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1002b8b4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push edi
call esi
push str.EnumProcessModules
push edi
mov dword [ebp - 0x64], eax
call esi
push str.GetModuleBaseNameA
push edi
mov dword [ebp - 0x74], eax
call esi
cmp dword [ebp - 0x64], ebx
mov dword [ebp - 0x78], eax
je 0x1002b8b4
cmp dword [ebp - 0x74], ebx
je 0x1002b8b4
mov esi, 0x1000
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0x70]
push ecx
push esi
push eax
mov dword [ebp - 0x6c], eax
call dword [ebp - 0x64]
test dword [ebp - 0x70], 0xfffffffc
mov dword [ebp - 0x68], ebx
jbe 0x1002b747
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
push dword [eax + ecx*4]
push ebx
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x1002b735
lea eax, [ebp - 0x80]
push eax
push 4
lea eax, [ebp - 0x64]
push eax
push edi
call dword [ebp - 0x74]
test eax, eax
je 0x1002b72e
push 0x104
lea eax, [ebp + 0x60c]
push eax
push dword [ebp - 0x64]
push edi
call dword [ebp - 0x78]
test eax, eax
je 0x1002b72e
mov esi, 0x1006f5b4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
lea eax, [ebp + 0x60c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
je 0x1002b726
add esi, 0xf
cmp esi, 0x1006f5c3
jl 0x1002b6ff
jmp 0x1002b72e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x70]
inc dword [ebp - 0x68]
shr eax, 2
cmp dword [ebp - 0x68], eax
jb 0x1002b6b6
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1002b8b4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1002b8b4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1006f920
push edi
call esi
push 0x1006f910
push edi
mov dword [ebp - 0x68], eax
call esi
push 0x1006f900
push edi
mov dword [ebp - 0x6c], eax
call esi
push str.Module32First
push edi
mov dword [ebp - 0x74], eax
call esi
push str.Module32Next
push edi
mov dword [ebp - 0x70], eax
call esi
cmp dword [ebp - 0x68], ebx
mov dword [ebp - 0x78], eax
je 0x1002b8b4
cmp dword [ebp - 0x6c], ebx
je 0x1002b8b4
cmp dword [ebp - 0x74], ebx
je 0x1002b8b4
cmp dword [ebp - 0x70], ebx
je 0x1002b8b4
cmp eax, ebx
je 0x1002b8b4
push ebx
push 2
call dword [ebp - 0x68]
cmp eax, 0xffffffff
mov dword [ebp - 0x64], eax
je 0x1002b8b4
lea eax, [ebp + 0x5e8]
push eax
push dword [ebp - 0x64]
mov dword [ebp + 0x5e8], 0x128
call dword [ebp - 0x6c]
jmp 0x1002b8a3
cmp dword [ebp + 0x5f0], ebx
je 0x1002b896
push dword [ebp + 0x5f0]
push 8
call dword [ebp - 0x68]
mov edi, eax
cmp edi, 0xffffffff
je 0x1002b896
lea eax, [ebp + 0x3c4]
push eax
push edi
mov dword [ebp + 0x3c4], 0x224
call dword [ebp - 0x70]
jmp 0x1002b86b
mov esi, 0x1006f5b4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
lea eax, [ebp + 0x3e4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
je 0x1002b871
add esi, 0xf
cmp esi, 0x1006f5c3
jl 0x1002b83b
lea eax, [ebp + 0x3c4]
push eax
push edi
call dword [ebp - 0x78]
test eax, eax
jne 0x1002b836
jmp 0x1002b88f
push dword [ebp + 0x5f0]
push ebx
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x1002b88f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x5e8]
push eax
push dword [ebp - 0x64]
call dword [ebp - 0x74]
test eax, eax
jne 0x1002b801
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x710]
mov al, byte [ebp - 0x5d]
pop edi
pop esi
pop ebx
call fcn.100568ae
add ebp, 0x714
leave
ret