Function at 0x10111a90
Capabilities:
Create thread
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70c
mov eax, dword [0x1024bdac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x10111430
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call fcn.100020f0
mov dword [0x10251bac], eax
call fcn.10116a60
lea ecx, [ebp - 0x51c]
push ecx
call fcn.101110b0
add esp, 4
push eax
mov ecx, 0x102ce820
call fcn.100508b0
lea ecx, [ebp - 0x51c]
call fcn.10045ea0
movzx edx, byte [ebp - 0x6c2]
push edx
push str.KnightOnLine.exe
lea ecx, [ebp - 0x54c]
call fcn.10114500
mov ecx, eax
call fcn.100538f0
push eax
push 0x102ce820
lea eax, [ebp - 0x484]
push eax
call fcn.1004bd80
add esp, 0xc
lea ecx, [ebp - 0x484]
push ecx
call fcn.10111020
add esp, 4
movzx edx, al
test edx, edx
jne 0x10111ba4
push 0x30
movzx eax, byte [ebp - 0x6c3]
push eax
push 0x1021160c
lea ecx, [ebp - 0x48c]
call fcn.10114ab0
mov ecx, eax
call fcn.10074940
push eax
movzx ecx, byte [ebp - 0x6c1]
push ecx
push str.KnightOnLine.exe_name_invalid
lea ecx, [ebp - 0x58c]
call fcn.10114720
mov ecx, eax
call fcn.100e3e30
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x704], esp
push 0x101f518b
call fcn.10045f80
call fcn.10111180
add esp, 0x1c
lea ecx, [ebp - 0x484]
call fcn.10045ea0
jmp 0x10112401
mov byte [ebp - 0x6b5], 0
mov dword [ebp - 0x6b4], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x6c0], eax
lea edx, [ebp - 0x6b4]
push edx
mov eax, dword [ebp - 0x6c0]
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x10111c6d
lea ecx, [ebp - 0x690]
push ecx
lea ecx, [ebp - 0x4e0]
call fcn.10045f80
lea edx, [ebp - 0x4e0]
push edx
lea eax, [ebp - 0x4c4]
push eax
call fcn.101119c0
add esp, 8
lea ecx, [ebp - 0x4e0]
call fcn.10045ea0
push 0
push str.knightonline.exe
lea ecx, [ebp - 0x4c4]
call fcn.100ae680
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 0xffffffff
je 0x10111c45
mov cl, byte [ebp - 0x6b5]
add cl, 1
mov byte [ebp - 0x6b5], cl
lea ecx, [ebp - 0x4c4]
call fcn.10045ea0
lea edx, [ebp - 0x6b4]
push edx
mov eax, dword [ebp - 0x6c0]
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x10111be2
mov ecx, dword [ebp - 0x6c0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [ebp - 0x6b5]
cmp edx, 3
jle 0x10111c9b
push 0
push 0
push 0
push 0x101118d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movzx eax, byte [ebp - 0x6c4]
push eax
push 0x102115c4
lea ecx, [ebp - 0x500]
call fcn.1005aed0
mov ecx, eax
call fcn.10043af0
push eax
push 0x102ce820
lea ecx, [ebp - 0x538]
push ecx
call fcn.1004bd80
add esp, 0xc
push eax
lea ecx, [ebp - 0x484]
call fcn.100508b0
lea ecx, [ebp - 0x538]
call fcn.10045ea0
lea edx, [ebp - 0x484]
push edx
call fcn.10111020
add esp, 4
movzx eax, al
test eax, eax
jne 0x10111d73
push 0x30
movzx ecx, byte [ebp - 0x6c5]
push ecx
push str.Need_This_File_In_Directory
lea ecx, [ebp - 0x56c]
call fcn.10114ce0
mov ecx, eax
call fcn.10112410
push eax
movzx edx, byte [ebp - 0x6b8]
push edx
push 0x102115ec
lea ecx, [ebp - 0x4f0]
call fcn.10114b70
mov ecx, eax
call fcn.10043af0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x708], esp
push 0x101f519e
call fcn.10045f80
call fcn.10111180
add esp, 0x1c
lea ecx, [ebp - 0x484]
call fcn.10045ea0
jmp 0x10112401
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x4a8]
call fcn.10045f80
push 0x550
call fcn.101551e0
add esp, 4
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 0
je 0x10111e06
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x70c], esp
movzx edx, byte [ebp - 0x6b9]
push edx
push 0x10211670
lea ecx, [ebp - 0x6f8]
call fcn.10115030
mov ecx, eax
call fcn.100cfff0
push eax
push 0x102ce820
push esi
call fcn.1004bd80
add esp, 0xc
mov ecx, dword [ebp - 0x6e0]
call fcn.100e1a80
mov dword [ebp - 0x6dc], eax
jmp 0x10111e10
mov dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x6e4], eax
mov ecx, dword [ebp - 0x6e4]
mov dword [0x10251b9c], ecx
push 0x30
call fcn.101551e0
add esp, 4
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 0
je 0x10111e8d
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x6fc], esp
movzx edx, byte [ebp - 0x6ba]
push edx
push 0x10211674
lea ecx, [ebp - 0x6f4]
call fcn.10115070
mov ecx, eax
call fcn.100cfff0
push eax
push 0x102ce820
push esi
call fcn.1004bd80
add esp, 0xc
mov ecx, dword [ebp - 0x6d8]
call fcn.10085050
mov dword [ebp - 0x6d4], eax
jmp 0x10111e97
mov dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6ec], eax
mov ecx, dword [ebp - 0x6ec]
mov dword [0x10251b88], ecx
call fcn.100be9f0
mov ecx, dword [0x10251b9c]
call fcn.100bebf0
push 0x400
push 0
lea edx, [ebp - 0x468]
push edx
call fcn.10157e80
add esp, 0xc
mov eax, dword [0x102ce660]
add eax, 0x925
xor eax, 0xbb
imul ecx, eax, 0x94
and ecx, 0xcc
push ecx
push str._KK___x_
lea edx, [ebp - 0x468]
push edx
call fcn.100ebce0
add esp, 0xc
push 0
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [0x10251b9c]
call fcn.100beab0
mov ecx, dword [0x102ce660]
mov edx, dword [ecx + 0xb0]
xor edx, 0xac
imul eax, edx, 0x75
and eax, 0x5d
push eax
push str._SZ1___x_
lea ecx, [ebp - 0x468]
push ecx
call fcn.1005b940
add esp, 0xc
push 0
lea edx, [ebp - 0x468]
push edx
mov ecx, dword [0x10251b9c]
call fcn.100beab0
mov eax, dword [0x102ce660]
mov ecx, dword [eax + 0xac]
xor ecx, 0xb2
imul edx, ecx, 0x36
and edx, 0x14
push edx
push str._SZ2___x_
lea eax, [ebp - 0x468]
push eax
call fcn.100ebce0
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10251b9c]
call fcn.100beab0
mov edx, dword [0x102ce660]
mov eax, dword [edx + 0xb4]
xor eax, 0xde
imul ecx, eax, 0x71
and ecx, 0x4e
push ecx
push str._SZ3___x_
lea edx, [ebp - 0x468]
push edx
call fcn.100ebce0
add esp, 0xc
push 0
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [0x10251b9c]
call fcn.100beab0
mov ecx, dword [0x102ce660]
mov edx, dword [ecx + 0xc]
push edx
push str.CSRSS_process_id:__i
lea eax, [ebp - 0x468]
push eax
call fcn.100ebce0
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10251b9c]
call fcn.100beab0
mov edx, dword [0x102ce660]
mov eax, dword [edx + 0x10]
push eax
push str.WLG_process_id:__i
lea ecx, [ebp - 0x468]
push ecx
call fcn.100ebce0
add esp, 0xc
push 0
lea edx, [ebp - 0x468]
push edx
mov ecx, dword [0x10251b9c]
call fcn.100beab0
mov eax, dword [0x102ce660]
mov ecx, dword [eax + 0xa0]
xor ecx, 0x72
imul edx, ecx, 0x41
and edx, 0x21
push edx
push str._SM1___x_
lea eax, [ebp - 0x468]
push eax
call fcn.100ebce0
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10251b9c]
call fcn.100beab0
mov edx, dword [0x102ce660]
mov eax, dword [edx + 0x14]
xor eax, 0x67
imul ecx, eax, 0x88
and ecx, 0xe3
push ecx
push str._SM2___x_
lea edx, [ebp - 0x468]
push edx
call fcn.100ebce0
add esp, 0xc
push 0
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [0x10251b9c]
call fcn.100beab0
call fcn.10111870
movzx ecx, al
test ecx, ecx
je 0x101120fe
push 0
push str._x64__sistem_belirlendi
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push 0x10211684
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Sistem_servisi_ba
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Islemci_calisma_kumesi_olusturuldu.
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Bellek_arayuzu_entegrasyonu_basladi
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Bellek_arayuzu_entegrasyonu_tamamlandi
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Essiz_kimlik_olusturuldu
mov ecx, dword [0x10251b9c]
call fcn.100beab0
mov edx, dword [0x102ce660]
mov eax, dword [edx + 0x2c]
xor eax, 0x72
imul ecx, eax, 0x41
and ecx, 0x21
push ecx
push str.Yans
lea edx, [ebp - 0x468]
push edx
call fcn.100ebce0
add esp, 0xc
push 0
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.AA_sistemi_aktif_edildi
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Haklar_al
mov ecx, dword [0x10251b9c]
call fcn.100beab0
mov ecx, dword [0x10251b9c]
call fcn.100bef90
push 0
push str.Haklar_elde_edildi
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Sistem_ayarlar
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0x10211790
push 0x10211854
mov ecx, dword [0x10251b9c]
call fcn.100bef40
push 0x10211864
push 0x10211878
mov ecx, dword [0x10251b9c]
call fcn.100bef40
push 0x10211888
push 0x10211818
mov ecx, dword [0x10251b9c]
call fcn.100bef40
push 0x10211828
push 0x10211834
mov ecx, dword [0x10251b9c]
call fcn.100bef40
push 0x10211844
push 0x10211908
mov ecx, dword [0x10251b9c]
call fcn.100bef40
push 0x10211918
push str.kernel32.dll
mov ecx, dword [0x10251b9c]
call fcn.100bef40
push 0x10211940
push str.Winmm.dll
mov ecx, dword [0x10251b9c]
call fcn.100bef40
mov ecx, dword [0x10251b9c]
call fcn.10041f10
push 0
push str.Sistem_segmentleri_kontrol_ediliyor
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Log_sistemi_aktif_ediliyor
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Adres_y
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Kimlik_y
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0
push str.Geni
mov ecx, dword [0x10251b9c]
call fcn.100beab0
call fcn.10112980
push 0
push 0x10211a28
mov ecx, dword [0x10251b9c]
call fcn.100beab0
push 0x3c
call fcn.101551e0
add esp, 4
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 0
je 0x1011230f
mov ecx, dword [ebp - 0x6d0]
call fcn.10043710
mov dword [ebp - 0x6cc], eax
jmp 0x10112319
mov dword [ebp - 0x6cc], 0
mov ecx, dword [ebp - 0x6cc]
mov dword [ebp - 0x6f0], ecx
mov edx, dword [ebp - 0x6f0]
mov dword [0x10251b8c], edx
mov ecx, dword [0x10251b8c]
call fcn.10043ff0
mov byte [ebp - 0x6b6], al
mov ecx, dword [0x10251b8c]
call fcn.100440c0
mov byte [ebp - 0x6b7], al
push 0
push str.PC_ban_sistemi_kontrol_ediliyor.
mov ecx, dword [0x10251b9c]
call fcn.100beab0
movzx eax, byte [ebp - 0x6b6]
test eax, eax
jne 0x1011237b
movzx ecx, byte [ebp - 0x6b7]
test ecx, ecx
je 0x101123c2
push 1
push 0x1021194c
mov ecx, dword [0x10251b9c]
call fcn.100beab0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x700], esp
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
call fcn.10045f80
call fcn.10111180
add esp, 0x1c
lea ecx, [ebp - 0x4a8]
call fcn.10045ea0
lea ecx, [ebp - 0x484]
call fcn.10045ea0
jmp 0x10112401
push 0x101117a0
push 0x510de7
call fcn.101117e0
add esp, 8
call fcn.101169f0
push 0
push str.ClientPlugin_aktif_edildi.
mov ecx, dword [0x10251b9c]
call fcn.100beab0
lea ecx, [ebp - 0x4a8]
call fcn.10045ea0
lea ecx, [ebp - 0x484]
call fcn.10045ea0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154eb0
mov esp, ebp
pop ebp
ret