Function at 0x1001fce0
Capabilities:
Enumerate process modules
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099afb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x146c
call fcn.100974c0
mov eax, dword [0x100e6018]
xor eax, esp
mov dword [esp + 0x1468], eax
push ebx
push esi
push edi
mov eax, dword [0x100e6018]
xor eax, esp
push eax
lea eax, [esp + 0x1480]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esp + 0x14], esi
cmp dword [esi + 0x14], 8
jb 0x1001fd36
mov eax, dword [esi]
jmp 0x1001fd38
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, eax
xor eax, eax
mov dword [esp + 0x268], 7
mov dword [esp + 0x264], 0
mov word [esp + 0x254], ax
cmp word [edx], ax
jne 0x1001fd6a
xor ecx, ecx
jmp 0x1001fd83
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001fd70
sub ecx, esi
mov esi, dword [esp + 0x14]
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x25c]
call fcn.100089b0
push 0
push 2
mov dword [esp + 0x1490], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x1001ff78
test eax, eax
je 0x1001ff78
push 0x228
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x28], 0x22c
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
xor bl, bl
mov byte [esp + 0x1b], bl
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1001ff70
lea ebx, [ebx]
cmp dword [esp + 0x268], 8
lea eax, [esp + 0x254]
cmovae eax, dword [esp + 0x254]
lea ecx, [esp + 0x40]
jmp 0x1001fe20
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1001fe46
test dx, dx
je 0x1001fe42
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1001fe46
add ecx, 4
add eax, 4
test dx, dx
jne 0x1001fe20
xor eax, eax
jmp 0x1001fe4b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1001ff51
push dword [esp + 0x24]
push eax
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1001ff4b
lea eax, [esp + 0x250]
push eax
push 0x1000
lea eax, [esp + 0x274]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x1001ff40
xor ebx, ebx
test dword [esp + 0x250], 0xfffffffc
jbe 0x1001ff40
xor eax, eax
push 0x206
push eax
mov word [esp + 0x1274], ax
lea eax, [esp + 0x1276]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x126c]
push 0x104
push eax
push dword [esp + ebx*4 + 0x274]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x1001ff29
mov ecx, esi
call fcn.100086e0
push eax
lea eax, [esp + 0x1270]
push eax
call dword [sym.imp.MSVCR110.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x1001ff29
push eax
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
test esi, esi
jne 0x1001ff18
push eax
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test esi, esi
setne byte [esp + 0x13]
mov eax, dword [esp + 0x250]
mov esi, dword [esp + 0x14]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x1001fea4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x1001ff51
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x1001fe00
mov bl, byte [esp + 0x13]
push dword [esp + 0x18]
call edi
jmp 0x1001ff7a
xor bl, bl
cmp dword [esp + 0x268], 8
jb 0x1001ff94
push dword [esp + 0x254]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x1480]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1468]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret