Function at 0x1010cd00
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x388
mov eax, dword [0x10245db0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1010c8c0
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call fcn.100020f0
mov dword [0x1024ca24], eax
mov dword [0x1024cd68], 1
mov dword [0x1024cd6c], 1
mov dword [0x1024cd58], 0x102070f0
mov dword [0x1024cd5c], 0x10207174
mov dword [0x1024cd60], 0x1020718c
mov dword [0x1024cd64], 0x102071a4
call fcn.10111c50
lea ecx, [ebp - 0xfc]
push ecx
call fcn.1010c540
add esp, 4
push eax
mov ecx, 0x102c7a90
call fcn.1004dd80
lea ecx, [ebp - 0xfc]
call fcn.10044fc0
movzx edx, byte [ebp - 0x316]
push edx
push str.KnightOnLine.exe
lea ecx, [ebp - 0x180]
call fcn.1010eed0
mov ecx, eax
call fcn.10050d70
push eax
push 0x102c7a90
lea eax, [ebp - 0x84]
push eax
call fcn.10049750
add esp, 0xc
lea ecx, [ebp - 0x84]
push ecx
call fcn.1010c4b0
add esp, 4
movzx edx, al
test edx, edx
jne 0x1010ce50
push 0x30
movzx eax, byte [ebp - 0x317]
push eax
push 0x10207138
lea ecx, [ebp - 0x8c]
call fcn.1010f480
mov ecx, eax
call fcn.10072410
push eax
movzx ecx, byte [ebp - 0x30c]
push ecx
push str.KnightOnLine.exe_name_invalid
lea ecx, [ebp - 0x1e0]
call fcn.1010f0f0
mov ecx, eax
call fcn.100dd810
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x37c], esp
push 0x101e9d02
call fcn.100450b0
call fcn.1010c610
add esp, 0x1c
lea ecx, [ebp - 0x84]
call fcn.10044fc0
jmp 0x1010d371
mov byte [ebp - 0x309], 0
mov dword [ebp - 0x308], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x334], eax
lea edx, [ebp - 0x308]
push edx
mov eax, dword [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x1010cf14
lea ecx, [ebp - 0x308]
push ecx
mov edx, dword [ebp - 0x334]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x1010cf14
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0xc4]
call fcn.100450b0
push 0
movzx ecx, byte [ebp - 0x30d]
push ecx
push 0x10207160
lea ecx, [ebp - 0x16c]
call fcn.100fea00
mov ecx, eax
call fcn.1005da80
push eax
lea ecx, [ebp - 0xc4]
call fcn.100a9b20
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xffffffff
je 0x1010cf04
mov dl, byte [ebp - 0x309]
add dl, 1
mov byte [ebp - 0x309], dl
lea ecx, [ebp - 0xc4]
call fcn.10044fc0
jmp 0x1010ce8e
movzx eax, byte [ebp - 0x309]
cmp eax, 3
jle 0x1010cf98
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ecx, byte [ebp - 0x315]
push ecx
push 0x10207208
lea ecx, [ebp - 0x148]
call fcn.1010f540
mov ecx, eax
call fcn.10059f50
push eax
push 0x102c7a90
lea edx, [ebp - 0xe0]
push edx
call fcn.10049750
add esp, 0xc
push eax
lea ecx, [ebp - 0x84]
call fcn.1004dd80
lea ecx, [ebp - 0xe0]
call fcn.10044fc0
lea eax, [ebp - 0x84]
push eax
call fcn.1010c4b0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x1010d070
push 0x30
movzx edx, byte [ebp - 0x30e]
push edx
push str.Need_This_File_In_Directory
lea ecx, [ebp - 0x1c0]
call fcn.1010f710
mov ecx, eax
call fcn.1010d380
push eax
movzx eax, byte [ebp - 0x30f]
push eax
push 0x10207234
lea ecx, [ebp - 0x158]
call fcn.10094a20
mov ecx, eax
call fcn.10059f50
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x368], esp
push 0x101e9d15
call fcn.100450b0
call fcn.1010c610
add esp, 0x1c
lea ecx, [ebp - 0x84]
call fcn.10044fc0
jmp 0x1010d371
movzx ecx, byte [ebp - 0x310]
push ecx
push 0x102071cc
lea ecx, [ebp - 0x138]
call fcn.1010fa60
mov ecx, eax
call fcn.100597b0
push eax
push 0x102c7a90
lea edx, [ebp - 0x118]
push edx
call fcn.10049750
add esp, 0xc
push eax
lea ecx, [ebp - 0x84]
call fcn.1004dd80
lea ecx, [ebp - 0x118]
call fcn.10044fc0
lea eax, [ebp - 0x84]
push eax
call fcn.1010c4b0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x1010d148
push 0x30
movzx edx, byte [ebp - 0x311]
push edx
push 0x102071dc
lea ecx, [ebp - 0x1a0]
call fcn.1010fdc0
mov ecx, eax
call fcn.1010d380
push eax
movzx eax, byte [ebp - 0x312]
push eax
push str.OpenAL64.dll
lea ecx, [ebp - 0x128]
call fcn.1010fc10
mov ecx, eax
call fcn.100597b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x36c], esp
push 0x101e9d03
call fcn.100450b0
call fcn.1010c610
add esp, 0x1c
lea ecx, [ebp - 0x84]
call fcn.10044fc0
jmp 0x1010d371
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea edx, [ebp - 0x68]
push edx
lea ecx, [ebp - 0xa8]
call fcn.100450b0
push 0x550
call fcn.10154550
add esp, 4
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
je 0x1010d1db
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x370], esp
movzx eax, byte [ebp - 0x313]
push eax
push 0x10207258
lea ecx, [ebp - 0x350]
call fcn.10110110
mov ecx, eax
call fcn.100c9980
push eax
push 0x102c7a90
push esi
call fcn.10049750
add esp, 0xc
mov ecx, dword [ebp - 0x330]
call fcn.100db4f0
mov dword [ebp - 0x32c], eax
jmp 0x1010d1e5
mov dword [ebp - 0x32c], 0
mov ecx, dword [ebp - 0x32c]
mov dword [ebp - 0x340], ecx
mov edx, dword [ebp - 0x340]
mov dword [0x1024ca04], edx
push 0x30
call fcn.10154550
add esp, 4
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
je 0x1010d262
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x374], esp
movzx eax, byte [ebp - 0x314]
push eax
push 0x1020725c
lea ecx, [ebp - 0x34c]
call fcn.100f6fa0
mov ecx, eax
call fcn.100c9980
push eax
push 0x102c7a90
push esi
call fcn.10049750
add esp, 0xc
mov ecx, dword [ebp - 0x328]
call fcn.10082fc0
mov dword [ebp - 0x324], eax
jmp 0x1010d26c
mov dword [ebp - 0x324], 0
mov ecx, dword [ebp - 0x324]
mov dword [ebp - 0x33c], ecx
mov edx, dword [ebp - 0x33c]
mov dword [0x1024ca1c], edx
call fcn.1010d910
push 0x3c
call fcn.10154550
add esp, 4
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
je 0x1010d2b5
mov ecx, dword [ebp - 0x320]
call fcn.10042760
mov dword [ebp - 0x31c], eax
jmp 0x1010d2bf
mov dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x338], eax
mov ecx, dword [ebp - 0x338]
mov dword [0x1024ca08], ecx
mov ecx, dword [0x1024ca08]
call fcn.10042fc0
mov byte [ebp - 0x30a], al
mov ecx, dword [0x1024ca08]
call fcn.100430a0
mov byte [ebp - 0x30b], al
movzx edx, byte [ebp - 0x30a]
test edx, edx
jne 0x1010d30f
movzx eax, byte [ebp - 0x30b]
test eax, eax
je 0x1010d344
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x378], esp
push str.Pc_Blocked.
call fcn.100450b0
call fcn.1010c610
add esp, 0x1c
lea ecx, [ebp - 0xa8]
call fcn.10044fc0
lea ecx, [ebp - 0x84]
call fcn.10044fc0
jmp 0x1010d371
push 0x1010cc30
push 0x510de7
call fcn.1010cc70
add esp, 8
call fcn.10111be0
lea ecx, [ebp - 0xa8]
call fcn.10044fc0
lea ecx, [ebp - 0x84]
call fcn.10044fc0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10154220
mov esp, ebp
pop ebp
ret