Function at 0x100258f0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10050085
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b8
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [esp + 0x90]
push 0x128
push ebx
push eax
mov dword [esp + 0x1c], ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 0x90], 0x128
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
jne 0x10025966
xor al, al
mov ecx, dword [esp + 0x2c4]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x103
lea eax, [esp + 0x1bd]
mov byte [esp + 0x1bc], bl
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [esp + 0x1b8]
push 0x103
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
cmp byte [esp + 0x1b8], bl
jne 0x100259b6
xor ecx, ecx
jmp 0x100259c9
lea ecx, [esp + 0x1b8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100259c0
sub ecx, edx
push ecx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x68]
call fcn.10001a10
lea eax, [esp + 0x60]
mov dword [esp + 0x2cc], 0
push eax
lea eax, [esp + 0x4c]
push eax
call sym.KwLib.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_KwLib::StringUtility::Str2Lower_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
lea eax, [esp + 0x20]
mov byte [esp + 0x2d4], 2
push eax
lea eax, [esp + 0x54]
push eax
call sym.KwLib.dll_int___cdecl_KwLib::Dir::GetShortFileName_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____
add esp, 0x10
mov byte [esp + 0xf], 1
lea eax, [esp + 0x90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
test eax, eax
je 0x10025c47
jmp 0x10025a50
cmp byte [esp + 0xb4], 0
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
jne 0x10025a73
xor ecx, ecx
jmp 0x10025a89
lea ecx, [esp + 0xb4]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10025a80
sub ecx, edx
push ecx
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x38]
call fcn.10001a10
lea eax, [esp + 0x30]
mov byte [esp + 0x2cc], 3
push eax
lea eax, [esp + 0x7c]
or ebx, 1
push eax
mov dword [esp + 0x18], ebx
call sym.KwLib.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_KwLib::StringUtility::Str2Lower_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
mov ecx, eax
or ebx, 2
add esp, 8
mov dword [esp + 0x10], ebx
cmp dword [ecx + 0x14], 0x10
mov ebx, dword [ecx + 0x10]
jb 0x10025ad0
mov ecx, dword [ecx]
cmp dword [esp + 0x2c], 0x10
lea esi, [esp + 0x18]
mov edi, dword [esp + 0x28]
mov edx, ebx
cmovae esi, dword [esp + 0x18]
cmp edi, ebx
cmovb edx, edi
test edx, edx
je 0x10025b42
sub edx, 4
jb 0x10025b03
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x10025b08
add esi, 4
add ecx, 4
sub edx, 4
jae 0x10025af2
cmp edx, 0xfffffffc
je 0x10025b3c
mov al, byte [esi]
cmp al, byte [ecx]
jne 0x10025b35
cmp edx, 0xfffffffd
je 0x10025b3c
mov al, byte [esi + 1]
cmp al, byte [ecx + 1]
jne 0x10025b35
cmp edx, 0xfffffffe
je 0x10025b3c
mov al, byte [esi + 2]
cmp al, byte [ecx + 2]
jne 0x10025b35
cmp edx, 0xffffffff
je 0x10025b3c
mov al, byte [esi + 3]
cmp al, byte [ecx + 3]
je 0x10025b3c
sbb eax, eax
or eax, 1
jmp 0x10025b3e
xor eax, eax
test eax, eax
jne 0x10025b54
cmp edi, ebx
jae 0x10025b4b
or eax, 0xffffffff
jmp 0x10025b52
xor eax, eax
cmp edi, ebx
setne al
test eax, eax
sete al
test al, al
je 0x10025b6e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x98], eax
je 0x10025b6e
mov bl, 1
jmp 0x10025b70
xor bl, bl
mov eax, dword [esp + 0x10]
test al, 2
je 0x10025bb5
and eax, 0xfffffffd
cmp dword [esp + 0x8c], 0x10
mov dword [esp + 0x10], eax
jb 0x10025b9a
push dword [esp + 0x78]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], 0
mov byte [esp + 0x78], 0
mov dword [esp + 0x2cc], 2
test al, 1
je 0x10025bdf
and eax, 0xfffffffe
cmp dword [esp + 0x44], 0x10
mov dword [esp + 0x10], eax
jb 0x10025bdf
push dword [esp + 0x30]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
test bl, bl
je 0x10025c23
push dword [esp + 0x98]
mov byte [esp + 0x13], 0
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10025c23
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0xf], 1
lea eax, [esp + 0x90]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_Process32Next]
mov ebx, dword [esp + 0x10]
test eax, eax
jne 0x10025a50
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c], 0x10
jb 0x10025c61
push dword [esp + 0x18]
call esi
add esp, 4
cmp dword [esp + 0x5c], 0x10
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
jb 0x10025c86
push dword [esp + 0x48]
call esi
add esp, 4
cmp dword [esp + 0x74], 0x10
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], 0
mov byte [esp + 0x48], 0
jb 0x10025cab
push dword [esp + 0x60]
call esi
add esp, 4
mov ecx, dword [esp + 0x2c4]
mov al, byte [esp + 0xf]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret