Function at 0x1000b6f0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026356
mov eax, dword fs:[0]
push eax
mov eax, 0x1020
call fcn.1001e820
mov eax, dword [0x10031040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push 0xffc
lea eax, [ebp - 0x100c]
push esi
push eax
mov dword [ebp - 0x1010], esi
call fcn.10018f30
add esp, 0xc
lea ecx, [ebp - 0x1020]
push ecx
push 0x1000
lea edx, [ebp - 0x1010]
push edx
mov dword [ebp - 0x1020], esi
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x1000b977
mov eax, dword [ebp - 0x1020]
shr eax, 2
xor edi, edi
mov dword [ebp - 0x1024], eax
mov dword [ebp - 0x1018], edi
cmp eax, esi
jbe 0x1000b977
jmp 0x1000b790
mov eax, dword [ebp + edi*4 - 0x1010]
cmp eax, esi
je 0x1000b964
push eax
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x102c], ebx
mov dword [ebp - 4], esi
cmp ebx, esi
jne 0x1000b7c7
mov dword [ebp - 4], 0xffffffff
jmp 0x1000b964
lea eax, [ebp - 0x1028]
push eax
push 4
lea ecx, [ebp - 0x101c]
push ecx
push ebx
mov dword [ebp - 0x101c], esi
mov dword [ebp - 0x1028], esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x1000b801
push ebx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000b964
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x1014], edi
mov byte [ebp - 4], 1
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x1000b848
mov eax, 0x104
lea ecx, [ebp - 0x1014]
call fcn.10001c90
mov edi, dword [ebp - 0x1014]
mov ecx, dword [ebp - 0x101c]
push 0x104
push edi
push ecx
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov eax, dword [edi - 8]
push eax
push edi
call fcn.10017a48
add esp, 8
cmp eax, esi
jl 0x1000b993
cmp eax, dword [edi - 8]
jg 0x1000b993
xor edx, edx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], dx
cmp dword [edi - 0xc], esi
jl 0x1000b8e4
push str.adb.exe
push edi
call fcn.10017623
add esp, 8
cmp eax, esi
je 0x1000b8a6
sub eax, edi
sar eax, 1
cmp eax, esi
jg 0x1000b924
cmp dword [edi - 0xc], esi
jl 0x1000b8e4
push str.Mobogenie.exe
push edi
call fcn.10017623
add esp, 8
cmp eax, esi
je 0x1000b8c5
sub eax, edi
sar eax, 1
cmp eax, esi
jg 0x1000b924
cmp dword [edi - 0xc], esi
jl 0x1000b8e4
push str.dinst_64.exe
push edi
call fcn.10017623
add esp, 8
cmp eax, esi
je 0x1000b8e4
sub eax, edi
sar eax, 1
cmp eax, esi
jg 0x1000b924
mov ecx, str.dinst_32.exe
lea esi, [ebp - 0x1014]
call fcn.10001860
test eax, eax
jg 0x1000b922
mov ecx, str.Update.exe
call fcn.10001860
test eax, eax
jg 0x1000b922
mov ecx, str.CrashReport.exe
call fcn.10001860
test eax, eax
jg 0x1000b922
mov ecx, str.MobogenieService.exe
call fcn.10001860
test eax, eax
jle 0x1000b92e
xor esi, esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1000b930
xor esi, esi
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000b950
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x1018]
inc edi
mov dword [ebp - 0x1018], edi
cmp edi, dword [ebp - 0x1024]
jb 0x1000b790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017423
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.10001ef0
int3