Function at 0x10111980
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x724
mov eax, dword [0x10247db0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x101114d0
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call fcn.100020f0
mov dword [0x10266cc0], eax
call fcn.10117500
lea ecx, [ebp - 0x51c]
push ecx
call fcn.101110f0
add esp, 4
push eax
mov ecx, 0x102e1b6c
call fcn.1004eac0
lea ecx, [ebp - 0x51c]
call fcn.100450b0
movzx edx, byte [ebp - 0x6b0]
push edx
push 0x1020d694
lea ecx, [ebp - 0x544]
call fcn.10114a40
mov ecx, eax
call fcn.10051ab0
push eax
push 0x102e1b6c
lea eax, [ebp - 0x484]
push eax
call fcn.10049f10
add esp, 0xc
lea ecx, [ebp - 0x484]
push ecx
call fcn.10111060
add esp, 4
movzx edx, al
test edx, edx
jne 0x10111a94
push 0x30
movzx eax, byte [ebp - 0x6b1]
push eax
push 0x1020d6a8
lea ecx, [ebp - 0x48c]
call fcn.100ed560
mov ecx, eax
call fcn.10071900
push eax
movzx ecx, byte [ebp - 0x6b2]
push ecx
push str.KnightOnLine.exe_name_invalid
lea ecx, [ebp - 0x584]
call fcn.10114c60
mov ecx, eax
call fcn.100d93b0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x720], esp
push 0x101f19bb
call fcn.100451a0
call fcn.10111200
add esp, 0x1c
lea ecx, [ebp - 0x484]
call fcn.100450b0
jmp 0x1011234d
mov byte [ebp - 0x6ad], 0
mov dword [ebp - 0x6ac], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x6d4], eax
lea edx, [ebp - 0x6ac]
push edx
mov eax, dword [ebp - 0x6d4]
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x10111b58
lea ecx, [ebp - 0x6ac]
push ecx
mov edx, dword [ebp - 0x6d4]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x10111b58
lea eax, [ebp - 0x688]
push eax
lea ecx, [ebp - 0x4c4]
call fcn.100451a0
push 0
movzx ecx, byte [ebp - 0x6b8]
push ecx
push str.KnightOnLine.exe
lea ecx, [ebp - 0x530]
call fcn.10114ff0
mov ecx, eax
call fcn.10071a80
push eax
lea ecx, [ebp - 0x4c4]
call fcn.100ab370
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 0xffffffff
je 0x10111b48
mov dl, byte [ebp - 0x6ad]
add dl, 1
mov byte [ebp - 0x6ad], dl
lea ecx, [ebp - 0x4c4]
call fcn.100450b0
jmp 0x10111ad2
movzx eax, byte [ebp - 0x6ad]
cmp eax, 3
jle 0x10111bdc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ecx, byte [ebp - 0x6b3]
push ecx
push 0x1020d74c
lea ecx, [ebp - 0x4e4]
call fcn.100739c0
mov ecx, eax
call fcn.10042b50
push eax
push 0x102e1b6c
lea edx, [ebp - 0x500]
push edx
call fcn.10049f10
add esp, 0xc
push eax
lea ecx, [ebp - 0x484]
call fcn.1004eac0
lea ecx, [ebp - 0x500]
call fcn.100450b0
lea eax, [ebp - 0x484]
push eax
call fcn.10111060
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10111cb4
push 0x30
movzx edx, byte [ebp - 0x6b4]
push edx
push str.Need_This_File_In_Directory
lea ecx, [ebp - 0x564]
call fcn.10115360
mov ecx, eax
call fcn.10112360
push eax
movzx eax, byte [ebp - 0x6b5]
push eax
push 0x1020d708
lea ecx, [ebp - 0x4d4]
call fcn.101151f0
mov ecx, eax
call fcn.10042b50
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x710], esp
push 0x101f19ab
call fcn.100451a0
call fcn.10111200
add esp, 0x1c
lea ecx, [ebp - 0x484]
call fcn.100450b0
jmp 0x1011234d
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea edx, [ebp - 0x68]
push edx
lea ecx, [ebp - 0x4a8]
call fcn.100451a0
push 0x558
call fcn.10159ea0
add esp, 4
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 0
je 0x10111d47
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x714], esp
movzx eax, byte [ebp - 0x6b6]
push eax
push 0x1020d714
lea ecx, [ebp - 0x6ec]
call fcn.1007c8e0
mov ecx, eax
call fcn.1007ade0
push eax
push 0x102e1b6c
push esi
call fcn.10049f10
add esp, 0xc
mov ecx, dword [ebp - 0x6d0]
call fcn.100e1d60
mov dword [ebp - 0x6cc], eax
jmp 0x10111d51
mov dword [ebp - 0x6cc], 0
mov ecx, dword [ebp - 0x6cc]
mov dword [ebp - 0x6e0], ecx
mov edx, dword [ebp - 0x6e0]
mov dword [0x10266cc8], edx
push 0x30
call fcn.10159ea0
add esp, 4
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 0
je 0x10111dce
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x718], esp
movzx eax, byte [ebp - 0x6b7]
push eax
push 0x1020d79c
lea ecx, [ebp - 0x6f0]
call fcn.1007c8e0
mov ecx, eax
call fcn.1007ade0
push eax
push 0x102e1b6c
push esi
call fcn.10049f10
add esp, 0xc
mov ecx, dword [ebp - 0x6c8]
call fcn.10085340
mov dword [ebp - 0x6c4], eax
jmp 0x10111dd8
mov dword [ebp - 0x6c4], 0
mov ecx, dword [ebp - 0x6c4]
mov dword [ebp - 0x6dc], ecx
mov edx, dword [ebp - 0x6dc]
mov dword [0x10266cc4], edx
call fcn.100bb590
mov ecx, dword [0x10266cc8]
call fcn.100be0b0
push 0x400
push 0
lea eax, [ebp - 0x468]
push eax
call fcn.1015cb20
add esp, 0xc
mov ecx, dword [0x102e19ac]
add ecx, 0x925
xor ecx, 0xbb
imul edx, ecx, 0x94
and edx, 0xcc
push edx
push str._KK___x_
lea eax, [ebp - 0x468]
push eax
call fcn.100ec740
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov edx, dword [0x102e19ac]
mov eax, dword [edx + 0xb0]
xor eax, 0xac
imul ecx, eax, 0x75
and ecx, 0x5d
push ecx
push str._SZ1___x_
lea edx, [ebp - 0x468]
push edx
call fcn.100584b0
add esp, 0xc
push 0
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov ecx, dword [0x102e19ac]
mov edx, dword [ecx + 0xac]
xor edx, 0xb2
imul eax, edx, 0x36
and eax, 0x14
push eax
push str._SZ2___x_
lea ecx, [ebp - 0x468]
push ecx
call fcn.100ec740
add esp, 0xc
push 0
lea edx, [ebp - 0x468]
push edx
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov eax, dword [0x102e19ac]
mov ecx, dword [eax + 0xb4]
xor ecx, 0xde
imul edx, ecx, 0x71
and edx, 0x4e
push edx
push str._SZ3___x_
lea eax, [ebp - 0x468]
push eax
call fcn.100ec740
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov edx, dword [0x102e19ac]
mov eax, dword [edx + 0xc]
push eax
push str.CSRSS_process_id:__i
lea ecx, [ebp - 0x468]
push ecx
call fcn.100ec740
add esp, 0xc
push 0
lea edx, [ebp - 0x468]
push edx
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov eax, dword [0x102e19ac]
mov ecx, dword [eax + 0x10]
push ecx
push str.WLG_process_id:__i
lea edx, [ebp - 0x468]
push edx
call fcn.100ec740
add esp, 0xc
push 0
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov ecx, dword [0x102e19ac]
mov edx, dword [ecx + 0xa0]
xor edx, 0x72
imul eax, edx, 0x41
and eax, 0x21
push eax
push str._SM1___x_
lea ecx, [ebp - 0x468]
push ecx
call fcn.100ec740
add esp, 0xc
push 0
lea edx, [ebp - 0x468]
push edx
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov eax, dword [0x102e19ac]
mov ecx, dword [eax + 0x14]
xor ecx, 0x67
imul edx, ecx, 0x88
and edx, 0xe3
push edx
push str._SM2___x_
lea eax, [ebp - 0x468]
push eax
call fcn.100ec740
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
call fcn.10111910
movzx edx, al
test edx, edx
je 0x10112041
push 0
push str._x64__sistem_belirlendi
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push 0x1020d874
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Sistem_servisi_ba
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Islemci_calisma_kumesi_olusturuldu.
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Bellek_arayuzu_entegrasyonu_basladi
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Bellek_arayuzu_entegrasyonu_tamamlandi
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Essiz_kimlik_olusturuldu
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov eax, dword [0x102e19ac]
mov ecx, dword [eax + 0x2c]
xor ecx, 0x72
imul edx, ecx, 0x41
and edx, 0x21
push edx
push str.Yans
lea eax, [ebp - 0x468]
push eax
call fcn.100ec740
add esp, 0xc
push 0
lea ecx, [ebp - 0x468]
push ecx
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.AA_sistemi_aktif_edildi
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Haklar_al
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov ecx, dword [0x10266cc8]
call fcn.100be450
push 0
push str.Haklar_elde_edildi
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Sistem_ayarlar
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0x1020d8d0
push 0x1020d8e4
mov ecx, dword [0x10266cc8]
call fcn.100be400
push 0x1020d8f4
push 0x1020d9a4
mov ecx, dword [0x10266cc8]
call fcn.100be400
push 0x1020d9b4
push 0x1020d9c4
mov ecx, dword [0x10266cc8]
call fcn.100be400
push 0x1020d9d4
push 0x1020d95c
mov ecx, dword [0x10266cc8]
call fcn.100be400
push 0x1020d96c
push 0x1020d97c
mov ecx, dword [0x10266cc8]
call fcn.100be400
push 0x1020d98c
push str.kernel32.dll
mov ecx, dword [0x10266cc8]
call fcn.100be400
push 0x1020da74
push str.Winmm.dll
mov ecx, dword [0x10266cc8]
call fcn.100be400
mov ecx, dword [0x10266cc8]
call fcn.10040f30
push 0
push str.Sistem_segmentleri_kontrol_ediliyor
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
mov ecx, dword [0x10266cc8]
call fcn.100bb880
push 0
push str.Log_sistemi_aktif_ediliyor
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Adres_y
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Kimlik_y
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0
push str.Geni
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
call fcn.10112c10
push 0
push 0x1020dadc
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
push 0x3c
call fcn.10159ea0
add esp, 4
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0
je 0x1011225c
mov ecx, dword [ebp - 0x6c0]
call fcn.10042700
mov dword [ebp - 0x6bc], eax
jmp 0x10112266
mov dword [ebp - 0x6bc], 0
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x6d8], edx
mov eax, dword [ebp - 0x6d8]
mov dword [0x10266ca4], eax
mov ecx, dword [0x10266ca4]
call fcn.10043050
mov byte [ebp - 0x6ae], al
mov ecx, dword [0x10266ca4]
call fcn.10043120
mov byte [ebp - 0x6af], al
push 0
push str.PC_ban_sistemi_kontrol_ediliyor.
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
movzx ecx, byte [ebp - 0x6ae]
test ecx, ecx
jne 0x101122c7
movzx edx, byte [ebp - 0x6af]
test edx, edx
je 0x1011230e
push 1
push 0x1020db18
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x71c], esp
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
call fcn.100451a0
call fcn.10111200
add esp, 0x1c
lea ecx, [ebp - 0x4a8]
call fcn.100450b0
lea ecx, [ebp - 0x484]
call fcn.100450b0
jmp 0x1011234d
push 0x10111840
push 0x510de7
call fcn.10111880
add esp, 8
call fcn.10117490
push 0
push str.ClientPlugin_aktif_edildi.
mov ecx, dword [0x10266cc8]
call fcn.100bdf70
lea ecx, [ebp - 0x4a8]
call fcn.100450b0
lea ecx, [ebp - 0x484]
call fcn.100450b0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10159b70
mov esp, ebp
pop ebp
ret