Function at 0x10001e60
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000480b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x388
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0xa
call fcn.100014e0
push 0
push 2
mov dword [ebp - 0x358], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x358]
mov dword [ebp - 0x35c], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
xor edi, edi
test eax, eax
je 0x10001fca
mov dword [ebp - 0x364], str.ToolsX64.exe
mov dword [ebp - 0x360], 0x10005300
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0x128]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x128]
push 0
push 0
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x334]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor esi, esi
nop dword [eax + eax]
mov eax, dword [ebp + esi*4 - 0x364]
lea ecx, [ebp - 0x128]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10001f70
test dl, dl
je 0x10001f6c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10001f70
add ecx, 2
add eax, 2
test dl, dl
jne 0x10001f50
xor eax, eax
jmp 0x10001f75
sbb eax, eax
or eax, 1
test eax, eax
je 0x10001f83
inc esi
cmp esi, 2
jl 0x10001f40
xor cl, cl
jmp 0x10001f85
mov cl, 1
test cl, cl
lea eax, [edi + 1]
cmove eax, edi
mov edi, eax
lea eax, [ebp - 0x358]
push eax
push dword [ebp - 0x35c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10001f00
cmp edi, 2
jl 0x10001fca
push 0x10
push str.CloudMusic
push str.isDangerProcRunning
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.10001420
test al, al
je 0x100020c3
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x37c]
push 0x12
xorps xmm0, xmm0
mov dword [ebp - 0x36c], 0
push str.175135463646456646
movups xmmword [ebp - 0x37c], xmm0
mov dword [ebp - 0x368], 0
call fcn.100032f0
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call edi
cmp dword [ebp - 0x368], 0xf
lea esi, [ebp - 0x37c]
mov dword [ebp - 0x360], eax
cmova esi, dword [ebp - 0x37c]
mov dword [eax], 0
lea eax, [ebp - 0x35c]
push 0xa
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
cmp esi, dword [ebp - 0x35c]
jne 0x10002060
push str.invalid_stol_argument
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const__]
mov eax, dword [ebp - 0x360]
cmp dword [eax], 0x22
jne 0x10002076
push str.stol_argument_out_of_range
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x368]
cmp ecx, 0xf
jbe 0x100020c9
mov edx, dword [ebp - 0x37c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100020ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100020ac
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10003543
add esp, 8
jmp 0x100020c9
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, 0x1fbd0
call fcn.10001350
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x394]
push 0x11
xorps xmm0, xmm0
mov dword [ebp - 0x384], 0
push str.17513546346456646
movups xmmword [ebp - 0x394], xmm0
mov dword [ebp - 0x380], 0
call fcn.100032f0
mov byte [ebp - 4], 4
call edi
cmp dword [ebp - 0x380], 0xf
lea esi, [ebp - 0x394]
mov edi, eax
lea eax, [ebp - 0x360]
cmova esi, dword [ebp - 0x394]
push 0xa
push eax
push esi
mov dword [edi], 0
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
cmp esi, dword [ebp - 0x360]
jne 0x10002152
push str.invalid_stol_argument
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const__]
cmp dword [edi], 0x22
jne 0x10002162
push str.stol_argument_out_of_range
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
mov ecx, dword [ebp - 0x380]
cmp ecx, 0xf
jbe 0x100021b1
mov edx, dword [ebp - 0x394]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002194
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10002194
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10003543
add esp, 8
jmp 0x100021b1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10003535
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret