Function at 0x1025d449
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x28]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov esi, esp
push str.NtSuspendProcess
mov edi, esp
push 0x103c6f20
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x14], eax
mov esi, esp
push str.NtResumeProcess
mov edi, esp
push 0x103c6f20
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x20], eax
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
sub ecx, 0x57
mov dword [ebp - 0xe8], ecx
cmp dword [ebp - 0xe8], 0x68
ja case.0x1025d3c6.1
mov edx, dword [ebp - 0xe8]
movzx eax, byte [edx + 0x1025d508]
jmp dword [eax*4 + 0x1025d4e0]
mov eax, dword [ebp + 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
call fcn.101375af
jmp case.0x1025d3c6.1
mov ecx, dword [ebp - 8]
call fcn.1013717c
jmp case.0x1025d3c6.1
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 1]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
call dword [ebp - 0x14]
cmp esi, esp
call fcn.1013ca23
jmp case.0x1025d3c6.1
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 1]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push eax
call dword [ebp - 0x20]
cmp esi, esp
call fcn.1013ca23
jmp case.0x1025d3c6.1
mov esi, esp
push 0
mov edi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 1]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.1013ca23
jmp case.0x1025d3c6.1
push str.http:__xui.ptlogin2.qq.com_cgi_bin_xlogin_proxy_urlhttp_3A__qzs.qq.com_qzone_v6_portal_proxy.htmldaid5hide_title_bar1low_login0qlogin_auto_login1no_verifyimg1link_targetblankappid549000912style22targetselfs_urlhttp_3A_2F_2Fqzs.qq.com_2Fqzone_2Fv5_2Floginsucc.html_3Fpara_3Dizonept_qr_app
push 0xb8
mov ecx, dword [ebp - 8]
call fcn.1013bf88
jmp case.0x1025d3c6.1
push str.http:__xui.ptlogin2.qq.com_cgi_bin_xlogin_appid522005705daid4s_urlhttps:__mail.qq.com_cgi_bin_login_vtpassport_26vmwpt_26ftloginpage_26targetstyle25low_login1proxy_urlhttps:__mail.qq.com_proxy.htmlneed_qr0hide_border1border_radius0self_regurlhttp:__zc.qq.com_chs_index.html_type1app_id11005_tregistpt_feedback_linkhttp:__support.qq.com_discuss_350_1.shtml
push 0xba
mov ecx, dword [ebp - 8]
call fcn.1013d22f
jmp case.0x1025d3c6.1
push str.http:__ui.ptlogin2.qq.com_cgi_bin_login_appid549000912daid5style12s_urlhttp:__qun.qzone.qq.com_group
push 0xbc
mov ecx, dword [ebp - 8]
call fcn.1013d22f
jmp case.0x1025d3c6.1
push str.http:__xui.ptlogin2.qq.com_cgi_bin_xlogin_proxy_urlhttp_3A__qzs.qq.com_qzone_v6_portal_proxy.htmldaid5hide_title_bar1low_login0qlogin_auto_login1no_verifyimg1link_targetblankappid549000912style22targetselfs_urlhttp_3A_2F_2Fqzs.qq.com_2Fqzone_2Fv5_2Floginsucc.html_3Fpara_3Dizonept_qr_app
push 0xbe
mov ecx, dword [ebp - 8]
call fcn.1013d22f
pop edi
pop esi
pop ebx
add esp, 0xe8
cmp ebp, esp
call fcn.1013ca23
mov esp, ebp
pop ebp
ret 8