http://bbs.360safe.com/thread-111959-1-1.html
iocode 0x222020
.text:000110C6 ; int __stdcall sub_110C6(int processid)
.text:000110C6 sub_110C6 proc near ; CODE XREF: sub_1093C+46p
.text:000110C6
.text:000110C6 MajorVersion = dword ptr -14h
.text:000110C6 MinorVersion = dword ptr -10h
.text:000110C6 BuildNumber = dword ptr -0Ch
.text:000110C6 Handle = dword ptr -8
.text:000110C6 Object = dword ptr -4
.text:000110C6 processid = dword ptr 8
.text:000110C6
.text:000110C6 mov edi, edi
.text:000110C8 push ebp
.text:000110C9 mov ebp, esp
.text:000110CB sub esp, 14h
.text:000110CE push esi
.text:000110CF xor esi, esi
.text:000110D1 push esi ; CSDVersion
.text:000110D2 lea eax, [ebp+BuildNumber]
.text:000110D5 push eax ; BuildNumber
.text:000110D6 lea eax, [ebp+MinorVersion]
.text:000110D9 push eax ; MinorVersion
.text:000110DA lea eax, [ebp+MajorVersion]
.text:000110DD push eax ; MajorVersion
.text:000110DE call PsGetVersion
.text:000110E3 lea eax, [ebp+Object]
.text:000110E6 push eax
.text:000110E7 push [ebp+processid]
.text:000110EA call ds:PsLookupProcessByProcessId
.text:000110F0 cmp eax, esi
.text:000110F2 jl short loc_11136
.text:000110F4 push edi
.text:000110F5 lea eax, [ebp+Handle]
.text:000110F8 push eax
.text:000110F9 mov eax, ds:PsProcessType
.text:000110FE push esi
.text:000110FF push dword ptr [eax]
.text:00011101 push 1F03FFh
.text:00011106 push esi
.text:00011107 push esi
.text:00011108 push [ebp+Object]
.text:0001110B call ds:ObOpenObjectByPointer
.text:00011111 mov edi, eax
.text:00011113 cmp edi, esi
.text:00011115 jl short loc_11133
.text:00011117 push esi ; ExitStatus
.text:00011118 push [ebp+Handle] ; ProcessHandle
.text:0001111B call ds:ZwTerminateProcess
.text:00011121 mov ecx, [ebp+Object] ; Object
.text:00011124 call ds:ObfDereferenceObject
.text:0001112A push [ebp+Handle] ; Handle
.text:0001112D call ds:ZwClose
.text:00011133
.text:00011133 loc_11133: ; CODE XREF: sub_110C6+4Fj
.text:00011133 mov eax, edi
.text:00011135 pop edi
.text:00011136
.text:00011136 loc_11136: ; CODE XREF: sub_110C6+2Cj
.text:00011136 pop esi
.text:00011137 leave
.text:00011138 retn 4
.text:00011138 sub_110C6 endp