PROCESS_TERMINATE     = $0001
  TH32CS_SNAPPROCESS    = $00000002

struct PROCESSENTRY32
    dwSize               dd 0
    cntUsage             dd 0
    th32ProcessID        dd 0
    th32DefaultHeapID    dd 0
    th32ModuleID         dd 0
    cntThreads           dd 0
    th32ParentProcessID  dd 0
    pcPriClassBase       dd 0
    dwFlags              dd 0
    szExeFile            rb MAX_PATH
ends   

proc kill_process ExeFileName

     invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS, 0
     mov    [SnapshotHandle], eax
     mov    eax, sizeof.PROCESSENTRY32
     mov    [ProcessEntry32.dwSize], eax
     invoke Process32First,[SnapshotHandle],ProcessEntry32
     mov    [ContinueLoop], eax
   loop_while:
     stdcall ExtractFileName,string_buffer, ProcessEntry32.szExeFile
     invoke  lstrcmp,[ExeFileName],ProcessEntry32.szExeFile
     cmp     eax, 0
     jne     next_process
     invoke  OpenProcess,PROCESS_TERMINATE,0,[ProcessEntry32.th32ProcessID]
     invoke  TerminateProcess,eax,0
    next_process:
     invoke  Process32Next,[SnapshotHandle], ProcessEntry32
     mov     [ContinueLoop], eax
     cmp     [ContinueLoop], FALSE
     jne     loop_while
     invoke CloseHandle,[SnapshotHandle]
     ret
endp         

format PE GUI
include 'win32ax.inc'

main:   stdcall killprocess, "idler.exe"
        test    eax, eax
        jz      .err
        invoke  MessageBox,0,"killed","killed",0
        jmp     .done
.err:   invoke  MessageBox,0,"failure½!!","failure½!!",0
.done:  invoke  ExitProcess, 0

proc killprocess uses ebx edi esi, filename
        local   ssh     rd 1
        local   pe32    PROCESSENTRY32
                invoke  CreateToolhelp32Snapshot, TH32CS_SNAPPROCESS, 0
                cmp     eax, -1
                jnz     .l1
                xor     eax, eax
                jmp     .done
        .l1:    mov     [ssh], eax
                mov     eax, sizeof.PROCESSENTRY32
                mov     [pe32.dwSize], eax
                invoke  Process32First, [ssh], addr pe32
                test    eax, eax
                jz      .done
        .found?:invoke  lstrcmp, [filename], addr pe32.szExeFile
                test    eax, eax
                jz      .found
                invoke  Process32Next, [ssh], addr pe32
                test    eax, eax
                jz      .done
                jne     .found?
        .found: invoke  OpenProcess, PROCESS_TERMINATE, 0, [pe32.th32ProcessID]
                test    eax, eax
                jz      .done
                invoke  TerminateProcess, eax, 0
                test    eax, eax
                jz      .done
                invoke  CloseHandle, [ssh]
                mov     eax, 1 ;success
        .done:  ret
endp

.end main    

include 'win32ax.inc'
main:   invoke  Sleep, (1000*(5*60))
        invoke  MessageBox,0,"Idled 5mins.","Idler",0
        invoke  ExitProcess, 0
.end main    

PROCESS_CREATE_PROCESS                  = 0x0080        ; Required to create a process.
PROCESS_CREATE_THREAD                   = 0x0002        ; Required to create a thread.
PROCESS_DUP_HANDLE                      = 0x0040        ; Required to duplicate a handle using DuplicateHandle.
PROCESS_QUERY_INFORMATION               = 0x0400        ; Required to retrieve certain information about a process, such as its token, exit code,
                                                        ;       and priority class (see OpenProcessToken, GetExitCodeProcess, GetPriorityClass, and IsProcessInJob).
PROCESS_QUERY_LIMITED_INFORMATION       = 0x1000        ; Required to retrieve certain information about a process (see QueryFullProcessImageName).
                                                        ;       A handle that has the PROCESS_QUERY_INFORMATION access right is automatically granted PROCESS_QUERY_LIMITED_INFORMATION.
                                                        ;       Windows Server 2003 and Windows XP/2000:  This access right is not supported.
PROCESS_SET_INFORMATION                 = 0x0200        ; Required to set certain information about a process, such as its priority class (see SetPriorityClass).
PROCESS_SET_QUOTA                       = 0x0100        ; Required to set memory limits using SetProcessWorkingSetSize.
PROCESS_SUSPEND_RESUME                  = 0x0800        ; Required to suspend or resume a process.
PROCESS_TERMINATE                       = 0x0001        ; Required to terminate a process using TerminateProcess.
PROCESS_VM_OPERATION                    = 0x0008        ; Required to perform an operation on the address space of a process (see VirtualProtectEx and WriteProcessMemory).
PROCESS_VM_READ                         = 0x0010        ; Required to read memory in a process using ReadProcessMemory.
PROCESS_VM_WRITE                        = 0x0020        ; Required to write to memory in a process using WriteProcessMemory.


TH32CS_INHERIT          = 0x80000000    ; Indicates that the snapshot handle is to be inheritable.
TH32CS_SNAPHEAPLIST     = 0x00000001    ; Includes all heaps of the process specified in th32ProcessID in the snapshot. To enumerate the heaps, see Heap32ListFirst.
TH32CS_SNAPMODULE       = 0x00000008    ; Includes all modules of the process specified in th32ProcessID in the snapshot. To enumerate the modules, see Module32First.
                                        ;       64-bit Windows:  Using this flag in a 32-bit process includes the 32-bit modules of the process specified in th32ProcessID,
                                        ;       while using it in a 64-bit process includes the 64-bit modules.
                                        ;       To include the 32-bit modules of the process specified in th32ProcessID from a 64-bit process, use the TH32CS_SNAPMODULE32 flag.
TH32CS_SNAPMODULE32     = 0x00000010    ; Includes all 32-bit modules of the process specified in th32ProcessID in the snapshot when called from a 64-bit process.
                                        ;       This flag can be combined with TH32CS_SNAPMODULE or TH32CS_SNAPALL.
TH32CS_SNAPPROCESS      = 0x00000002    ; Includes all processes in the system in the snapshot. To enumerate the processes, see Process32First.
TH32CS_SNAPTHREAD       = 0x00000004    ; Includes all threads in the system in the snapshot. To enumerate the threads, see Thread32First.
                                        ;       To identify the threads that belong to a specific process,
                                        ;       compare its process identifier to the th32OwnerProcessID member of the THREADENTRY32 structure when enumerating the threads.
TH32CS_SNAPALL          = TH32CS_SNAPHEAPLIST or TH32CS_SNAPMODULE or TH32CS_SNAPPROCESS or TH32CS_SNAPTHREAD

struc PROCESSENTRY32 {
        .dwSize                 rd 1    ; The size of the structure, in bytes.
                                        ;       Before calling the Process32First function, set this member to sizeof(PROCESSENTRY32).
                                        ;       If you do not initialize dwSize, Process32First fails.
        .cntUsage               rd 1    ; This member is no longer used and is always set to zero.
        .th32ProcessID          rd 1    ; The process identifier.
        .th32DefaultHeapID      rd 1    ; This member is no longer used and is always set to zero.
        .th32ModuleID           rd 1    ; This member is no longer used and is always set to zero.
        .cntThreads             rd 1    ; The number of execution threads started by the process.
        .th32ParentProcessID    rd 1    ; The identifier of the process that created this process (its parent process).
        .pcPriClassBase         rd 1    ; The base priority of any threads created by this process.
        .dwFlags                rd 1    ; This member is no longer used and is always set to zero.
        .szExeFile              rb MAX_PATH     ; The name of the executable file for the process.
                                                ;       To retrieve the full path to the executable file, call the Module32First function
                                                ;       and check the szExePath member of the MODULEENTRY32 structure that is returned.
                                                ;       However, if the calling process is a 32-bit process,
                                                ;       you must call the QueryFullProcessImageName function to retrieve the full path of the executable file for a 64-bit process.
}
virtual at 0
        PROCESSENTRY32 PROCESSENTRY32
        sizeof.PROCESSENTRY32 =  $
end virtual