Function at 0x14000a710
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xfe0]
mov eax, 0x10e0
call fcn.14000c190
sub rsp, rax
mov rax, qword [0x1400285f8]
xor rax, rsp
mov qword [rbp + 0xfd0], rax
mov r12, rcx
xor r14d, r14d
mov dword [rsp + 0x50], r14d
cmp qword [rcx + 0x10], r14
jne 0x14000a82d
lea edx, [r14 + 0xa]
lea rcx, str.empty_path
call qword [0x140010590]
mov qword [rsp + 0x50], rax
lea edx, [r14 + 0x2a]
lea rcx, str.KillProcessLauncherFromNamedFolderExceptMe
call qword [0x140010590]
mov qword [rsp + 0x40], rax
lea edx, [r14 + 0x31]
lea rcx, str.D:WorkspaceQTFolderMoverFolderMoverutils.cpp
call qword [0x140010590]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call qword [0x140010528]
nop
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [0x140010500]
mov rbx, rax
call fcn.140004150
mov rcx, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8, rbx
lea edx, [r14 + 2]
call fcn.140004280
nop
lea rcx, [rsp + 0x58]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x48]
call qword [0x140010518]
nop
lea rcx, [rsp + 0x38]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x40]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x50]
call qword [0x1400105e0]
xor al, al
jmp 0x14000addd
mov edx, 0x2a
lea rcx, str.KillProcessLauncherFromNamedFolderExceptMe
call qword [0x140010590]
mov qword [rsp + 0x48], rax
mov edx, 0x31
lea rcx, str.D:WorkspaceQTFolderMoverFolderMoverutils.cpp
call qword [0x140010590]
mov qword [rsp + 0x38], rax
mov rdx, r12
lea rcx, [rsp + 0x70]
call qword [0x1400101a8]
mov rbx, rax
mov r15d, 0xffffffff
mov r8d, r15d
lea rdx, str.kill_process_launcher_in_folder
lea rcx, [rsp + 0x40]
call qword [0x1400105b0]
mov dword [rsp + 0x50], 1
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [0x1400105c8]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x68]
call qword [0x140010528]
nop
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [0x140010500]
mov rbx, rax
call fcn.140004150
mov rcx, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8, rbx
lea edx, [r15 + 5]
call fcn.140004280
nop
lea rcx, [rsp + 0x58]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x68]
call qword [0x140010518]
mov dword [rsp + 0x30], r14d
lea rcx, [rsp + 0x40]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x70]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x38]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x48]
call qword [0x1400105e0]
lea r8, [rsp + 0x60]
mov edx, 0x1000
lea rcx, [rbp - 0x30]
call sub.kernel32.dll_K32EnumProcesses
test eax, eax
je 0x14000addb
mov eax, dword [rsp + 0x60]
shr eax, 2
mov dword [rsp + 0x40], eax
mov r13d, r14d
test eax, eax
je 0x14000addb
nop
mov eax, r13d
lea rcx, [rbp - 0x30]
lea rax, [rcx + rax*4]
mov qword [rsp + 0x70], rax
mov edx, dword [rax]
lea rcx, [rbp - 0x78]
call fcn.14000a100
nop
mov rsi, qword [r12 + 0x10]
mov rax, r12
mov rdi, qword [r12 + 0x18]
cmp rdi, 8
jb 0x14000a993
mov rax, qword [r12]
mov r11, rsi
cmp qword [rbp - 0x68], rsi
cmovb r11, qword [rbp - 0x68]
lea r9, [rbp - 0x78]
mov r10, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x60]
cmp rbx, 8
cmovae r9, r10
mov rcx, r11
cmp rsi, r11
cmovb rcx, rsi
test rcx, rcx
je 0x14000a9d9
sub r9, rax
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x14000a9e3
add rax, 2
sub rcx, 1
jne 0x14000a9c5
cmp r11, rsi
jae 0x14000a9ee
mov eax, r15d
jmp 0x14000a9f4
mov eax, 1
cmovb eax, r15d
jmp 0x14000a9f4
mov eax, r14d
seta al
test eax, eax
jne 0x14000ad40
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, 0x10
jb 0x14000ae0d
mov r15, r12
cmp rdi, 8
jb 0x14000aa23
mov r15, qword [r12]
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
lea r14, [rsi + 0x10]
mov ebx, 7
lea rdi, [rbp - 0x58]
cmp r14, rbx
jbe 0x14000aace
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x14000aa5d
mov rbx, rcx
mov rcx, 0xfffffffffffffffe
jmp 0x14000aa8d
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000ae13
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000aab9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000ae13
mov rcx, rax
call fcn.14000bd48
test rax, rax
je 0x14000ad8d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000aaca
test rcx, rcx
je 0x14000aac8
call fcn.14000bd48
mov rdi, rax
jmp 0x14000aaca
xor edi, edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14000ce2a
movups xmm0, xmmword [str.FolderMover.exe]
movups xmmword [rdi + rbx], xmm0
movups xmm1, xmmword [0x1400127d0]
movups xmmword [rdi + rbx + 0x10], xmm1
xor edx, edx
mov word [rdi + r14*2], dx
mov eax, dword [rsp + 0x30]
or eax, 2
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x50], eax
lea rcx, [rbp - 0x58]
mov r11, qword [rbp - 0x58]
mov r15, qword [rbp - 0x40]
cmp r15, 8
cmovae rcx, r11
mov rsi, qword [rbp - 0x48]
mov r14, rsi
cmp qword [rbp - 0x68], rsi
cmovb r14, qword [rbp - 0x68]
lea r9, [rbp - 0x78]
mov r10, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x60]
cmp rdi, 8
cmovae r9, r10
mov r8, r14
cmp rsi, r14
cmovb r8, rsi
test r8, r8
je 0x14000ab76
sub r9, rcx
nop
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x14000ab84
add rcx, 2
sub r8, 1
jne 0x14000ab60
xor edx, edx
cmp r14, rsi
mov esi, 0xffffffff
jae 0x14000ab93
mov ebx, esi
jmp 0x14000ab98
mov ebx, 1
mov esi, 0xffffffff
cmovb ebx, esi
jmp 0x14000ab98
mov ebx, edx
seta bl
cmp r15, 8
jb 0x14000abdb
lea rdx, [r15*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x14000abcb
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ad8d
mov rcx, r11
call fcn.14000bd84
mov rdi, qword [rbp - 0x60]
mov r10, qword [rbp - 0x78]
test ebx, ebx
jne 0x14000abf6
cmp rdi, 8
jb 0x14000ad77
lea rdx, [rdi*2 + 2]
jmp 0x14000ad4e
mov rax, qword [rsp + 0x70]
mov r8d, dword [rax]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000ad94
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
test ebx, ebx
je 0x14000ad94
mov edx, 0x2a
lea rcx, str.KillProcessLauncherFromNamedFolderExceptMe
call qword [0x140010590]
mov qword [rsp + 0x58], rax
mov edx, 0x31
lea rcx, str.D:WorkspaceQTFolderMoverFolderMoverutils.cpp
call qword [0x140010590]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x80]
call qword [0x1400101a8]
mov rbx, rax
mov r8d, esi
lea rdx, str.Killing_process_with_cmdline_:
lea rcx, [rsp + 0x38]
call qword [0x1400105b0]
mov r14d, dword [rsp + 0x30]
or r14d, 4
mov dword [rsp + 0x50], r14d
mov rdx, rbx
lea rcx, [rsp + 0x38]
call qword [0x1400105c8]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x78]
call qword [0x140010528]
nop
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [0x140010500]
mov rbx, rax
call fcn.140004150
mov rcx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8, rbx
mov edx, 4
call fcn.140004280
nop
lea rcx, [rsp + 0x68]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x78]
call qword [0x140010518]
and r14d, 0xfffffffb
mov dword [rsp + 0x30], r14d
lea rcx, [rsp + 0x38]
call qword [0x1400105e0]
nop
lea rcx, [rbp - 0x80]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x48]
call qword [0x1400105e0]
nop
lea rcx, [rsp + 0x58]
call qword [0x1400105e0]
mov rbx, qword [rbp - 0x60]
mov r10, qword [rbp - 0x78]
cmp rbx, 8
jb 0x14000ad77
lea rdx, [rbx*2 + 2]
cmp rdx, 0x1000
mov rax, r10
jb 0x14000ad6f
mov r10, qword [r10 - 8]
sub rax, r10
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000add4
mov rcx, r10
call fcn.14000bd84
inc r13d
cmp r13d, dword [rsp + 0x40]
jae 0x14000addb
xor r14d, r14d
lea r15d, [r14 - 1]
jmp 0x14000a960
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000add0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000adcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000add4
call fcn.14000bd84
xor al, al
jmp 0x14000addd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov al, 1
mov rcx, qword [rbp + 0xfd0]
xor rcx, rsp
call fcn.14000c0e0
lea r11, [rsp + 0x10e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140004cd0
nop
call fcn.140003f10
int3