Function at 0x401e4a
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, section..rdata
call sub.msvcrt.dll_system
mov r8d, 5
lea rdx, str._nVPN_n
mov rcx, qword [0x004a90c0]
call fcn.00496a60
lea rcx, str.tasklist__find__i__Windscribe.exe____nul
call sub.msvcrt.dll_system
test eax, eax
je 0x40205b
mov r8d, 0x1d
lea rdx, str.e_31mWindscribe_not_founde_0m
mov rcx, qword [0x004a90c0]
call fcn.00496a60
mov rax, qword [0x004a90c0]
mov rdx, qword [rax]
add rax, qword [rdx - 0x18]
mov rbx, qword [rax + 0xf0]
test rbx, rbx
je 0x40203b
cmp byte [rbx + 0x38], 0
je 0x402040
movzx eax, byte [rbx + 0x43]
movsx edx, al
mov rcx, qword [0x004a90c0]
call fcn.004618f0
mov rcx, rax
call fcn.00461ae0
lea rcx, str.tasklist__find__i__ProtonVPNService.exe____nul
call sub.msvcrt.dll_system
test eax, eax
je 0x4020f1
mov r8d, 0x1c
lea rdx, str.e_31mProtonVPN_not_founde_0m
mov rcx, qword [0x004a90c0]
call fcn.00496a60
mov rax, qword [0x004a90c0]
mov rdx, qword [rax]
add rax, qword [rdx - 0x18]
mov rbx, qword [rax + 0xf0]
test rbx, rbx
je 0x4020d1
cmp byte [rbx + 0x38], 0
je 0x4020d6
movzx eax, byte [rbx + 0x43]
movsx edx, al
mov rcx, qword [0x004a90c0]
call fcn.004618f0
mov rcx, rax
call fcn.00461ae0
lea rcx, str.tasklist__find__i__IPVanish.exe____nul
call sub.msvcrt.dll_system
test eax, eax
je 0x402187
mov r8d, 0x1b
lea rdx, str.e_31mIPVanish_not_founde_0m
mov rcx, qword [0x004a90c0]
call fcn.00496a60
mov rax, qword [0x004a90c0]
mov rdx, qword [rax]
add rax, qword [rdx - 0x18]
mov rbx, qword [rax + 0xf0]
test rbx, rbx
je 0x402167
cmp byte [rbx + 0x38], 0
je 0x40216c
movzx eax, byte [rbx + 0x43]
movsx edx, al
mov rcx, qword [0x004a90c0]
call fcn.004618f0
mov rcx, rax
call fcn.00461ae0
lea rcx, str.tasklist__find__i__nordvpn_service.exe____nul
call sub.msvcrt.dll_system
test eax, eax
je 0x40221d
mov r8d, 0x1a
lea rdx, str.e_31mNordVPN_not_founde_0m
mov rcx, qword [0x004a90c0]
call fcn.00496a60
mov rax, qword [0x004a90c0]
mov rdx, qword [rax]
add rax, qword [rdx - 0x18]
mov rbx, qword [rax + 0xf0]
test rbx, rbx
je 0x4021fd
cmp byte [rbx + 0x38], 0
je 0x402202
movzx eax, byte [rbx + 0x43]
movsx edx, al
mov rcx, qword [0x004a90c0]
call fcn.004618f0
mov rcx, rax
call fcn.00461ae0
nop
add rsp, 0x20
pop rbx
ret
call fcn.00497210
mov rcx, rbx
call fcn.00422a90
mov rax, qword [rbx]
mov edx, 0xa
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x401ecd
mov r8d, 0x19
lea rdx, str.e_32mWindscribe_founde_0m
mov rcx, qword [0x004a90c0]
call fcn.00496a60
mov rax, qword [0x004a90c0]
mov rdx, qword [rax]
add rax, qword [rdx - 0x18]
mov rbx, qword [rax + 0xf0]
test rbx, rbx
je 0x4020b4
cmp byte [rbx + 0x38], 0
je 0x4020b9
movzx eax, byte [rbx + 0x43]
movsx edx, al
mov rcx, qword [0x004a90c0]
call fcn.004618f0
mov rcx, rax
call fcn.00461ae0
jmp 0x401ee4
call fcn.00497210
mov rcx, rbx
call fcn.00422a90
mov rax, qword [rbx]
mov edx, 0xa
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x402098
call fcn.00497210
mov rcx, rbx
call fcn.00422a90
mov rax, qword [rbx]
mov edx, 0xa
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x401f3d
mov r8d, 0x18
lea rdx, str.e_32mProtonVPN_founde_0m
mov rcx, qword [0x004a90c0]
call fcn.00496a60
mov rax, qword [0x004a90c0]
mov rdx, qword [rax]
add rax, qword [rdx - 0x18]
mov rbx, qword [rax + 0xf0]
test rbx, rbx
je 0x40214a
cmp byte [rbx + 0x38], 0
je 0x40214f
movzx eax, byte [rbx + 0x43]
movsx edx, al
mov rcx, qword [0x004a90c0]
call fcn.004618f0
mov rcx, rax
call fcn.00461ae0
jmp 0x401f54
call fcn.00497210
mov rcx, rbx
call fcn.00422a90
mov rax, qword [rbx]
mov edx, 0xa
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x40212e
call fcn.00497210
mov rcx, rbx
call fcn.00422a90
mov rax, qword [rbx]
mov edx, 0xa
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x401fad
mov r8d, 0x17
lea rdx, str.e_32mIPVanish_founde_0m
mov rcx, qword [0x004a90c0]
call fcn.00496a60
mov rax, qword [0x004a90c0]
mov rdx, qword [rax]
add rax, qword [rdx - 0x18]
mov rbx, qword [rax + 0xf0]
test rbx, rbx
je 0x4021e0
cmp byte [rbx + 0x38], 0
je 0x4021e5
movzx eax, byte [rbx + 0x43]
movsx edx, al
mov rcx, qword [0x004a90c0]
call fcn.004618f0
mov rcx, rax
call fcn.00461ae0
jmp 0x401fc4
call fcn.00497210
mov rcx, rbx
call fcn.00422a90
mov rax, qword [rbx]
mov edx, 0xa
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x4021c4
call fcn.00497210
mov rcx, rbx
call fcn.00422a90
mov rax, qword [rbx]
mov edx, 0xa
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x40201d
mov r8d, 0x16
lea rdx, str.e_32mNordVPN_founde_0m
mov rcx, qword [0x004a90c0]
call fcn.00496a60
mov rax, qword [0x004a90c0]
mov rdx, qword [rax]
add rax, qword [rdx - 0x18]
mov rbx, qword [rax + 0xf0]
test rbx, rbx
je 0x402276
cmp byte [rbx + 0x38], 0
je 0x40227b
movzx eax, byte [rbx + 0x43]
movsx edx, al
mov rcx, qword [0x004a90c0]
call fcn.004618f0
mov rcx, rax
call fcn.00461ae0
jmp 0x402035
call fcn.00497210
mov rcx, rbx
call fcn.00422a90
mov rax, qword [rbx]
mov edx, 0xa
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x40225a