Function at 0x1600c3dbc
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov qword [rax - 0x118], 0xfffffffffffffffe
xor r15d, r15d
mov r12d, r15d
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x78], r15d
mov dword [rax + 8], 8
lea rsi, str._KillSearchService
mov r13d, 0xf0000
mov edx, dword [rsp + 0x1a0]
add edx, edx
lea rcx, [rsp + 0x60]
call fcn.1600c2958
nop
jmp 0x1600c3e38
lea r8, [rsp + 0x1a0]
mov edx, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32EnumProcesses]
test eax, eax
jne 0x1600c3eba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r12d, eax
test eax, eax
je 0x1600c3ebf
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rdi, qword [rsp + 0x198]
mov r8d, r12d
lea rdx, str.MSS:__KillSearchService_failed_to_enumerate_running_processes___error_0x_X.
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], 0x1a7
xor r9d, r9d
mov edx, r13d
call fcn.1600ecb60
mov rbx, qword [rsp + 0x70]
test r12d, r12d
jne 0x1600c3ed4
mov r14d, dword [rsp + 0x1a0]
cmp r14d, dword [rsp + 0x68]
je 0x1600c3e0a
jmp 0x1600c3edc
mov r14d, dword [rsp + 0x1a0]
shr r14d, 2
mov eax, r15d
mov dword [rsp + 0x1b0], eax
test r12d, r12d
jne 0x1600c4234
cmp eax, r14d
jae 0x1600c4234
mov eax, dword [rbx + rax*4]
mov dword [rsp + 0x1b8], eax
cmp eax, 0xa
jb 0x1600c3feb
mov r8d, eax
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x88], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1600c3f3d
mov dword [rsp + 0x1a8], r15d
jmp 0x1600c3fb9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r12d, eax
cmp eax, 5
jne 0x1600c3f53
mov r12d, r15d
jmp 0x1600c3fd3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rsi, qword [rsp + 0x198]
mov r8d, r12d
lea rdx, str.MSS:__KillSearchService_failed_to_open_first_handle_for_terminated_process___error_0x_X.
mov ecx, 0x4000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea rax, str._KillSearchService
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x1c5
xor r9d, r9d
mov edx, r13d
call fcn.1600ecb60
mov dword [rsp + 0x1a8], r15d
test r12d, r12d
jne 0x1600c3fd3
lea rdx, [rsp + 0x1a8]
mov rcx, rbx
call fcn.1600c3094
cmp dword [rsp + 0x1a8], r15d
jne 0x1600c3ff9
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1600c3fe6
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x1b0]
inc eax
jmp 0x1600c3ee3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rsi, qword [rsp + 0x198]
mov r8d, dword [rsp + 0x1b8]
lea rdx, str.MSS:__KillSearchService_is_going_to_terminate_Windows_Search_process_pid0x_x.
mov ecx, 0x4000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea r12, str._KillSearchService
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x20], 0x1d0
xor r9d, r9d
mov edx, r13d
call fcn.1600ecb60
mov r8d, dword [rsp + 0x1b8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rdi, rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x1600c40d6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov r14, qword [rsp + 0x198]
mov r8d, r12d
lea rdx, str.MSS:__KillSearchService_failed_to_open_second_handle_for_terminated_process___error_0x_X.
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r14
lea rax, str._KillSearchService
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x1d9
jmp 0x1600c4201
mov edx, 0x41d
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test eax, eax
jne 0x1600c4150
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x1a8], eax
test eax, eax
je 0x1600c4150
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov r14, qword [rsp + 0x198]
mov r8d, dword [rsp + 0x1a8]
lea rdx, str.MSS:__KillSearchService_failed_with_TerminateProcess__the_error_is_0x_X.
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x20], 0x1e3
xor r9d, r9d
mov edx, r13d
call fcn.1600ecb60
mov edx, 0x7530
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov r12d, eax
test eax, eax
jne 0x1600c416d
mov r12d, r15d
jmp 0x1600c420c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov r14, qword [rsp + 0x198]
cmp r12d, 0x102
jne 0x1600c41c3
lea rdx, str.MSS:__KillSearchService:_Windows_Search_process_handle_is_still_non_signalled_after_30_sec
mov ecx, 0x4000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r14
lea rax, str._KillSearchService
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x1ed
jmp 0x1600c4201
mov r8d, r12d
lea rdx, str.MSS:__KillSearchService_failed_waiting_on_terminated_process_handle_with_error_0x_X.
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r14
lea rax, str._KillSearchService
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x1f3
xor r9d, r9d
mov edx, r13d
call fcn.1600ecb60
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1600c4220
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1600c4234
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rcx, [rsp + 0x60]
call fcn.1600671c4
mov eax, r12d
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret