Function at 0x140025530
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0xed8
mov rax, qword [0x14009b180]
xor rax, rsp
mov qword [rsp + 0xec8], rax
mov edx, Ordinal_26
lea rcx, [rsp + 0xeb0]
call fcn.140024ab0
lea rcx, [rsp + 0x30]
call fcn.1400016e0
mov qword [rsp + 0x50], rax
lea rdx, str.ollydbg.exe
lea rcx, [rsp + 0xa0]
call fcn.1400062f0
nop
lea rdx, str.x32dbg.exe
lea rcx, [rsp + 0xc0]
call fcn.1400062f0
nop
lea rdx, str.x64dbg.exe
lea rcx, [rsp + 0xe0]
call fcn.1400062f0
nop
lea rdx, str.windbg.exe
lea rcx, [rsp + 0x100]
call fcn.1400062f0
nop
lea rdx, str.ImmunityDebugger.exe
lea rcx, [rsp + 0x120]
call fcn.1400062f0
nop
lea rdx, str.idag.exe
lea rcx, [rsp + 0x140]
call fcn.1400062f0
nop
lea rdx, str.ida.exe
lea rcx, [rsp + 0x160]
call fcn.1400062f0
nop
lea rdx, str.idaq.exe
lea rcx, [rsp + 0x180]
call fcn.1400062f0
nop
lea rdx, str.ida64.exe
lea rcx, [rsp + 0x1a0]
call fcn.1400062f0
nop
lea rdx, str.Dbgview.exe
lea rcx, [rsp + 0x1c0]
call fcn.1400062f0
nop
lea rdx, str.GhidraRun.exe
lea rcx, [rsp + 0x1e0]
call fcn.1400062f0
nop
lea rdx, str.ghidra.exe
lea rcx, [rsp + 0x200]
call fcn.1400062f0
nop
lea rdx, str.Wireshark.exe
lea rcx, [rsp + 0x220]
call fcn.1400062f0
nop
lea rdx, str.dumpcap.exe
lea rcx, [rsp + 0x240]
call fcn.1400062f0
nop
lea rdx, str.Fiddler.exe
lea rcx, [rsp + 0x260]
call fcn.1400062f0
nop
lea rdx, str.httpdebugger.exe
lea rcx, [rsp + 0x280]
call fcn.1400062f0
nop
lea rdx, str.HTTPDebuggerUI.exe
lea rcx, [rsp + 0x2a0]
call fcn.1400062f0
nop
lea rdx, str.HTTPDebuggerSvc.exe
lea rcx, [rsp + 0x2c0]
call fcn.1400062f0
nop
lea rdx, str.PacketMon.exe
lea rcx, [rsp + 0x2e0]
call fcn.1400062f0
nop
lea rdx, str.netmon.exe
lea rcx, [rsp + 0x300]
call fcn.1400062f0
nop
lea rdx, str.smartsniff.exe
lea rcx, [rsp + 0x320]
call fcn.1400062f0
nop
lea rdx, str.NetworkMiner.exe
lea rcx, [rsp + 0x340]
call fcn.1400062f0
nop
lea rdx, str.ProcessHacker.exe
lea rcx, [rsp + 0x360]
call fcn.1400062f0
nop
lea rdx, str.SystemInformer.exe
lea rcx, [rsp + 0x380]
call fcn.1400062f0
nop
lea rdx, str.procmon.exe
lea rcx, [rsp + 0x3a0]
call fcn.1400062f0
nop
lea rdx, [0x14007e190]
lea rcx, [rsp + 0x3c0]
call fcn.1400062f0
nop
lea rdx, str.ProcessExplorer.exe
lea rcx, [rsp + 0x3e0]
call fcn.1400062f0
nop
lea rdx, str.procexp64.exe
lea rcx, [rsp + 0x400]
call fcn.1400062f0
nop
lea rdx, str.procexp32.exe
lea rcx, [rsp + 0x420]
call fcn.1400062f0
nop
lea rdx, str.TaskExplorer.exe
lea rcx, [rsp + 0x440]
call fcn.1400062f0
nop
lea rdx, str.SecurityTaskManager.exe
lea rcx, [rsp + 0x460]
call fcn.1400062f0
nop
lea rdx, str.ProcessLasso.exe
lea rcx, [rsp + 0x480]
call fcn.1400062f0
nop
lea rdx, str.Perfmon.exe
lea rcx, [rsp + 0x4a0]
call fcn.1400062f0
nop
lea rdx, str.procexp.exe
lea rcx, [rsp + 0x4c0]
call fcn.1400062f0
nop
lea rdx, str.autoruns.exe
lea rcx, [rsp + 0x4e0]
call fcn.1400062f0
nop
lea rdx, str.autorunsc.exe
lea rcx, [rsp + 0x500]
call fcn.1400062f0
nop
lea rdx, str.regmon.exe
lea rcx, [rsp + 0x520]
call fcn.1400062f0
nop
lea rdx, str.filemon.exe
lea rcx, [rsp + 0x540]
call fcn.1400062f0
nop
lea rdx, str.Tcpview.exe
lea rcx, [rsp + 0x560]
call fcn.1400062f0
nop
lea rdx, str.TaskManager.exe
lea rcx, [rsp + 0x580]
call fcn.1400062f0
nop
lea rdx, str.ResourceMonitor.exe
lea rcx, [rsp + 0x5a0]
call fcn.1400062f0
nop
lea rdx, str.pestudio.exe
lea rcx, [rsp + 0x5c0]
call fcn.1400062f0
nop
lea rdx, str.fileinsight.exe
lea rcx, [rsp + 0x5e0]
call fcn.1400062f0
nop
lea rdx, str.LordPE.exe
lea rcx, [rsp + 0x600]
call fcn.1400062f0
nop
lea rdx, str.PEBrowseDbg.exe
lea rcx, [rsp + 0x620]
call fcn.1400062f0
nop
lea rdx, str.PETools.exe
lea rcx, [rsp + 0x640]
call fcn.1400062f0
nop
lea rdx, str.ImpREC.exe
lea rcx, [rsp + 0x660]
call fcn.1400062f0
nop
lea rdx, str.ImportREC.exe
lea rcx, [rsp + 0x680]
call fcn.1400062f0
nop
lea rdx, str.ExplorerSuite.exe
lea rcx, [rsp + 0x6a0]
call fcn.1400062f0
nop
lea rdx, str.CFF_Explorer.exe
lea rcx, [rsp + 0x6c0]
call fcn.1400062f0
nop
lea rdx, str.Detect_It_Easy.exe
lea rcx, [rsp + 0x6e0]
call fcn.1400062f0
nop
lea rdx, str.die.exe
lea rcx, [rsp + 0x700]
call fcn.1400062f0
nop
lea rdx, str.PEiD.exe
lea rcx, [rsp + 0x720]
call fcn.1400062f0
nop
lea rdx, str.Hiew.exe
lea rcx, [rsp + 0x740]
call fcn.1400062f0
nop
lea rdx, str.WinHex.exe
lea rcx, [rsp + 0x760]
call fcn.1400062f0
nop
lea rdx, str.Hxd.exe
lea rcx, [rsp + 0x780]
call fcn.1400062f0
nop
lea rdx, str.cutter.exe
lea rcx, [rsp + 0x7a0]
call fcn.1400062f0
nop
lea rdx, str.cheatengine.exe
lea rcx, [rsp + 0x7c0]
call fcn.1400062f0
nop
lea rdx, str.cheatengine_x86_64.exe
lea rcx, [rsp + 0x7e0]
call fcn.1400062f0
nop
lea rdx, str.cheatengine_x86_64_SSE4_AVX2.exe
lea rcx, [rsp + 0x800]
call fcn.1400062f0
nop
lea rdx, str.MemHack.exe
lea rcx, [rsp + 0x820]
call fcn.1400062f0
nop
lea rdx, str.ArtMoney.exe
lea rcx, [rsp + 0x840]
call fcn.1400062f0
nop
lea rdx, str.scanmem.exe
lea rcx, [rsp + 0x860]
call fcn.1400062f0
nop
lea rdx, str.AnVir.exe
lea rcx, [rsp + 0x880]
call fcn.1400062f0
nop
lea rdx, str.SpyBot.exe
lea rcx, [rsp + 0x8a0]
call fcn.1400062f0
nop
lea rdx, str.Malwarebytes.exe
lea rcx, [rsp + 0x8c0]
call fcn.1400062f0
nop
lea rdx, str.RogueKiller.exe
lea rcx, [rsp + 0x8e0]
call fcn.1400062f0
nop
lea rdx, str.HitmanPro.exe
lea rcx, [rsp + 0x900]
call fcn.1400062f0
nop
lea rdx, str.ESETOnlineScanner.exe
lea rcx, [rsp + 0x920]
call fcn.1400062f0
nop
lea rdx, str.GMER.exe
lea rcx, [rsp + 0x940]
call fcn.1400062f0
nop
lea rdx, str.Kaspersky_Security_Scan.exe
lea rcx, [rsp + 0x960]
call fcn.1400062f0
nop
lea rdx, str.TDSSKiller.exe
lea rcx, [rsp + 0x980]
call fcn.1400062f0
nop
lea rdx, str.Norton_Power_Eraser.exe
lea rcx, [rsp + 0x9a0]
call fcn.1400062f0
nop
lea rdx, str.ComboFix.exe
lea rcx, [rsp + 0x9c0]
call fcn.1400062f0
nop
lea rdx, str.VMware.exe
lea rcx, [rsp + 0x9e0]
call fcn.1400062f0
nop
lea rdx, str.VMwareTray.exe
lea rcx, [rsp + 0xa00]
call fcn.1400062f0
nop
lea rdx, str.VMwareUser.exe
lea rcx, [rsp + 0xa20]
call fcn.1400062f0
nop
lea rdx, str.vmware_vmx.exe
lea rcx, [rsp + 0xa40]
call fcn.1400062f0
nop
lea rdx, str.vboxtray.exe
lea rcx, [rsp + 0xa60]
call fcn.1400062f0
nop
lea rdx, str.VBoxService.exe
lea rcx, [rsp + 0xa80]
call fcn.1400062f0
nop
lea rdx, str.VBoxHeadless.exe
lea rcx, [rsp + 0xaa0]
call fcn.1400062f0
nop
lea rdx, str.qemu_system_x86_64.exe
lea rcx, [rsp + 0xac0]
call fcn.1400062f0
nop
lea rdx, str.vagrant.exe
lea rcx, [rsp + 0xae0]
call fcn.1400062f0
nop
lea rdx, str.sandboxie.exe
lea rcx, [rsp + 0xb00]
call fcn.1400062f0
nop
lea rdx, str.sniff_hit.exe
lea rcx, [rsp + 0xb20]
call fcn.1400062f0
nop
lea rdx, str.joeboxcontrol.exe
lea rcx, [rsp + 0xb40]
call fcn.1400062f0
nop
lea rdx, str.joeboxserver.exe
lea rcx, [rsp + 0xb60]
call fcn.1400062f0
nop
lea rdx, str.ReClass.exe
lea rcx, [rsp + 0xb80]
call fcn.1400062f0
nop
lea rdx, str.HxD.exe
lea rcx, [rsp + 0xba0]
call fcn.1400062f0
nop
lea rdx, str.HxD64.exe
lea rcx, [rsp + 0xbc0]
call fcn.1400062f0
nop
lea rdx, str.HxD32.exe
lea rcx, [rsp + 0xbe0]
call fcn.1400062f0
nop
lea rdx, str.ResourceHacker.exe
lea rcx, [rsp + 0xc00]
call fcn.1400062f0
nop
lea rdx, str.BinText.exe
lea rcx, [rsp + 0xc20]
call fcn.1400062f0
nop
lea rdx, str.ExeinfoPE.exe
lea rcx, [rsp + 0xc40]
call fcn.1400062f0
nop
lea rdx, str.Proxifier.exe
lea rcx, [rsp + 0xc60]
call fcn.1400062f0
nop
lea rdx, str.IDA_Pro.exe
lea rcx, [rsp + 0xc80]
call fcn.1400062f0
nop
lea rdx, str.Hex_Fiend.exe
lea rcx, [rsp + 0xca0]
call fcn.1400062f0
nop
lea rdx, str.NetLimiter.exe
lea rcx, [rsp + 0xcc0]
call fcn.1400062f0
nop
lea rdx, str.tcpdump.exe
lea rcx, [rsp + 0xce0]
call fcn.1400062f0
nop
lea rdx, str.SysAnalyzer.exe
lea rcx, [rsp + 0xd00]
call fcn.1400062f0
nop
lea rdx, str.APIMonitor.exe
lea rcx, [rsp + 0xd20]
call fcn.1400062f0
nop
lea rdx, str.resource.exe
lea rcx, [rsp + 0xd40]
call fcn.1400062f0
nop
lea rdx, str.procdump.exe
lea rcx, [rsp + 0xd60]
call fcn.1400062f0
nop
lea rdx, str.Process_Dumper.exe
lea rcx, [rsp + 0xd80]
call fcn.1400062f0
nop
lea rdx, str.BurpSuite.exe
lea rcx, [rsp + 0xda0]
call fcn.1400062f0
nop
lea rdx, str.ZAP.exe
lea rcx, [rsp + 0xdc0]
call fcn.1400062f0
nop
lea rdx, str.owasp_zap.exe
lea rcx, [rsp + 0xde0]
call fcn.1400062f0
nop
lea rdx, str.Metasploit.exe
lea rcx, [rsp + 0xe00]
call fcn.1400062f0
nop
lea rdx, str.nmap.exe
lea rcx, [rsp + 0xe20]
call fcn.1400062f0
nop
lea rdx, str.OpenVAS.exe
lea rcx, [rsp + 0xe40]
call fcn.1400062f0
nop
lea rdx, str.Nikto.exe
lea rcx, [rsp + 0xe60]
call fcn.1400062f0
nop
lea rdx, str.Arachni.exe
lea rcx, [rsp + 0xe80]
call fcn.1400062f0
nop
lea rax, [rsp + 0xea0]
mov r8, rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x90]
call fcn.14001f7d0
lea rcx, [rsp + 0x68]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x80]
lea rcx, [rsp + 0x68]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xeb0]
call fcn.14001fa50
nop
lea r9, [fcn.140006260]
mov r8d, reloc.WS2_32.dll_WSASetLastError
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rsp + 0xa0]
call fcn.140079470
nop
lea rax, [rsp + 0xeb0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.140024a10
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x48]
call fcn.140024a60
mov qword [rsp + 0x58], rax
jmp 0x140025f5f
mov rax, qword [rsp + 0x38]
add rax, 0x20
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
je 0x140025fe9
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140006150
mov rcx, rax
call fcn.1400270e0
test eax, eax
je 0x140025fe4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Unallowed_Process_Found__Please_Restart_PC_or_Contact_Support._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400190c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__youtu.be_oeQ5bvU8LRI_si0WDU8AblcCTEeYJB
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x140025f51
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0xeb0]
call fcn.140020ab0
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xec8]
xor rcx, rsp
call fcn.140079450
add rsp, 0xed8
pop rdi
pop rsi
ret