Function at 0x140008820
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rcx, str.net_stop_FACEIT__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_ESEADriver2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140071b80]
xor ebx, ebx
movdqu xmmword [rbp - 0x30], xmm0
mov ecx, ebx
mov dword [rbp - 0x20], 0x7c7a6033
mov dword [rbp - 0x1c], 0x322d2031
mov word [rbp - 0x18], Ordinal_41
mov byte [rbp - 0x16], 1
nop
lea eax, [rcx - 3]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x19
jb 0x1400088c0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x16], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140071d30]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x227d6b7b
mov dword [rbp - 0x1c], 0x617d2c31
mov dword [rbp - 0x18], 0x26253679
mov dword [rbp - 0x14], 0x1002b3f
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1e
jb 0x140008910
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x11], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140071dd0]
mov rcx, rbx
movdqa xmm1, xmmword [0x140071c70]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], Ordinal_46
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 3]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140008960
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140071e10]
mov rcx, rbx
movdqa xmm1, xmmword [0x140071c40]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], Ordinal_46
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 3]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x1400089b0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140071e10]
mov rcx, rbx
movdqa xmm1, xmmword [0x140071c50]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], Ordinal_46
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 3]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140008a00
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140071e10]
mov rcx, rbx
movdqa xmm1, xmmword [0x140071c60]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], Ordinal_46
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 3]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140008a50
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140071df0]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x7e312e66
mov dword [rbp - 0x1c], 0x26337e64
mov dword [rbp - 0x18], 0x26302b
mov byte [rbp - 0x14], 1
nop word [rax + rax]
lea eax, [rcx - 3]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x140008aa0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x14], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140071cf0]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x36313c2d
mov word [rbp - 0x1c], reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp - 0x1a], 1
nop dword [rax + rax]
lea eax, [rbx - 3]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0x15
jb 0x140008ae0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x1a], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_wireshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_rawshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_charles___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]