Function at 0x4226b0
Capabilities:
Allocate or change rwx memory
Check for outputdebugstring error
Execute command
Execute shellcode via indirect call
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x4a1400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.004225c0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.NtQueryInformationProcess
push str.ntdll.dll
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 8], 0
je 0x42271e
call fcn.004211e0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.taskkill__f__im_KsDumperClient.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_KsDumper.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_ProcessHacker.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_idaq.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_idaq64.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_Wireshark.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_Fiddler.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_FiddlerEverywhere.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_Xenos64.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_Xenos.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_Xenos32.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_de4dot.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_Cheat_Engine.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_cheatengine_x86_64.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_cheatengine_x86_64_SSE4_AVX2.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_MugenJinFuu_x86_64_SSE4_AVX2.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_MugenJinFuu_i386.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_cheatengine_x86_64.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_cheatengine_i386.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_HTTP_Debugger_Windows_Service__32_bit_.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_KsDumper.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_OllyDbg.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_x64dbg.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_x32dbg.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_Ida64.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_OllyDbg.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_Dbg64.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__f__im_Dbg32.exe__nul_2_1
call esi
add esp, 4
push str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call esi
add esp, 4
push str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call esi
add esp, 4
push str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call esi
add esp, 4
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push str.NtQueryInformationProcess
push str.ntdll.dll
call ebx
push eax
call edi
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x1e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x4228db
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004211e0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movq xmm0, qword [0x499875]
mov cl, 0x5c
movzx eax, word [0x49987d]
movq qword [ebp - 0xdf], xmm0
xorps xmm0, xmm0
movq qword [ebp - 0xd5], xmm0
movq xmm0, qword [str..ICEEXT]
movq qword [ebp - 0xcc], xmm0
xorps xmm0, xmm0
movq qword [ebp - 0xc1], xmm0
movups xmm0, xmmword [str..NDBGMSG.VXD]
mov word [ebp - 0xd7], ax
movzx eax, word [0x499888]
mov word [ebp - 0xc4], ax
movzx eax, byte [0x49988a]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
movups xmmword [ebp - 0xb8], xmm0
mov byte [ebp - 0xc2], al
movq xmm0, qword [str..RING0]
movzx eax, word [0x4998a4]
movq qword [ebp - 0xa4], xmm0
xorps xmm0, xmm0
mov word [ebp - 0x9c], ax
movzx eax, word [0x4998b0]
movq qword [ebp - 0x9a], xmm0
movq xmm0, qword [str..SIWVID]
mov word [ebp - 0x88], ax
movzx eax, byte [0x4998b2]
movq qword [ebp - 0x90], xmm0
xorps xmm0, xmm0
mov byte [ebp - 0x86], al
movzx eax, word [0x4998bc]
movq qword [ebp - 0x85], xmm0
movq xmm0, qword [str..SYSER]
mov word [ebp - 0x74], ax
mov eax, dword [0x4998c8]
movq qword [ebp - 0x7c], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x4c], eax
movzx eax, word [0x4998cc]
movq qword [ebp - 0x72], xmm0
movq qword [ebp - 0x60], xmm0
movq xmm0, qword [str..SYSERBOOT]
mov word [ebp - 0x48], ax
xor eax, eax
movq qword [ebp - 0x54], xmm0
xor edi, edi
xorps xmm0, xmm0
mov dword [ebp - 0x46], eax
mov dword [ebp - 0x42], eax
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0xe0]
mov byte [ebp - 0xe0], cl
mov byte [ebp - 0xcd], 0
mov byte [ebp - 0xb9], 0
mov dword [ebp - 0xa8], 0
mov word [ebp - 0x92], 0
mov byte [ebp - 0x7d], 0
mov word [ebp - 0x6a], 0
mov dword [ebp - 0x68], 0x5c2e5c5c
mov dword [ebp - 0x64], 0x575254
mov dword [ebp - 0x58], 0
movups xmmword [ebp - 0x3e], xmm0
push 0
push 0
push 3
push 0
push 0
push 0
push eax
call ebx
cmp eax, 0xffffffff
jne 0x4228c7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
lea eax, [edi + edi*4]
cmp byte [ebp + eax*4 - 0xe0], 0
lea eax, [ebp + eax*4 - 0xe0]
jne 0x422a55
push str.NtQueryInformationProcess
push str.ntdll.dll
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov edi, eax
lea eax, [ebp - 8]
push 4
push eax
push 0x1f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [ebp - 8], 0
jne 0x422acf
call fcn.004211e0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x338], str..kdstinker
xor edi, edi
mov dword [ebp - 0x334], str..NiGgEr
mov dword [ebp - 0x330], str..KsDumper
mov dword [ebp - 0x32c], str..kprocesshacker
nop dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [ebp + edi*4 - 0x338]
call ebx
cmp eax, 0xffffffff
je 0x422b2f
push str.start_cmd__c_START_CMD__C__COLOR_C__TITLE_Protection__ECHO_KsDumper_Detected.__TIMEOUT_10__nul
call esi
add esp, 4
call fcn.004211e0
inc edi
cmp edi, 4
jl 0x422b00
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.leksa
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x422d7b
mov ebx, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call ebx
test eax, eax
jne 0x422d7b
call fcn.004214a0
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
mov esi, 0x630090
push 0
push dword [esi]
call edi
test eax, eax
je 0x422b85
call fcn.004211e0
add esi, 4
cmp esi, 0x630144
jne 0x422b76
push dword [0x630088]
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test eax, eax
je 0x422ba9
call fcn.004211e0
call ebx
test eax, eax
je 0x422bb4
call fcn.004211e0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x422beb
push str.DbgBreakPoint
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x422beb
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x422beb
mov byte [esi], 0xc3
push str.OllyDbg____CPU_
push 0
call edi
neg eax
push str.Immunity_Debugger____CPU_
sbb esi, esi
push 0
neg esi
call edi
test eax, eax
mov ecx, 1
cmovne esi, ecx
test esi, esi
je 0x422c19
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x2c8
xor esi, esi
lea eax, [ebp - 0x2f4]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x2f8], 0x10010
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x422c87
cmp dword [ebp - 0x2f4], esi
jne 0x422c82
cmp dword [ebp - 0x2f0], esi
jne 0x422c82
cmp dword [ebp - 0x2ec], esi
jne 0x422c82
cmp dword [ebp - 0x2e8], esi
jne 0x422c82
cmp dword [ebp - 0x2e4], esi
jne 0x422c82
cmp dword [ebp - 0x2e0], esi
je 0x422c87
mov esi, 1
test esi, esi
je 0x422c98
call fcn.004211e0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 8], 0
push ss
pop ss
pushfd
test byte [esp + 1], 1
jne 0x422cab
jmp 0x422cb2
mov dword [ebp - 8], 1
nop
cmp dword [ebp - 8], 0
je 0x422cc6
call fcn.004211e0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.00422640
push 0x23
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push str.C:WindowsSysWOW64x64debugger.exe
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0
movups xmmword [ebp - 0x24], xmm0
call fcn.00412900
cmp dword [ebp - 0x10], 0xf
lea ecx, [ebp - 0x328]
lea eax, [ebp - 0x24]
cmova eax, dword [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
jne 0x422d34
push str._n______You_are_banned_____
call fcn.004207f0
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004211e0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xf
jbe 0x422d6a
mov edx, dword [ebp - 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x422d60
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x422d60
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00483cf3
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004839af
mov esp, ebp
pop ebp
ret
call fcn.004211e0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3