Function at 0x7ff65ed3cbf0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r15, r8
mov qword [rsp + 0x50], r8
mov r14, rdx
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], r8
cmp dword [0x7ff65f42ca78], 0
jne 0x7ff65ed3cd3e
test r9b, r9b
je 0x7ff65ed3cd3e
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHQueryUserNotificationState]
mov eax, dword [rsp + 0x40]
add eax, 0xfffffffe
cmp eax, 1
ja 0x7ff65ed3cd3e
mov edx, 0x14
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x7ff65f42f790], eax
jg 0x7ff65ed3d498
movzx eax, byte [0x7ff65f42f84a]
test al, al
je 0x7ff65ed3ccef
xor byte [0x7ff65f42f840], 0x2e
xor byte [0x7ff65f42f841], 0x2e
xor byte [0x7ff65f42f842], 0x2e
xor byte [0x7ff65f42f843], 0x2e
xor byte [0x7ff65f42f844], 0x2e
xor byte [0x7ff65f42f845], 0x2e
xor byte [0x7ff65f42f846], 0x2e
xor byte [0x7ff65f42f847], 0x2e
xor byte [0x7ff65f42f848], 0x2e
xor byte [0x7ff65f42f849], 0x2e
xor al, 0x2e
mov byte [0x7ff65f42f84a], al
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
lea rdx, [0x7ff65f42f840]
mov r12, 0xffffffffffffffff
inc r12
cmp byte [rdx + r12], al
jne 0x7ff65ed3cd10
mov r8, r12
mov rcx, rbx
call fcn.7ff65ec85ad0
nop
mov rcx, r14
call fcn.7ff65eca37c0
nop
mov rcx, r15
call fcn.7ff65eca37c0
mov rax, rbx
jmp 0x7ff65ed3d468
mov rdx, qword [r14]
mov qword [rbp - 0x78], rdx
mov r8, qword [r14 + 8]
mov qword [rbp - 0x80], r8
mov rax, qword [r15]
mov qword [rsp + 0x60], rax
mov rcx, qword [r15 + 8]
mov qword [rsp + 0x58], rcx
cmp rdx, r8
jne 0x7ff65ed3cdee
cmp rax, rcx
jne 0x7ff65ed3cdee
mov edx, 0x14
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x7ff65f42f78c], eax
jg 0x7ff65ed3d4f2
movzx eax, byte [0x7ff65f42f838]
test al, al
je 0x7ff65ed3cdbf
xor byte [0x7ff65f42f834], 0x2e
xor byte [0x7ff65f42f835], 0x2e
xor byte [0x7ff65f42f836], 0x2e
xor byte [0x7ff65f42f837], 0x2e
xor al, 0x2e
mov byte [0x7ff65f42f838], al
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
lea rdx, [0x7ff65f42f834]
mov r12, 0xffffffffffffffff
inc r12
cmp byte [rdx + r12], al
jne 0x7ff65ed3cde0
jmp 0x7ff65ed3cd19
mov dword [rbp - 0x60], 0x238
mov esi, 0x14
mov rax, qword gs:[0x58]
add rsi, qword [rax]
mov eax, dword [rsi]
cmp dword [0x7ff65f42f7c8], eax
jg 0x7ff65ed3d539
movzx eax, byte [0x7ff65f42f788]
test al, al
je 0x7ff65ed3ce43
xor byte [0x7ff65f42f784], 0x2e
xor byte [0x7ff65f42f785], 0x2e
xor byte [0x7ff65f42f786], 0x2e
xor byte [0x7ff65f42f787], 0x2e
xor al, 0x2e
mov byte [0x7ff65f42f788], al
xor edi, edi
mov qword [rbp + 0x200], rdi
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x218], 0xf
mov byte [rbp + 0x200], dil
lea rdx, [0x7ff65f42f784]
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rdx + r8], dil
jne 0x7ff65ed3ce76
lea rcx, [rbp + 0x200]
call fcn.7ff65ec85ad0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
mov qword [rsp + 0x68], rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x7ff65ed3cf73
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi]
cmp dword [0x7ff65f42f6d4], eax
jg 0x7ff65ed3d580
movzx eax, byte [0x7ff65f42f768]
test al, al
je 0x7ff65ed3cefa
xor byte [0x7ff65f42f764], 0x2e
xor byte [0x7ff65f42f765], 0x2e
xor byte [0x7ff65f42f766], 0x2e
xor byte [0x7ff65f42f767], 0x2e
xor al, 0x2e
mov byte [0x7ff65f42f768], al
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rdx, [0x7ff65f42f764]
inc r12
cmp byte [rdx + r12], 0
jne 0x7ff65ed3cf13
mov r8, r12
mov rcx, rbx
call fcn.7ff65ec85ad0
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x7ff65ed3cd25
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3cf69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3d5c7
call fcn.7ff65efe070c
jmp 0x7ff65ed3cd25
mov r13, qword [rbp + 0x218]
mov rax, qword [rbp + 0x200]
mov qword [rsp + 0x40], rax
nop word [rax + rax]
mov qword [rbp + 0x220], rdi
mov qword [rbp + 0x230], rdi
mov qword [rbp + 0x238], 7
mov word [rbp + 0x220], di
lea rax, [rbp - 0x34]
mov r8, r12
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff65ed3cfc0
lea rdx, [rbp - 0x34]
lea rcx, [rbp + 0x220]
call fcn.7ff65ec85900
nop
lea r8, [rbp + 0x220]
cmp qword [rbp + 0x238], 8
cmovae r8, qword [rbp + 0x220]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x230]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov qword [rbp + 0x1e0], rdi
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], 0
mov rdx, rbx
xor r8d, r8d
lea rcx, [rbp + 0x1e0]
call fcn.7ff65eca3590
lea rcx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0x10
cmovae rcx, qword [rbp + 0x1e0]
lea r8, [rbp + 0x220]
cmp qword [rbp + 0x238], 8
cmovae r8, qword [rbp + 0x220]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x230]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 8
jb 0x7ff65ed3d0eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3d0e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3d5cd
call fcn.7ff65efe070c
mov qword [rbp + 0x230], rdi
mov qword [rbp + 0x238], 7
mov word [rbp + 0x220], di
mov rax, qword [rbp - 0x80]
cmp qword [rbp - 0x78], rax
je 0x7ff65ed3d2a4
mov rbx, qword [r14 + 8]
mov rdi, qword [r14]
mov r15, qword [rbp + 0x1f8]
mov rsi, qword [rbp + 0x1f0]
mov r14, qword [rbp + 0x1e0]
cmp rdi, rbx
je 0x7ff65ed3d2b9
nop word [rax + rax]
lea rdx, [rbp + 0x1e0]
cmp r15, 0x10
cmovae rdx, r14
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x7ff65ed3d15c
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rsi
jne 0x7ff65ed3d16e
call fcn.7ff65efe2e30
test eax, eax
je 0x7ff65ed3d177
add rdi, 0x20
cmp rdi, rbx
jne 0x7ff65ed3d140
cmp rdi, rbx
je 0x7ff65ed3d2b9
lea rax, [rbp + 0x1e0]
cmp r15, 0x10
cmovae rax, r14
mov qword [rsp + 0x78], rax
cmp rsi, r13
ja 0x7ff65ed3d1d6
lea rbx, [rbp + 0x200]
cmp r13, 0x10
cmovae rbx, qword [rsp + 0x40]
mov qword [rbp + 0x210], rsi
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call fcn.7ff65efe2f30
mov byte [rbx + rsi], 0
mov r13, qword [rbp + 0x218]
mov rbx, qword [rbp + 0x200]
jmp 0x7ff65ed3d28f
movabs rdx, 0x7fffffffffffffff
cmp rsi, rdx
ja 0x7ff65ed3d5df
mov rbx, r13
mov r13, rsi
or r13, 0xf
cmp r13, rdx
jbe 0x7ff65ed3d1fd
mov r13, rdx
jmp 0x7ff65ed3d21e
mov rcx, rbx
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rbx, rax
jbe 0x7ff65ed3d213
mov r13, rdx
jmp 0x7ff65ed3d21e
lea rax, [rbx + rcx]
cmp r13, rax
cmovb r13, rax
lea rcx, [r13 + 1]
call fcn.7ff65ec844e0
mov rdi, rax
mov qword [rbp + 0x210], rsi
mov qword [rbp + 0x218], r13
mov r8, rsi
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call fcn.7ff65efe2f30
mov byte [rdi + rsi], 0
cmp rbx, 0x10
jb 0x7ff65ed3d285
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ed3d280
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3d5d3
call fcn.7ff65efe070c
mov rbx, rdi
mov qword [rbp + 0x200], rbx
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x60], rax
je 0x7ff65ed3d3b5
mov r15, qword [rbp + 0x1f8]
mov rsi, qword [rbp + 0x1f0]
mov r14, qword [rbp + 0x1e0]
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x60], rax
je 0x7ff65ed3d358
mov rax, qword [rsp + 0x50]
mov rbx, qword [rax + 8]
mov rdi, qword [rax]
cmp rdi, rbx
je 0x7ff65ed3d358
nop word [rax + rax]
lea rdx, [rbp + 0x1e0]
cmp r15, 0x10
cmovae rdx, r14
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x7ff65ed3d2fc
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, rsi
jne 0x7ff65ed3d30e
call fcn.7ff65efe2e30
test eax, eax
je 0x7ff65ed3d317
add rdi, 0x20
cmp rdi, rbx
jne 0x7ff65ed3d2e0
cmp rdi, rbx
je 0x7ff65ed3d358
mov r8d, dword [rbp - 0x58]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x7ff65ed3d34a
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rbp + 0x1e0]
mov r15, qword [rbp + 0x1f8]
cmp r15, 0x10
jb 0x7ff65ed3d38f
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x7ff65ed3d387
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3d492
mov rcx, r14
call fcn.7ff65efe070c
lea rdx, [rbp - 0x60]
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x7ff65ed3d42d
xor edi, edi
mov r14, qword [rsp + 0x48]
jmp 0x7ff65ed3cf90
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, qword [rsp + 0x70]
movups xmm0, xmmword [rbp + 0x1e0]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0x1f0]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], al
cmp r13, 0x10
jb 0x7ff65ed3d450
lea rdx, [r13 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x7ff65ed3d423
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ed3d5d9
mov rcx, rbx
call fcn.7ff65efe070c
jmp 0x7ff65ed3d450
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x70]
movups xmm0, xmmword [rbp + 0x200]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0x210]
movups xmmword [rdi + 0x10], xmm1
mov rcx, qword [rsp + 0x48]
call fcn.7ff65eca37c0
nop
mov rcx, qword [rsp + 0x50]
call fcn.7ff65eca37c0
mov rax, rdi
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.7ff65efe06b0
mov rbx, qword [rsp + 0x3a8]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff65efe777c
nop
lea rcx, [0x7ff65f42f790]
call fcn.7ff65efe08c8
cmp dword [0x7ff65f42f790], 0xffffffff
jne 0x7ff65ed3cc96
mov dword [0x7ff65f42f840], 0x42425b68
mov dword [0x7ff65f42f844], 0x4b5c4d5d
mov word [0x7ff65f42f848], 0x404b
mov byte [0x7ff65f42f84a], 0x2e
lea rcx, [0x7ff65f019dc0]
call fcn.7ff65efe0c10
lea rcx, [0x7ff65f42f790]
call fcn.7ff65efe0868
jmp 0x7ff65ed3cc96
lea rcx, [0x7ff65f42f78c]
call fcn.7ff65efe08c8
cmp dword [0x7ff65f42f78c], 0xffffffff
jne 0x7ff65ed3cd90
mov dword [0x7ff65f42f834], 0x4b404140
mov byte [0x7ff65f42f838], 0x2e
lea rcx, [0x7ff65f019d60]
call fcn.7ff65efe0c10
lea rcx, [0x7ff65f42f78c]
call fcn.7ff65efe0868
jmp 0x7ff65ed3cd90
lea rcx, [0x7ff65f42f7c8]
call fcn.7ff65efe08c8
cmp dword [0x7ff65f42f7c8], 0xffffffff
jne 0x7ff65ed3ce14
mov dword [0x7ff65f42f784], 0x4b404140
mov byte [0x7ff65f42f788], 0x2e
lea rcx, [0x7ff65f019da0]
call fcn.7ff65efe0c10
lea rcx, [0x7ff65f42f7c8]
call fcn.7ff65efe0868
jmp 0x7ff65ed3ce14
lea rcx, [0x7ff65f42f6d4]
call fcn.7ff65efe08c8
cmp dword [0x7ff65f42f6d4], 0xffffffff
jne 0x7ff65ed3cecb
mov dword [0x7ff65f42f764], 0x4b404140
mov byte [0x7ff65f42f768], 0x2e
lea rcx, [0x7ff65f019d80]
call fcn.7ff65efe0c10
lea rcx, [0x7ff65f42f6d4]
call fcn.7ff65efe0868
jmp 0x7ff65ed3cecb
call fcn.7ff65efe777c
nop
call fcn.7ff65efe777c
int3
call fcn.7ff65efe777c
nop
call fcn.7ff65efe777c
nop
call fcn.7ff65ec84720
int3