Function at 0x18004a0e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x610]
sub rsp, 0x710
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x60], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.KsDumperClient.exe
lea rcx, [rbp - 0x70]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
mov r8d, 8
lea rdx, str.KsDumper
lea rcx, [rbp - 0x50]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x20], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.HTTPDebuggerUI.exe
lea rcx, [rbp - 0x30]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.HttpDebuggerPro
lea rcx, [rbp - 0x10]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.HTTPDebuggerSvc.exe
lea rcx, [rbp + 0x10]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm1
mov r8d, Ordinal_26
lea rdx, str.HttpDebuggerPro___Service
lea rcx, [rbp + 0x30]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.FolderChangesView.exe
lea rcx, [rbp + 0x50]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x80], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.FolderChangesView
lea rcx, [rbp + 0x70]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.ProcessHacker.exe
lea rcx, [rbp + 0x90]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Process_Hacker
lea rcx, [rbp + 0xb0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, recv
lea rdx, str.procmon.exe
lea rcx, [rbp + 0xd0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Process_Monitor
lea rcx, [rbp + 0xf0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
mov r8d, 8
lea rdx, str.idaq.exe
lea rcx, [rbp + 0x110]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov r8d, 3
lea rdx, [0x1800d4578]
lea rcx, [rbp + 0x130]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x160], xmm1
mov r8d, 0xa
lea rdx, str.idaq64.exe
lea rcx, [rbp + 0x150]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x180], xmm1
mov r8d, 3
lea rdx, [0x1800d4578]
lea rcx, [rbp + 0x170]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1a0], xmm1
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Wireshark.exe
lea rcx, [rbp + 0x190]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1c0], xmm1
mov r8d, 9
lea rdx, str.Wireshark
lea rcx, [rbp + 0x1b0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1e0], xmm1
mov r8d, recv
lea rdx, str.Fiddler.exe
lea rcx, [rbp + 0x1d0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x200], xmm1
mov r8d, 7
lea rdx, str.Fiddler
lea rcx, [rbp + 0x1f0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x220], xmm1
mov r8d, recv
lea rdx, str.Xenos64.exe
lea rcx, [rbp + 0x210]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x240], xmm1
mov r8d, 5
lea rdx, str.Xenos
lea rcx, [rbp + 0x230]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x260], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.Cheat_Engine.exe
lea rcx, [rbp + 0x250]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x280], xmm1
mov r8d, recv
lea rdx, str.Cheat_Engine
lea rcx, [rbp + 0x270]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2a0], xmm1
mov r8d, Ordinal_45
lea rdx, str.HTTP_Debugger_Windows_Service__32_bit_.exe
lea rcx, [rbp + 0x290]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.HTTP_Debugger___Service__2_
lea rcx, [rbp + 0x2b0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
mov r8d, recv
lea rdx, str.KsDumper.exe
lea rcx, [rbp + 0x2d0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x300], xmm1
mov r8d, 8
lea rdx, str.KSDumper
lea rcx, [rbp + 0x2f0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x310], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x320], xmm1
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Everything.exe
lea rcx, [rbp + 0x310]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x330], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x340], xmm1
mov r8d, 0xa
lea rdx, str.Everything
lea rcx, [rbp + 0x330]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x350], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x360], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.System_Informer.exe
lea rcx, [rbp + 0x350]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x380], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.System_Informer
lea rcx, [rbp + 0x370]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3a0], xmm1
mov r8d, recv
lea rdx, str.Notepad.exe
lea rcx, [rbp + 0x390]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3c0], xmm1
mov r8d, 7
lea rdx, str.Notepad
lea rcx, [rbp + 0x3b0]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor r13d, r13d
mov qword [rsp + 0x48], r13
mov ecx, 0x440
call fcn.1800b3344
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rax + 0x440]
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x38]
mov qword [rbp + 0x650], rax
lea rdi, [rbp - 0x70]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x658], rbx
mov rdx, rdi
mov rcx, rbx
call fcn.18004de50
nop
lea rcx, [rbx + 0x20]
lea rdx, [rdi + 0x20]
call fcn.18004de50
nop
add rbx, 0x40
mov qword [rsp + 0x28], rbx
add rdi, 0x40
lea rax, [rbp + 0x3d0]
cmp rdi, rax
jne 0x18004a750
mov qword [rsp + 0x40], rbx
lea r9, [fcn.18004aa70]
mov edx, 0x40
lea r8d, [rdx - 0x2f]
lea rcx, [rbp - 0x70]
call fcn.1800b30dc
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, reloc.WS2_32.dll_gethostname
lea rdx, str.C:Program_Files__x86_MSI_AfterburnerMSIAfterburner.exe
lea rcx, [rsp + 0x70]
call fcn.18004fad0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov r14, r13
mov qword [rsp + 0x30], r13
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
cmp rbx, rsi
je 0x18004a833
cmp rdi, r14
je 0x18004a810
mov rdx, rbx
mov rcx, rdi
call fcn.18004de50
add rdi, 0x20
mov qword [rsp + 0x28], rdi
jmp 0x18004a82a
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180050a50
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rbx, 0x40
cmp rbx, rsi
jne 0x18004a7f5
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
mov r15, qword [rsp + 0x20]
cmp rax, 0xffffffffffffffff
je 0x18004a986
mov dword [rbp + 0x3d0], 0x238
lea rdx, [rbp + 0x3d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18004a97c
mov rbx, r15
cmp r15, rdi
je 0x18004a964
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
lea rax, [rbp + 0x3fc]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18004a8a0
lea rdx, [rbp + 0x3fc]
lea rcx, [rsp + 0x50]
call fcn.18004fad0
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x18004a8c9
mov rax, qword [rbx]
lea r8, [rsp + 0x50]
mov r10, qword [rsp + 0x68]
cmp r10, 7
seta r11b
mov r9, qword [rsp + 0x50]
cmova r8, r9
mov rdx, qword [rsp + 0x60]
cmp rdx, qword [rbx + 0x10]
jne 0x18004a919
test rdx, rdx
je 0x18004a914
sub r8, rax
nop word [rax + rax]
movzx ecx, word [rax + r8]
cmp cx, word [rax]
jne 0x18004a919
add rax, 2
sub rdx, 1
jne 0x18004a900
mov sil, 1
jmp 0x18004a91c
xor sil, sil
test r11b, r11b
je 0x18004a952
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x18004a94a
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a9c5
mov rcx, r9
call fcn.1800b31ac
test sil, sil
jne 0x18004a9cc
add rbx, 0x20
cmp rbx, rdi
jne 0x18004a880
lea rdx, [rbp + 0x3d0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18004a872
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r15, r15
je 0x18004a9f4
mov rdx, rdi
mov rcx, r15
call fcn.18004fe60
sub r14, r15
and r14, 0xffffffffffffffe0
mov rax, r15
cmp r14, 0x1000
jb 0x18004a9e8
add r14, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004a9e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x70]
call fcn.18004a040
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, r14
mov rcx, r15
call fcn.1800b31ac
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x18004aa38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004aa33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004aa33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800b31ac
movdqa xmm0, xmmword [0x1800d4d50]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r13w
lea rcx, [rsp + 0x38]
call fcn.18004e230
mov rbx, qword [rsp + 0x760]
add rsp, 0x710
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret