Function at 0x18000a620
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11b0]
mov eax, 0x12b0
call fcn.180029160
sub rsp, rax
mov rax, qword [0x180048db8]
xor rax, rsp
mov qword [rbp + 0x11a0], rax
mov r12, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
mov ecx, dword [0x180049798]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180049578], ecx
jg 0x18000c018
cmp byte [section..data], 0
jne 0x18000a6b0
lea rdx, [0x180049560]
mov rcx, r12
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
jmp 0x18000bfdf
mov byte [section..data], 0
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea ecx, [rax + 0x60]
call fcn.1800289b4
mov rsi, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x60], 0
mov r15d, 0xf
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], 7
mov eax, dword [str.avp.exe]
mov dword [rbp - 0x60], eax
movzx eax, word [0x18002f59c]
mov word [rbp - 0x5c], ax
movzx eax, byte [0x18002f59e]
mov byte [rbp - 0x5a], al
mov byte [rbp - 0x59], 0
mov edi, r15d
mov qword [rsp + 0x48], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], 9
movsd xmm0, qword [str.Kaspersky]
movsd qword [rbp - 0x40], xmm0
movzx eax, byte [0x18002f590]
mov byte [rbp - 0x38], al
mov byte [rbp - 0x37], 0
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], 0
mov r13, rsi
mov r14, qword [rbp - 0x60]
cmp byte [rbx + 0x19], 0
jne 0x18000a7e6
lea r12d, [r15 - 8]
mov qword [rsp + 0x50], rbx
lea rcx, [rbx + 0x20]
lea rdx, [rbp - 0x60]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x18000a78c
mov rcx, qword [rcx]
mov r8, rdi
cmp r12, rdi
cmovb r8, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18000a7b3
cmp rdi, r12
jae 0x18000a7ab
mov eax, 0xffffffff
jmp 0x18000a7b3
xor eax, eax
cmp rdi, r12
seta al
shr eax, 0x1f
test al, al
je 0x18000a7c8
mov dword [rsp + 0x58], 0
mov rbx, qword [rbx + 0x10]
jmp 0x18000a7d6
mov dword [rsp + 0x58], 1
mov r13, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x18000a771
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp byte [r13 + 0x19], 0
jne 0x18000a807
lea r8, [r13 + 0x20]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.18000a280
test al, al
je 0x18000a890
movabs rax, 0x2aaaaaaaaaaaaaa
cmp qword [rsp + 0x38], rax
je 0x18000c012
lea rax, [rsp + 0x30]
mov qword [rbp - 0x20], rax
xor ebx, ebx
mov qword [rbp - 0x18], rbx
lea ecx, [rbx + 0x60]
call fcn.1800289b4
nop
movaps xmm0, xmmword [rbp - 0x60]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [rbp - 0x50]
movups xmmword [rax + 0x30], xmm1
lea r15d, [rbx + 0xf]
mov byte [rbp - 0x60], bl
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rax + 0x50], xmm1
mov edi, r15d
mov byte [rbp - 0x40], bl
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], bx
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rbp - 0x20], xmm0
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000a340
mov r14, qword [rbp - 0x60]
jmp 0x18000a892
xor ebx, ebx
cmp rdi, 0x10
jb 0x18000a8c6
lea rdx, [rdi + 1]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a8c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a8f1
call fcn.1800289f0
cmp r15, 0x10
jb 0x18000a900
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x18000a8f8
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000a8f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1800289f0
mov qword [rbp - 0x48], 0xf
mov qword [rbp - 0x50], 9
movsd xmm0, qword [str.avpui.exe]
movsd qword [rbp - 0x60], xmm0
movzx eax, byte [0x18002f5a8]
mov byte [rbp - 0x58], al
mov byte [rbp - 0x57], 0
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 9
lea rdx, str.Kaspersky
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 7
lea rdx, str.nav.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.Norton
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 6
lea rdx, str.ns.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.Norton
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0x12
lea rdx, str.nortonsecurity.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.Norton
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xc
lea rdx, str.nswscsvc.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.Norton
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xc
lea rdx, str.navapsvc.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.Norton
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 8
lea rdx, str.ekrn.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 3
lea rdx, [0x18002f600]
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 8
lea rdx, str.egui.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 3
lea rdx, [0x18002f600]
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xd
lea rdx, str.eguiproxy.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 3
lea rdx, [0x18002f600]
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xc
lea rdx, str.avastsvc.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 5
lea rdx, str.Avast
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xb
lea rdx, str.ashServ.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 5
lea rdx, str.Avast
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xc
lea rdx, str.mcshield.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.McAfee
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 9
lea rdx, str.MCODS.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.McAfee
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 9
lea rdx, str.cavwp.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.Comodo
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0x12
lea rdx, str.dragon_updater.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.Comodo
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 7
lea rdx, str.cis.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.Comodo
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xc
lea rdx, str.cmdagent.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 6
lea rdx, str.Comodo
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xc
lea rdx, str.psuamain.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 5
lea rdx, str.Panda
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xf
lea rdx, str.PSUAConsole.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
mov qword [rbp - 0x40], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 5
lea rdx, str.Panda
lea rcx, [rbp - 0x40]
call fcn.18000c060
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009ad0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [0x18002fb70]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov r8d, 0xc
lea rdx, str.AVENGINE.exe
lea rcx, [rbp - 0x60]
call fcn.18000c060
nop
lea rdx, str.Panda
lea rcx, [rbp - 0x40]
call fcn.180009f60
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.Avira
lea rdx, str.avguard.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.DrWeb
lea rdx, str.dwengine.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.DrWeb
lea rdx, str.dwarkdaemon.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.DrWeb
lea rdx, str.dwantispam.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.DrWeb
lea rdx, str.dwservice.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.DrWeb
lea rdx, str.dwnetfilter.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.DrWeb
lea rdx, str.dwwatcher.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, [0x18002f788]
lea rdx, str.avgidsagent.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, [0x18002f788]
lea rdx, str.avgToolsSvc.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, [0x18002f788]
lea rdx, str.AVGUI.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, [0x18002f788]
lea rdx, str.aswEngSrv.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, [0x18002f788]
lea rdx, str.wsc_proxy.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, [0x18002f788]
lea rdx, str.AVGSvc.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, [0x18002f788]
lea rdx, str.avgemc.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.TrendMicro
lea rdx, str.coreserviceshell.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.TrendMicro
lea rdx, str.uiWatchDog.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.TrendMicro
lea rdx, str.Tmsalnstance64.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.TrendMicro
lea rdx, str.AMSPTelemetryService.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.TrendMicro
lea rdx, str.coreFrameworkHost.exe
lea rcx, [rbp - 0x60]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp - 0x60]
call fcn.18000a140
lea r8, str.TrendMicro
lea rdx, str.ntrtscan.exe
lea rcx, [rbp + 0x40]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x40]
call fcn.18000a140
lea r8, str.TrendMicro
lea rdx, str.tmntsrv.exe
lea rcx, [rbp]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp]
call fcn.18000a140
lea r8, str.BitDefender
lea rdx, str.bdagent.exe
lea rcx, [rbp + 0x80]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x80]
call fcn.18000a140
lea r8, str.BitDefender
lea rdx, str.gziface.exe
lea rcx, [rbp + 0xc0]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0xc0]
call fcn.18000a140
lea r8, str.BitDefender
lea rdx, str.ProductAgentService.exe
lea rcx, [rbp + 0x100]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x100]
call fcn.18000a140
lea r8, str.BitDefender
lea rdx, str.vsservppl.exe
lea rcx, [rbp + 0x140]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x140]
call fcn.18000a140
lea r8, str.BitDefender
lea rdx, str.bdredline.exe
lea rcx, [rbp + 0x180]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x180]
call fcn.18000a140
lea r8, str.BitDefender
lea rdx, str.vsserv.exe
lea rcx, [rbp + 0x1c0]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x1c0]
call fcn.18000a140
lea r8, str.BitDefender
lea rdx, str.updatesrv.exe
lea rcx, [rbp + 0x200]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x200]
call fcn.18000a140
lea r8, str.MalwareBytes
lea rdx, str.mbamservice.exe
lea rcx, [rbp + 0x240]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x240]
call fcn.18000a140
lea r8, str.Clamav
lea rdx, str.freshclam.exe
lea rcx, [rbp + 0x280]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x280]
call fcn.18000a140
lea r8, str.Clamav
lea rdx, str.freshclamwrap.exe
lea rcx, [rbp + 0x2c0]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x2c0]
call fcn.18000a140
lea r8, str.GData
lea rdx, str.gdscan.exe
lea rcx, [rbp + 0x300]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x300]
call fcn.18000a140
lea r8, str.Emsisoft
lea rdx, str.a2start.exe
lea rcx, [rbp + 0x340]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x340]
call fcn.18000a140
lea r8, [0x18002f9b4]
lea rdx, str.k7tsecurity.exe
lea rcx, [rbp + 0x380]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x380]
call fcn.18000a140
lea r8, [0x18002f9b4]
lea rdx, str.k7tsmain.exe
lea rcx, [rbp + 0x3c0]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x3c0]
call fcn.18000a140
lea r8, str.TrustPort
lea rdx, str.tpeasy.exe
lea rcx, [rbp + 0x400]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x400]
call fcn.18000a140
lea r8, str.Vipre
lea rdx, str.vipreui.exe
lea rcx, [rbp + 0x440]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x440]
call fcn.18000a140
lea r8, str.MicroWorld
lea rdx, str.avkwctl.exe
lea rcx, [rbp + 0x480]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x480]
call fcn.18000a140
lea r8, str.FSecure
lea rdx, str.fsav32.exe
lea rcx, [rbp + 0x4c0]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x4c0]
call fcn.18000a140
lea r8, str.Q360
lea rdx, str.qhactivedefense.exe
lea rcx, [rbp + 0x500]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x500]
call fcn.18000a140
lea r8, str.Q360
lea rdx, str.qhsafetray.exe
lea rcx, [rbp + 0x540]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x540]
call fcn.18000a140
lea r8, str.Q360
lea rdx, str.qhwatchdog.exe
lea rcx, [rbp + 0x580]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x580]
call fcn.18000a140
lea r8, str.Q360
lea rdx, str.liveupdate360.exe
lea rcx, [rbp + 0x5c0]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x5c0]
call fcn.18000a140
lea r8, str.Q360
lea rdx, str.360tsliveupd.exe
lea rcx, [rbp + 0x600]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x600]
call fcn.18000a140
lea r8, str.AdBlocker
lea rdx, str.adblockerultimategui.exe
lea rcx, [rbp + 0x640]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x640]
call fcn.18000a140
lea r8, str.AdLock
lea rdx, str.adlock.exe
lea rcx, [rbp + 0x680]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x680]
call fcn.18000a140
lea r8, str.Ghostery
lea rdx, str.ghostery_midnight.exe
lea rcx, [rbp + 0x6c0]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x6c0]
call fcn.18000a140
lea r8, str.Microsoft
lea rdx, str.msmpeng.exe
lea rcx, [rbp + 0x700]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x700]
call fcn.18000a140
lea r8, str.Microsoft
lea rdx, str.msseces.exe
lea rcx, [rbp + 0x740]
call fcn.1800099f0
nop
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.180009de0
nop
lea rcx, [rbp + 0x740]
call fcn.18000a140
mov dword [rbp + 0x780], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
test rax, rax
je 0x18000bfc4
lea rdx, [rbp + 0x780]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18000bfc4
mov r8d, 0x3e8
lea rdx, [rbp + 0x7ac]
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp - 0x60]
call fcn.180009f60
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.18000c1c0
mov rdi, qword [rax]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.18000c1e0
mov rbx, qword [rax]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.18000c1c0
mov rcx, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x70]
call fcn.180009e10
mov rax, qword [rsp + 0x30]
mov rsi, qword [rax]
mov qword [rsp + 0x40], rsi
cmp rsi, rax
je 0x18000be00
nop word [rax + rax]
lea rdx, [rsi + 0x20]
lea rcx, [rbp - 0x20]
call fcn.180009e80
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x20]
call fcn.18000c1c0
mov rdi, qword [rax]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x20]
call fcn.18000c1e0
mov rbx, qword [rax]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.18000c1c0
mov rcx, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x78]
call fcn.180009e10
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.180009a90
test al, al
jne 0x18000bdc3
lea rcx, [rbp - 0x20]
call fcn.18000a0b0
lea rcx, [rsp + 0x40]
call fcn.18000a210
mov rsi, qword [rsp + 0x40]
cmp rsi, qword [rsp + 0x30]
jne 0x18000bd30
jmp 0x18000be00
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsi + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt6Core.dll_public:_static_class_QString___cdecl_QString::fromStdString_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64_]
mov rdx, rax
lea rcx, [0x180049560]
call qword [sym.imp.Qt6Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString____ptr64____ptr64]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x20]
call fcn.18000a0b0
lea rcx, [0x180049560]
call qword [sym.imp.Qt6Core.dll_public:_bool___cdecl_QString::isEmpty_void_const___ptr64]
test al, al
je 0x18000bfbb
nop word [rax + rax]
lea rdx, [rbp + 0x780]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x18000bfbb
mov r8d, 0x3e8
lea rdx, [rbp + 0x7ac]
lea rcx, [rbp + 0xdb0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
lea rdx, [rbp + 0xdb0]
lea rcx, [rbp + 0x40]
call fcn.180009f60
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x40]
call fcn.18000c1c0
mov rdi, qword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x40]
call fcn.18000c1e0
mov rbx, qword [rax]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x40]
call fcn.18000c1c0
mov rcx, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x48]
call fcn.180009e10
mov rax, qword [rsp + 0x30]
mov rsi, qword [rax]
mov qword [rsp + 0x40], rsi
cmp rsi, rax
je 0x18000bf9d
nop word [rax + rax]
lea rdx, [rsi + 0x20]
lea rcx, [rbp]
call fcn.180009e80
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp]
call fcn.18000c1c0
mov rdi, qword [rax]
lea rdx, [rbp - 0x80]
lea rcx, [rbp]
call fcn.18000c1e0
mov rbx, qword [rax]
lea rdx, [rbp - 0x78]
lea rcx, [rbp]
call fcn.18000c1c0
mov rcx, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp - 0x20]
call fcn.180009e10
lea rdx, [rbp + 0x40]
lea rcx, [rbp]
call fcn.180009a90
test al, al
jne 0x18000bf5f
lea rcx, [rbp]
call fcn.18000a0b0
lea rcx, [rsp + 0x40]
call fcn.18000a210
mov rsi, qword [rsp + 0x40]
cmp rsi, qword [rsp + 0x30]
jne 0x18000bed0
jmp 0x18000bf9d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsi + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt6Core.dll_public:_static_class_QString___cdecl_QString::fromStdString_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64_]
mov rdx, rax
lea rcx, [0x180049560]
call qword [sym.imp.Qt6Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString____ptr64____ptr64]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp]
call fcn.18000a0b0
nop
lea rcx, [rbp + 0x40]
call fcn.18000a0b0
lea rcx, [0x180049560]
call qword [sym.imp.Qt6Core.dll_public:_bool___cdecl_QString::isEmpty_void_const___ptr64]
test al, al
jne 0x18000be20
lea rcx, [rbp - 0x60]
call fcn.18000a0b0
lea rdx, [0x180049560]
mov rcx, r12
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x30]
call fcn.18000a110
mov rax, r12
mov rcx, qword [rbp + 0x11a0]
xor rcx, rsp
call fcn.180028a90
lea r11, [rsp + 0x12b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18000a5e0
nop
lea rcx, [0x180049578]
call fcn.180028fb4
cmp dword [0x180049578], 0xffffffff
jne 0x18000a692
lea rcx, [0x18002c320]
call fcn.180028e44
lea rcx, [0x180049578]
call fcn.180028f54
jmp 0x18000a692