Function at 0x140034570
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
call fcn.140032850
mov ecx, 0x28a
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__IM_svchost.exe__F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140033830
call fcn.140033780
lea rcx, str.net_stop_FACEIT__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_ESEADriver2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400c9e00]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x1a], 0x31263e
mov dword [rbp - 0x20], 0x6c756e3e
mov word [rbp - 0x1c], 0x3220
mov byte [rbp - 0x16], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ca1c0]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x13], gethostbyname
mov dword [rbp - 0x20], 0x32726576
mov dword [rbp - 0x1c], 0x756e3e20
mov dword [rbp - 0x18], 0x3e32206c
mov byte [rbp - 0x14], Ordinal_41
mov byte [rbp - 0x11], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ca210]
lea rcx, [rbp - 0x30]
movdqa xmm1, xmmword [0x1400c9e60]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], gethostbyname
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ca200]
lea rcx, [rbp - 0x30]
movdqa xmm1, xmmword [0x1400c9e50]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], gethostbyname
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ca200]
lea rcx, [rbp - 0x30]
movdqa xmm1, xmmword [0x1400c9e40]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], gethostbyname
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ca200]
lea rcx, [rbp - 0x30]
movdqa xmm1, xmmword [0x1400c9e30]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], gethostbyname
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ca1f0]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x18], 0x31263e
mov dword [rbp - 0x20], 0x6e3e206b
mov dword [rbp - 0x1c], 0x32206c75
mov byte [rbp - 0x14], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ca1e0]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x1e], 0x31263e
mov word [rbp - 0x20], 0x3220
mov byte [rbp - 0x1a], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_wireshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_rawshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_charles___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400ca1a0]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x16], 0x31263e
mov dword [rbp - 0x20], 0x20656e69
mov dword [rbp - 0x1c], 0x6c756e3e
mov word [rbp - 0x18], 0x3220
mov byte [rbp - 0x12], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x50
pop rbp
ret