Function at 0x140034f00
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x320]
sub rsp, 0x420
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x70], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rsp + 0x60], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_select]
movdqa xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [str.KsDumperClient.exe]
movups xmmword [rax], xmm1
movzx ecx, word [0x1400c88a0]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_htonl]
movdqa xmmword [rbp - 0x70], xmm1
movabs rax, 0x7265706d7544734b
mov qword [rbp - 0x80], rax
mov byte [rbp - 0x78], 0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp - 0x60], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_select]
movdqa xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [str.HTTPDebuggerUI.exe]
movups xmmword [rax], xmm1
movzx ecx, word [0x1400c88b8]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ntohs]
movdqa xmmword [rbp - 0x30], xmm1
movsd xmm0, qword [str.HttpDebuggerPro]
movsd qword [rbp - 0x40], xmm0
mov eax, dword [0x1400c8e40]
mov dword [rbp - 0x38], eax
movzx eax, word [0x1400c8e44]
mov word [rbp - 0x34], ax
movzx eax, byte [reloc.WS2_32.dll_WSAGetLastError]
mov byte [rbp - 0x32], al
mov byte [rbp - 0x31], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_send]
movdqa xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [str.HTTPDebuggerSvc.exe]
movups xmmword [rax], xmm1
movzx ecx, word [0x1400c88d0]
mov word [rax + 0x10], cx
movzx ecx, byte [0x1400c88d2]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp], rax
movdqa xmm0, xmmword [0x1400c9c90]
movdqa xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [str.HttpDebuggerPro___Service]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x1400c8e58]
movsd qword [rax + 0x10], xmm0
movzx ecx, byte [0x1400c8e60]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x30], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp + 0x20], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movdqa xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [str.FolderChangesView.exe]
movups xmmword [rax], xmm1
mov ecx, dword [0x1400c8e78]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1400c8e7c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x50], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp + 0x40], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_recvfrom]
movdqa xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [str.FolderChangesView]
movups xmmword [rax], xmm1
movzx edx, byte [0x1400c8d98]
mov byte [rax + 0x10], dl
mov byte [rax + 0x11], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x70], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ac698
mov qword [rbp + 0x60], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_recvfrom]
movdqa xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [str.ProcessHacker.exe]
movups xmmword [rax], xmm1
movzx ecx, byte [0x1400c8e90]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ntohl]
movdqa xmmword [rbp + 0x90], xmm1
movsd xmm0, qword [str.Process_Hacker]
movsd qword [rbp + 0x80], xmm0
mov eax, dword [0x1400c8df8]
mov dword [rbp + 0x88], eax
movzx eax, word [0x1400c8dfc]
mov word [rbp + 0x8c], ax
mov byte [rbp + 0x8e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
movdqa xmm3, xmmword [reloc.WS2_32.dll_inet_addr]
movdqa xmmword [rbp + 0xb0], xmm3
movsd xmm0, qword [str.procmon.exe]
movsd qword [rbp + 0xa0], xmm0
movzx eax, word [0x1400c8eb0]
mov word [rbp + 0xa8], ax
movzx eax, byte [0x1400c8eb2]
mov byte [rbp + 0xaa], al
mov byte [rbp + 0xab], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ntohs]
movdqa xmmword [rbp + 0xd0], xmm1
movsd xmm0, qword [str.Process_Monitor]
movsd qword [rbp + 0xc0], xmm0
mov eax, dword [0x1400c8ea0]
mov dword [rbp + 0xc8], eax
movzx eax, word [0x1400c8ea4]
mov word [rbp + 0xcc], ax
movzx eax, byte [0x1400c8ea6]
mov byte [rbp + 0xce], al
mov byte [rbp + 0xcf], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_htonl]
movdqa xmmword [rbp + 0xf0], xmm1
movabs rax, 0x6578652e71616469
mov qword [rbp + 0xe0], rax
mov byte [rbp + 0xe8], 0
movups xmmword [rbp + 0x100], xmm0
movdqa xmm2, xmmword [reloc.WS2_32.dll_closesocket]
movdqa xmmword [rbp + 0x110], xmm2
mov eax, dword [0x1400c8eb4]
mov word [rbp + 0x100], ax
movzx edx, byte [0x1400c8eb6]
mov byte [rbp + 0x102], dl
mov byte [rbp + 0x103], 0
movups xmmword [rbp + 0x120], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ioctlsocket]
movdqa xmmword [rbp + 0x130], xmm1
movsd xmm0, qword [str.idaq64.exe]
movsd qword [rbp + 0x120], xmm0
movzx ecx, word [0x1400c8ed0]
mov word [rbp + 0x128], cx
mov byte [rbp + 0x12a], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x150], xmm2
mov word [rbp + 0x140], ax
mov byte [rbp + 0x142], dl
mov byte [rbp + 0x143], 0
movups xmmword [rbp + 0x160], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_listen]
movdqa xmmword [rbp + 0x170], xmm1
movsd xmm0, qword [str.Wireshark.exe]
movsd qword [rbp + 0x160], xmm0
mov eax, dword [0x1400c8ef0]
mov dword [rbp + 0x168], eax
movzx eax, byte [0x1400c8ef4]
mov byte [rbp + 0x16c], al
mov byte [rbp + 0x16d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_htons]
movdqa xmmword [rbp + 0x190], xmm1
movsd xmm0, qword [str.Wireshark]
movsd qword [rbp + 0x180], xmm0
movzx eax, byte [0x1400c8ee0]
mov byte [rbp + 0x188], al
mov byte [rbp + 0x189], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
movdqa xmmword [rbp + 0x1b0], xmm3
movsd xmm0, qword [str.Fiddler.exe]
movsd qword [rbp + 0x1a0], xmm0
movzx eax, word [0x1400c8f00]
mov word [rbp + 0x1a8], ax
movzx eax, byte [0x1400c8f02]
mov byte [rbp + 0x1aa], al
mov byte [rbp + 0x1ab], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_getsockopt]
movdqa xmmword [rbp + 0x1d0], xmm1
mov rax, qword [str.Fiddler]
mov dword [rbp + 0x1c0], eax
movzx eax, word [0x1400c8d64]
mov word [rbp + 0x1c4], ax
movzx eax, byte [0x1400c8d66]
mov byte [rbp + 0x1c6], al
mov byte [rbp + 0x1c7], 0
movups xmmword [rbp + 0x1e0], xmm0
movdqa xmmword [rbp + 0x1f0], xmm3
movsd xmm0, qword [str.Xenos64.exe]
movsd qword [rbp + 0x1e0], xmm0
movzx eax, word [0x1400c8f18]
mov word [rbp + 0x1e8], ax
movzx eax, byte [0x1400c8f1a]
mov byte [rbp + 0x1ea], al
mov byte [rbp + 0x1eb], 0
lea rcx, [rbp + 0x200]
call fcn.14002e9e0
mov r8d, 5
lea rdx, str.Xenos
lea rcx, [rbp + 0x200]
call fcn.1400317a0
nop
lea rcx, [rbp + 0x220]
call fcn.14003f1e0
nop
lea rcx, [rbp + 0x260]
call fcn.14003f250
nop
lea rcx, [rbp + 0x2a0]
call fcn.14003f2c0
nop
lea rcx, [rbp + 0x2e0]
call fcn.14003f330
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x320]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14003bf20
nop
lea r9, [fcn.1400355d0]
mov edx, 0x40
mov r8d, reloc.WS2_32.dll_ntohs
lea rcx, [rsp + 0x60]
call fcn.1400ac430
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
cmp rbx, rsi
je 0x140035555
nop
mov rcx, rbx
call fcn.1400338e0
test al, al
jne 0x140035578
add rbx, 0x40
cmp rbx, rsi
jne 0x140035540
lea rcx, [rsp + 0x40]
call fcn.14003e180
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.taskkill__F__T__IM_perfmon.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140033830
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140033780
call fcn.140033720
call fcn.1400338d0
call fcn.140034570
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x20]
call fcn.140031bd0
mov rcx, rax
call fcn.140033990
int3