Function at 0x140005f30
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rcx, str.net_stop_FACEIT__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_ESEADriver2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [str.GO__fZ__]
xor ebx, ebx
movdqu xmmword [rbp - 0x30], xmm0
mov ecx, ebx
mov dword [rbp - 0x20], 0x504e5407
mov dword [rbp - 0x1c], 0x66010c1d
mov word [rbp - 0x18], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x16], 1
nop
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x19
jb 0x140005fd0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x16], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140094910]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xe495f4f
mov dword [rbp - 0x1c], 0x3551001d
mov dword [rbp - 0x18], 0x7a71622d
mov dword [rbp - 0x14], 0x1007763
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1e
jb 0x140006020
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x11], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140094900]
mov rcx, rbx
movdqa xmm1, xmmword [0x140094960]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x78
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140006070
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400948f0]
mov rcx, rbx
movdqa xmm1, xmmword [0x140094930]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x78
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x1400060c0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400948f0]
mov rcx, rbx
movdqa xmm1, xmmword [0x140094940]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x78
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140006110
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400948f0]
mov rcx, rbx
movdqa xmm1, xmmword [0x140094950]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x78
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140006160
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400948e0]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x52051a52
mov dword [rbp - 0x1c], 0x721f5248
mov dword [rbp - 0x18], 0x72647f
mov byte [rbp - 0x14], 1
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x1400061b0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x14], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140094920]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x1a050819
mov word [rbp - 0x1c], recv
mov byte [rbp - 0x1a], 1
nop dword [rax + rax]
lea eax, [rbx + 0x29]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0x15
jb 0x1400061f0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x1a], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_wireshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_rawshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_charles___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]