Function at 0x140002eb0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push rdi
mov eax, 0x12a0
call fcn.140016540
sub rsp, rax
mov rax, qword [0x140021220]
xor rax, rsp
mov qword [rsp + 0x1290], rax
lea r8, [rsp + 0x44]
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x140002f68
mov eax, dword [0x140020940]
and eax, 0x10
test eax, eax
jne 0x140002f07
mov rcx, qword [0x140020948]
mov eax, dword [0x140025264]
cmp dword [rcx], eax
je 0x140002f63
call fcn.140010ff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.EnumProcesses_failed___d_
call fcn.140012270
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x21e
lea rax, [0x140017f00]
mov qword [rsp + 0x28], rax
mov eax, dword [0x140020060]
mov dword [rsp + 0x20], eax
xor r9d, r9d
lea r8, [0x140017f10]
mov edx, 0x10
lea rcx, str.KillS7epasrv64x__
call fcn.1400122d0
call fcn.1400110a0
jmp 0x14000319a
mov eax, dword [rsp + 0x44]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x1050], eax
mov dword [rsp + 0x40], 0
jmp 0x140002f92
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x1050]
cmp dword [rsp + 0x40], eax
jae 0x14000319a
mov eax, dword [rsp + 0x40]
cmp dword [rsp + rax*4 + 0x50], 0
je 0x140003195
movzx eax, word [0x140017f14]
mov word [rsp + 0x1070], ax
lea rdi, [rsp + 0x1072]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x40]
mov r8d, dword [rsp + rax*4 + 0x50]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x1058], rax
cmp qword [rsp + 0x1058], 0
je 0x140003195
lea r9, [rsp + 0x1280]
mov r8d, 8
lea rdx, [rsp + 0x1288]
mov rcx, qword [rsp + 0x1058]
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14000310d
mov r9d, 0x104
lea r8, [rsp + 0x1070]
mov rdx, qword [rsp + 0x1288]
mov rcx, qword [rsp + 0x1058]
call sub.PSAPI.DLL_GetModuleBaseNameW
lea rdx, str.s7epasrv64x.exe
lea rcx, [rsp + 0x1070]
call qword [sym.imp.MSVCR90.dll__wcsicmp]
test eax, eax
jne 0x14000310b
xor edx, edx
mov rcx, qword [rsp + 0x1058]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400030f8
mov eax, dword [0x140020940]
and eax, 0x10
test eax, eax
jne 0x14000309c
mov rcx, qword [0x140020948]
mov eax, dword [0x140025264]
cmp dword [rcx], eax
je 0x1400030f8
call fcn.140010ff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.TerminateProcess_failed___d_
call fcn.140012270
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x23c
lea rax, [0x140017f58]
mov qword [rsp + 0x28], rax
mov eax, dword [0x140020060]
mov dword [rsp + 0x20], eax
xor r9d, r9d
lea r8, [0x140017f68]
mov edx, 0x10
lea rcx, str.KillS7epasrv64x__
call fcn.1400122d0
call fcn.1400110a0
mov rcx, qword [rsp + 0x1058]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000319a
jmp 0x140003187
mov eax, dword [0x140020940]
and eax, 0x10
test eax, eax
jne 0x14000312b
mov rcx, qword [0x140020948]
mov eax, dword [0x140025264]
cmp dword [rcx], eax
je 0x140003187
call fcn.140010ff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.EnumProcessModules_failed___d_
call fcn.140012270
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x243
lea rax, [0x140017f90]
mov qword [rsp + 0x28], rax
mov eax, dword [0x140020060]
mov dword [rsp + 0x20], eax
xor r9d, r9d
lea r8, [0x140017f6c]
mov edx, 0x10
lea rcx, str.KillS7epasrv64x__
call fcn.1400122d0
call fcn.1400110a0
mov rcx, qword [rsp + 0x1058]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002f87
mov rcx, qword [rsp + 0x1290]
xor rcx, rsp
call fcn.140015270
add rsp, 0x12a0
pop rdi
ret