Function at 0x140009e30
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rcx, str.net_stop_FACEIT__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_ESEADriver2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400dd310]
xor ebx, ebx
movdqu xmmword [rbp - 0x30], xmm0
mov ecx, ebx
mov dword [rbp - 0x20], 0x52485205
mov dword [rbp - 0x1c], 0x647f721f
mov word [rbp - 0x18], WSAStartup
mov byte [rbp - 0x16], 1
nop
lea eax, [rcx + 0x2b]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x19
jb 0x140009ed0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x16], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400dd3e0]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xc4f594d
mov dword [rbp - 0x1c], 0x372f7e1f
mov dword [rbp - 0x18], 0x7877642f
mov dword [rbp - 0x14], 0x1007961
nop dword [rax]
lea eax, [rcx + 0x2b]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1e
jb 0x140009f20
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x11], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400dd3d0]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400dd450]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x7a
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x2b]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140009f70
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400dd3b0]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400dd470]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x7a
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x2b]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x140009fc0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400dd3b0]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400dd480]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x7a
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x2b]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x14000a010
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400dd3b0]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400dd460]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x7a
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x2b]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x21
jb 0x14000a060
lea rcx, [rbp - 0x30]
mov byte [rbp - 0xe], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400dd3a0]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x50031c50
mov dword [rbp - 0x1c], 0x70612c4a
mov dword [rbp - 0x18], 0x74627d
mov byte [rbp - 0x14], 1
nop word [rax + rax]
lea eax, [rcx + 0x2b]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x14000a0b0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x14], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400dd410]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x18030e1b
mov word [rbp - 0x1c], reloc.WS2_32.dll_ntohl
mov byte [rbp - 0x1a], 1
nop dword [rax + rax]
lea eax, [rbx + 0x2b]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0x15
jb 0x14000a0f0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x1a], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_wireshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_rawshark___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_charles___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wireshark__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_npf__nul_2_1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]