Function at 0x140049d10
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x650]
sub rsp, 0x750
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x60], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.KsDumperClient.exe
lea rcx, [rbp - 0x70]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
mov r8d, 8
lea rdx, str.KsDumper
lea rcx, [rbp - 0x50]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x20], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.HTTPDebuggerUI.exe
lea rcx, [rbp - 0x30]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.HttpDebuggerPro
lea rcx, [rbp - 0x10]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.HTTPDebuggerSvc.exe
lea rcx, [rbp + 0x10]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm1
mov r8d, Ordinal_27
lea rdx, str.HttpDebuggerPro___Service
lea rcx, [rbp + 0x30]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.FolderChangesView.exe
lea rcx, [rbp + 0x50]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x80], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.FolderChangesView
lea rcx, [rbp + 0x70]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.ProcessHacker.exe
lea rcx, [rbp + 0x90]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Process_Hacker
lea rcx, [rbp + 0xb0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, recv
lea rdx, str.procmon.exe
lea rcx, [rbp + 0xd0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Process_Monitor
lea rcx, [rbp + 0xf0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
mov r8d, 8
lea rdx, str.idaq.exe
lea rcx, [rbp + 0x110]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov r8d, 3
lea rdx, [0x1400d5068]
lea rcx, [rbp + 0x130]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x160], xmm1
mov r8d, 0xa
lea rdx, str.idaq64.exe
lea rcx, [rbp + 0x150]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x180], xmm1
mov r8d, 3
lea rdx, [0x1400d5068]
lea rcx, [rbp + 0x170]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1a0], xmm1
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Wireshark.exe
lea rcx, [rbp + 0x190]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1c0], xmm1
mov r8d, 9
lea rdx, str.Wireshark
lea rcx, [rbp + 0x1b0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1e0], xmm1
mov r8d, recv
lea rdx, str.Fiddler.exe
lea rcx, [rbp + 0x1d0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x200], xmm1
mov r8d, 7
lea rdx, str.Fiddler
lea rcx, [rbp + 0x1f0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x220], xmm1
mov r8d, recv
lea rdx, str.Xenos64.exe
lea rcx, [rbp + 0x210]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x240], xmm1
mov r8d, 5
lea rdx, str.Xenos
lea rcx, [rbp + 0x230]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x260], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.Cheat_Engine.exe
lea rcx, [rbp + 0x250]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x280], xmm1
mov r8d, recv
lea rdx, str.Cheat_Engine
lea rcx, [rbp + 0x270]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2a0], xmm1
mov r8d, Ordinal_45
lea rdx, str.HTTP_Debugger_Windows_Service__32_bit_.exe
lea rcx, [rbp + 0x290]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.HTTP_Debugger___Service__2_
lea rcx, [rbp + 0x2b0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
mov r8d, recv
lea rdx, str.KsDumper.exe
lea rcx, [rbp + 0x2d0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x300], xmm1
mov r8d, 8
lea rdx, str.KSDumper
lea rcx, [rbp + 0x2f0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x310], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x320], xmm1
mov r8d, recv
lea rdx, str.Anydesk.exe
lea rcx, [rbp + 0x310]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x330], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x340], xmm1
mov r8d, 7
lea rdx, str.Anydesk
lea rcx, [rbp + 0x330]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x350], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x360], xmm1
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Teamviwer.exe
lea rcx, [rbp + 0x350]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x380], xmm1
mov r8d, 0xa
lea rdx, str.TeamViewer
lea rcx, [rbp + 0x370]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3a0], xmm1
mov r8d, recv
lea rdx, str.Discord.exe
lea rcx, [rbp + 0x390]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3c0], xmm1
mov r8d, 7
lea rdx, str.Discord
lea rcx, [rbp + 0x3b0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3e0], xmm1
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.everything.exe
lea rcx, [rbp + 0x3d0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x400], xmm1
mov r8d, 0xa
lea rdx, str.everything
lea rcx, [rbp + 0x3f0]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor r13d, r13d
mov qword [rsp + 0x48], r13
mov ecx, 0x480
call fcn.1400b2f84
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rax + 0x480]
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x38]
mov qword [rbp + 0x690], rax
lea rdi, [rbp - 0x70]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
nop
mov qword [rbp + 0x698], rbx
mov rdx, rdi
mov rcx, rbx
call fcn.14004da90
nop
lea rcx, [rbx + 0x20]
lea rdx, [rdi + 0x20]
call fcn.14004da90
nop
add rbx, 0x40
mov qword [rsp + 0x28], rbx
add rdi, 0x40
lea rax, [rbp + 0x410]
cmp rdi, rax
jne 0x14004a3e0
mov qword [rsp + 0x40], rbx
lea r9, [fcn.14004a700]
mov edx, 0x40
lea r8d, [rdx - 0x2e]
lea rcx, [rbp - 0x70]
call fcn.1400b2d1c
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, Ordinal_50
lea rdx, str.C:Program_Files__x86_TokenGuardTokenGuard.exe
lea rcx, [rsp + 0x70]
call fcn.14004f6b0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov r14, r13
mov qword [rsp + 0x30], r13
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
cmp rbx, rsi
je 0x14004a4c3
cmp rdi, r14
je 0x14004a4a0
mov rdx, rbx
mov rcx, rdi
call fcn.14004da90
add rdi, 0x20
mov qword [rsp + 0x28], rdi
jmp 0x14004a4ba
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140050460
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rbx, 0x40
cmp rbx, rsi
jne 0x14004a485
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
mov r15, qword [rsp + 0x20]
cmp rax, 0xffffffffffffffff
je 0x14004a616
mov dword [rbp + 0x410], 0x238
lea rdx, [rbp + 0x410]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004a60c
mov rbx, r15
cmp r15, rdi
je 0x14004a5f4
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
lea rax, [rbp + 0x43c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14004a530
lea rdx, [rbp + 0x43c]
lea rcx, [rsp + 0x50]
call fcn.14004f6b0
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14004a559
mov rax, qword [rbx]
lea r8, [rsp + 0x50]
mov r10, qword [rsp + 0x68]
cmp r10, 7
seta r11b
mov r9, qword [rsp + 0x50]
cmova r8, r9
mov rdx, qword [rsp + 0x60]
cmp rdx, qword [rbx + 0x10]
jne 0x14004a5a9
test rdx, rdx
je 0x14004a5a4
sub r8, rax
nop word [rax + rax]
movzx ecx, word [rax + r8]
cmp cx, word [rax]
jne 0x14004a5a9
add rax, 2
sub rdx, 1
jne 0x14004a590
mov sil, 1
jmp 0x14004a5ac
xor sil, sil
test r11b, r11b
je 0x14004a5e2
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14004a5da
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a655
mov rcx, r9
call fcn.1400b2dec
test sil, sil
jne 0x14004a65c
add rbx, 0x20
cmp rbx, rdi
jne 0x14004a510
lea rdx, [rbp + 0x410]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004a502
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r15, r15
je 0x14004a684
mov rdx, rdi
mov rcx, r15
call fcn.14004f8f0
sub r14, r15
and r14, 0xffffffffffffffe0
mov rax, r15
cmp r14, 0x1000
jb 0x14004a678
add r14, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a678
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x70]
call fcn.140049c70
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, r14
mov rcx, r15
call fcn.1400b2dec
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x14004a6c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a6c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a6c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2dec
movdqa xmm0, xmmword [0x1400d57a0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r13w
lea rcx, [rsp + 0x38]
call fcn.14004dfb0
mov rbx, qword [rsp + 0x7a0]
add rsp, 0x750
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret