Function at 0x140006220
Capabilities:
Enumerate processes

Disassembly:
push rdi
push r15
sub rsp, 0x488
mov rax, qword [0x140021078]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15d, 2
xor edx, edx
mov ecx, r15d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
cmp dword [0x140021664], 0
jne 0x1400064c2
mov qword [rsp + 0x4a0], rbx
lea rbx, [r15 - 3]
test rdi, rdi
je 0x1400063a4
mov qword [rsp + 0x4a8], rbp
lea rcx, [rsp + 0x24]
mov qword [rsp + 0x4b0], rsi
xor edx, edx
mov r8d, 0x234
mov qword [rsp + 0x480], r14
call sub.VCRUNTIME140.dll_memset
mov esi, ebx
mov dword [rsp + 0x20], 0x238
mov r14d, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebp, eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400062f4
cmp dword [rsp + 0x28], ebp
je 0x1400062f0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400062d7
jmp 0x1400062f4
mov esi, dword [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
mov rbp, qword [rsp + 0x4a8]
test eax, eax
je 0x140006347
nop dword [rax]
cmp dword [rsp + 0x28], esi
je 0x140006329
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140006310
jmp 0x140006347
mov r14d, dword [rsp + 0x40]
lea rdx, [rsp + 0x4c]
mov r8d, 0x104
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
mov rsi, qword [rsp + 0x4b0]
test eax, eax
je 0x140006393
cmp dword [rsp + 0x28], r14d
je 0x14000637a
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140006360
jmp 0x140006393
mov r8d, 0x104
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x480]
lea rcx, [rsp + 0x260]
mov dword [0x140021664], 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
lea r8, str.firefox.exe
xor edx, edx
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x140006415
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x140006415
add rdx, r15
cmp rdx, 0xc
jne 0x1400063c5
mov dword [0x140021038], 0
xor eax, eax
mov rbx, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140015310
add rsp, 0x488
pop r15
pop rdi
ret
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
lea r9, str.chrome.exe
mov rdx, rbx
mov r8, rax
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x140006453
add rdx, r15
cmp rdx, 0xb
je 0x1400064ae
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x140006430
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov r8, rax
lea r9, str.msedge.exe
nop dword [rax + rax]
movzx edx, word [r8 + rbx*2 + 2]
movzx ecx, word [r9 + rbx*2 + 2]
sub edx, ecx
jne 0x140006497
add rbx, r15
cmp rbx, 0xb
je 0x140006497
movzx edx, word [r8 + rbx*2]
movzx eax, word [r9 + rbx*2]
sub edx, eax
je 0x140006470
mov eax, dword [0x140021038]
test edx, edx
cmove eax, r15d
mov dword [0x140021038], eax
jmp 0x1400063f2
mov dword [0x140021038], 1
mov eax, 1
jmp 0x1400063f2
mov eax, dword [0x140021038]
jmp 0x1400063fa