Function at 0x14004d930
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
xor bl, bl
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, 1
test eax, eax
je 0x14004d9be
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004d9be
lea rdx, str.KsDumperClient.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004d992
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e0fc
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004da3c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004da3c
nop dword [rax + rax]
lea rdx, str.HTTPDebuggerUI.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004da10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e116
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004dabc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004dabc
nop dword [rax]
lea rdx, str.HTTPDebuggerSvc.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004da90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e130
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004db3c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004db3c
nop dword [rax]
lea rdx, str.FolderChangesView.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004db10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e14a
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004dbbc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004dbbc
nop dword [rax]
lea rdx, str.ProcessHacker.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004db90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e164
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004dc3c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004dc3c
nop dword [rax]
lea rdx, str.procmon.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004dc10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e17e
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004dcbc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004dcbc
nop dword [rax]
lea rdx, str.idaq.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004dc90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e198
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004dd3c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004dd3c
nop dword [rax]
lea rdx, [0x1400cb740]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004dd10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e1b2
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004ddbc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004ddbc
nop dword [rax]
lea rdx, str.Wireshark.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004dd90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e1cc
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004de3c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004de3c
nop dword [rax]
lea rdx, str.Fiddler.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004de10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e1e6
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004debc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004debc
nop dword [rax]
lea rdx, str.Xenos64.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004de90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e200
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004df3c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004df3c
nop dword [rax]
lea rdx, str.Cheat_Engine.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004df10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e21a
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004dfbc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004dfbc
nop dword [rax]
lea rdx, str.HTTP_Debugger_Windows_Service__32_bit_.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004df90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e234
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004e03c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004e03c
nop dword [rax]
lea rdx, str.KsDumper.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004e010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e24e
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004e0bc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004e0bc
nop dword [rax]
lea rdx, str.x64dbg.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x40]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004e090
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14004e0e2
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, str.x64dbg
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.KsDumper
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.HttpDebuggerPro
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.HttpDebuggerPro___Service
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.FolderChangesView
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.Process_Hacker
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.Process_Monitor
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, [0x1400cb73c]
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, [0x1400cb73c]
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.Wireshark
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.Fiddler
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.Xenos
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.Cheat_Engine
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.HTTP_Debugger___Service__2_
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
lea rdx, str.KSDumper
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3
sub rsp, 0x48
lea rdx, [0x1400cb8c8]
lea rcx, str.C:Program_FilesWin32Log.txt
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
jne 0x14004e296
add rsp, 0x48
jmp 0x14004d930
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, str.User_is_banned__7_
lea rcx, [rsp + 0x20]
call fcn.140046b90
mov rcx, rax
call fcn.140045920
int3