Function at 0x1400107b0
Capabilities:
Enumerate processes
Query or enumerate registry value
Terminate process

Disassembly:
mov r11, rsp
push rbp
push r14
lea rbp, [r11 - 0x3f8]
sub rsp, 0x4e8
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov qword [r11 + 0x10], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rax
xor edx, edx
mov qword [r11 + 0x18], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov r12d, ecx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x60]
mov qword [r11 - 0x28], r15
lea rax, [rsp + 0x30]
xor r15d, r15d
mov qword [rsp + 0x30], rax
mov r14d, r15d
mov qword [rsp + 0x60], r15
call fcn.140031c50
test eax, eax
je 0x140010982
mov rsi, qword [rsp + 0x60]
mov ebx, 0x200
mov ecx, ebx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
call fcn.14004d694
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140010977
test r12d, r12d
lea rcx, str.GraphicsDGPUProcessSnapshot
lea rdi, str.GraphicsDGPUProcess
cmovne rdi, rcx
lea rcx, [rsp + 0x44]
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x1400108ce
lea eax, [rbx + 0x1000]
cmp ebx, 0x1000
lea ecx, [rbx + rbx]
cmovae ecx, eax
mov ebx, ecx
mov edx, ecx
mov rcx, qword [rsp + 0x48]
call fcn.14004dea0
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140010871
jmp 0x140010977
test eax, eax
je 0x1400108dc
mov rcx, qword [rsp + 0x48]
jmp 0x140010972
cmp dword [rsp + 0x40], 7
mov rbx, qword [rsp + 0x48]
jne 0x14001096f
cmp word [rbx], r15w
je 0x14001096f
mov ecx, 0x218
call fcn.14004d694
mov rdi, rax
test rax, rax
je 0x140010942
xor edx, edx
mov r8d, 0x218
mov rcx, rax
call fcn.1400423d0
lea rcx, [rdi + 0x10]
mov r8, rbx
mov edx, 0x104
call fcn.140044288
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rcx], rdi
mov qword [rsp + 0x58], rdi
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x140010950
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], r15w
jne 0x1400108f6
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.14004d69c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x234
call fcn.1400423d0
xor edx, edx
mov dword [rsp + 0x70], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140010b80
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32FirstW]
test eax, eax
je 0x140010b77
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x208
call fcn.1400423d0
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140010b61
mov r9d, 0x104
lea r8, [rbp + 0x1b0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetModuleFileNameExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebx, ebx
je 0x140010b61
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0x50]
cmp rbx, rax
je 0x140010b61
mov rdi, qword [rsp + 0x58]
lea rcx, [rbx + 0x10]
lea rdx, [rbp + 0x1b0]
call fcn.14004da60
test eax, eax
je 0x140010a80
nop dword [rax]
cmp rbx, rdi
je 0x140010b61
mov rbx, qword [rbx]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbx + 0x10]
call fcn.14004da60
test eax, eax
jne 0x140010a60
test r12d, r12d
je 0x140010ac1
mov r8d, dword [rsp + 0x78]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140010b61
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test eax, eax
je 0x140010ab3
inc r14d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x140010b61
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x30]
cmp rbx, rax
je 0x140010b0e
mov rdi, qword [rsp + 0x38]
lea rcx, [rbx + 0x10]
lea rdx, [rbp + 0x1b0]
call fcn.14004da60
test eax, eax
je 0x140010b61
nop dword [rax]
cmp rbx, rdi
je 0x140010b0e
mov rbx, qword [rbx]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbx + 0x10]
call fcn.14004da60
test eax, eax
jne 0x140010af0
jmp 0x140010b61
mov ecx, 0x218
call fcn.14004d694
mov rbx, rax
test rax, rax
je 0x140010b5e
xor edx, edx
mov r8d, 0x218
mov rcx, rax
call fcn.1400423d0
lea rcx, [rbx + 0x10]
mov edx, 0x104
lea r8, [rbp + 0x1b0]
call fcn.140044288
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [rsp + 0x38], rbx
inc r14d
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32NextW]
test eax, eax
jne 0x1400109d0
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r12d, r12d
lea rcx, [rsp + 0x30]
mov edx, 1
cmovne rcx, r15
call fcn.1400105c0
mov rdi, qword [rsp + 0x4e0]
test r12d, r12d
mov r12, qword [rsp + 0x4d8]
mov rsi, qword [rsp + 0x510]
mov rbx, qword [rsp + 0x508]
je 0x140010c1c
xor edx, edx
xor ecx, ecx
call fcn.1400105c0
cmp dword [0x14007b36c], 3
jne 0x140010c1c
xor edx, edx
mov dword [0x14007b36c], r15d
lea rcx, str.GraphicsModeResult
call fcn.1400320f0
mov rcx, qword [0x14007d0e8]
test rcx, rcx
je 0x140010c00
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x140010c00
mov r15d, 0x10000
mov ecx, dword [0x14007b36c]
mov edx, 3
shl ecx, 8
or ecx, r15d
or ecx, dword [0x14007b3a0]
call fcn.140010ce0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x50]
mov r15, qword [rsp + 0x4d0]
cmp rcx, rax
je 0x140010c62
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx + 8]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov qword [rdx + 8], rax
call fcn.14004d69c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x50]
cmp rcx, rax
jne 0x140010c40
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x140010c93
mov rdx, qword [rcx + 8]
mov r8, qword [rcx]
mov qword [rdx], r8
mov qword [r8 + 8], rdx
call fcn.14004d69c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x30]
cmp rcx, rax
jne 0x140010c71
mov eax, r14d
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x4e8
pop r14
pop rbp
ret