Function at 0x140035840
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
lea rcx, str.taskkill__f__im_HTTPDebuggerUI.exe__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__f__im_HTTPDebuggerSvc.exe__nul_2_1
call fcn.140035680
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_fiddler___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_wireshark___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_rawshark___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_charles___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker___IM___F__T__nul_2_1
call fcn.140035680
lea rcx, str.sc_stop_HTTPDebuggerPro__nul_2_1
call fcn.140035680
lea rcx, str.sc_stop_KProcessHacker3__nul_2_1
call fcn.140035680
lea rcx, str.sc_stop_KProcessHacker2__nul_2_1
call fcn.140035680
lea rcx, str.sc_stop_KProcessHacker1__nul_2_1
call fcn.140035680
lea rcx, str.sc_stop_wireshark__nul_2_1
call fcn.140035680
lea rcx, str.sc_stop_npf__nul_2_1
call fcn.140035680
lea rax, str.joeboxcontrol.exe
mov qword [rsp + 0x60], rax
lea rax, str.joeboxcontrol
mov qword [rsp + 0x68], rax
lea rax, str.joeboxserver.exe
mov qword [rsp + 0x70], rax
lea rax, str.joeboxserver
mov qword [rsp + 0x78], rax
lea rax, str.VMSrvc.exe
mov qword [rbp - 0x80], rax
lea rax, str.VMSrvc
mov qword [rbp - 0x78], rax
lea rax, str.VMUSrvc.exe
mov qword [rbp - 0x70], rax
lea rax, str.VMUSrvc
mov qword [rbp - 0x68], rax
lea rax, str.xenservice.exe
mov qword [rbp - 0x60], rax
lea rax, str.xenservice
mov qword [rbp - 0x58], rax
lea rax, str.VBoxControl.exe
mov qword [rbp - 0x50], rax
lea rax, str.VBoxControl
mov qword [rbp - 0x48], rax
lea rax, str.vboxtray.exe
mov qword [rbp - 0x40], rax
lea rax, str.vboxtray
mov qword [rbp - 0x38], rax
lea rax, str.vboxservice.exe
mov qword [rbp - 0x30], rax
lea rax, str.vboxservice
mov qword [rbp - 0x28], rax
lea rax, str.vmtoolsd.exe
mov qword [rbp - 0x20], rax
lea rax, str.vmtoolsd
mov qword [rbp - 0x18], rax
lea rax, str.vmwaretray.exe
mov qword [rbp - 0x10], rax
lea rax, str.vmwaretray
mov qword [rbp - 8], rax
lea rax, str.vmwareuser.exe
mov qword [rbp], rax
lea rax, str.vmwareuser
mov qword [rbp + 8], rax
lea rax, str.VGAuthService.exe
mov qword [rbp + 0x10], rax
lea rax, str.VGAuthService
mov qword [rbp + 0x18], rax
lea rax, str.vmacthlp.exe
mov qword [rbp + 0x20], rax
lea rax, str.vmacthlp
mov qword [rbp + 0x28], rax
lea rax, str.qemu_ga.exe
mov qword [rbp + 0x30], rax
lea rax, str.qemu_ga
mov qword [rbp + 0x38], rax
lea rax, str.vdagent.exe
mov qword [rbp + 0x40], rax
lea rax, str.vdagent
mov qword [rbp + 0x48], rax
lea rax, str.vdservice.exe
mov qword [rbp + 0x50], rax
lea rax, str.vdservice
mov qword [rbp + 0x58], rax
lea rax, str.prl_cc.exe
mov qword [rbp + 0x60], rax
lea rax, str.prl_cc
mov qword [rbp + 0x68], rax
lea rax, str.prl_tools.exe
mov qword [rbp + 0x70], rax
lea rax, str.prl_tools
mov qword [rbp + 0x78], rax
lea rbx, [rsp + 0x60]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor r12d, r12d
mov ecx, 0x120
call fcn.1400ac698
mov r14, rax
mov qword [rsp + 0x40], rax
lea rsi, [rax + 0x120]
mov qword [rsp + 0x50], rsi
mov r8d, 0x120
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r15, [r14 + 0x120]
mov qword [rsp + 0x48], r15
mov rdi, r14
cmp r14, r15
je 0x140035c46
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140035b60
lea rcx, [rsp + 0x20]
call fcn.1400317a0
mov dword [rbp + 0x80], 0x130
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140035b98
xor bl, bl
jmp 0x140035bfc
lea rdx, [rbp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140035bc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x140035bfc
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
lea rcx, [rbp + 0xac]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov rcx, rbx
test eax, eax
je 0x140035bf4
lea rdx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x140035ba8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035c35
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035c30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035c7a
call fcn.1400ac500
test bl, bl
jne 0x140035cad
add rdi, 0x10
cmp rdi, r15
jne 0x140035b40
test r14, r14
je 0x140035c8c
sub rsi, r14
and rsi, 0xfffffffffffffff0
mov rax, r14
cmp rsi, 0x1000
jb 0x140035c81
add rsi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035c81
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, rsi
mov rcx, r14
call fcn.1400ac500
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rdi + 8]
call fcn.1400357d0
int3