Function at 0x140016ff0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x1400aa0c0]
xor rax, rsp
mov qword [rbp + 0x280], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14001732c
lea rax, str.ollydbg
mov qword [rbp + 0x180], rax
lea rbx, [rbp + 0x180]
lea rax, [0x14009a4f8]
mov qword [rbp + 0x188], rax
lea rax, str.ida32
mov qword [rbp + 0x190], rax
lea rax, str.ida64
mov qword [rbp + 0x198], rax
lea rax, str.ollydbg.exe
mov qword [rbp + 0x1a0], rax
lea rax, str.ida.exe
mov qword [rbp + 0x1a8], rax
lea rax, str.idaq.exe
mov qword [rbp + 0x1b0], rax
lea rax, str.idaq64.exe
mov qword [rbp + 0x1b8], rax
lea rax, str.idaq32.exe
mov qword [rbp + 0x1c0], rax
lea rax, str.immunity
mov qword [rbp + 0x1c8], rax
lea rax, str.windbg
mov qword [rbp + 0x1d0], rax
lea rax, str.x64dbg
mov qword [rbp + 0x1d8], rax
lea rax, str.x32dbg
mov qword [rbp + 0x1e0], rax
lea rax, str.dbg64
mov qword [rbp + 0x1e8], rax
lea rax, str.dbg32
mov qword [rbp + 0x1f0], rax
lea rax, [0x14009a5f8]
mov qword [rbp + 0x1f8], rax
lea rax, [0x14009a600]
mov qword [rbp + 0x200], rax
lea rax, str.scylla
mov qword [rbp + 0x208], rax
lea rax, str.scylla_x64
mov qword [rbp + 0x210], rax
lea rax, str.scylla_x86
mov qword [rbp + 0x218], rax
lea rax, str.x96dbg
mov qword [rbp + 0x220], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x228], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x230], rax
lea rax, str.Cheat_Engine
mov qword [rbp + 0x238], rax
lea rax, str.fiddler
mov qword [rbp + 0x240], rax
lea rax, str.charles
mov qword [rbp + 0x248], rax
lea rax, str.wireshark
mov qword [rbp + 0x250], rax
lea rax, str.netmon
mov qword [rbp + 0x258], rax
lea rax, str.procmon
mov qword [rbp + 0x260], rax
lea rax, str.import_reconstructor
mov qword [rbp + 0x268], rax
lea rax, str.Registry_Editor
mov qword [rbp + 0x270], rax
nop
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14001732c
add rbx, 8
lea rax, [rbp + 0x278]
cmp rbx, rax
jne 0x1400171f0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140017785
xor r14d, r14d
lea r12, str.taskmgr.exe
lea r13, str.procmon.exe
lea r15, str.cheatengine.exe
nop dword [rax + rax]
xorps xmm0, xmm0
mov qword [rsp + 0x30], r14
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x140017280
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140014800
mov rdi, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
cmp rdi, 7
mov r9, qword [rsp + 0x30]
cmova r8, rbx
cmp r9, 0xb
jne 0x14001735e
mov rdx, r9
mov rcx, r12
test r9, r9
je 0x1400172e8
sub r8, r12
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14001735e
add rcx, 2
sub rdx, 1
jne 0x1400172d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 7
jbe 0x14001732c
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140017324
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017795
mov rcx, rbx
call fcn.140085540
mov al, 1
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140085210
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xb
jne 0x14001739c
mov rdx, r9
mov rcx, r13
test r9, r9
je 0x1400172e8
sub r8, r13
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14001739c
add rcx, 2
sub rdx, 1
jne 0x140017383
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x10
jne 0x1400173e9
lea rax, str.Cheat_Engine.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
nop dword [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400173e9
add rcx, 2
sub rdx, 1
jne 0x1400173d0
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x14
jne 0x14001742e
lea rax, str.cheatengine_i386.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14001742e
add rcx, 2
sub rdx, 1
jne 0x140017415
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x16
jne 0x140017479
lea rax, str.cheatengine_x86_64.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140017479
add rcx, 2
sub rdx, 1
jne 0x140017460
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x20
jne 0x1400174be
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400174be
add rcx, 2
sub rdx, 1
jne 0x1400174a5
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 7
jne 0x140017509
lea rax, str.HxD.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140017509
add rcx, 2
sub rdx, 1
jne 0x1400174f0
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x11
jne 0x14001754e
lea rax, str.ProcessHacker.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14001754e
add rcx, 2
sub rdx, 1
jne 0x140017535
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xb
jne 0x140017599
lea rax, str.procexp.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140017599
add rcx, 2
sub rdx, 1
jne 0x140017580
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xd
jne 0x1400175de
lea rax, str.wireshark.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400175de
add rcx, 2
sub rdx, 1
jne 0x1400175c5
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xb
jne 0x140017629
lea rax, str.ollydbg.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140017629
add rcx, 2
sub rdx, 1
jne 0x140017610
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 7
jne 0x14001766e
lea rax, str.ida.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14001766e
add rcx, 2
sub rdx, 1
jne 0x140017655
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xa
jne 0x1400176b9
lea rax, str.x32dbg.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400176b9
add rcx, 2
sub rdx, 1
jne 0x1400176a0
jmp 0x1400172e8
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xa
jne 0x1400176fe
lea rax, str.x64dbg.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x1400172e8
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400176fe
add rcx, 2
sub rdx, 1
jne 0x1400176e5
jmp 0x1400172e8
cmp rdi, 7
lea rdx, [rsp + 0x20]
cmova rdx, rbx
cmp r9, 0xf
jne 0x140017738
mov rcx, r15
test r9, r9
je 0x1400172e8
sub rdx, r15
movzx eax, word [rdx + rcx]
cmp ax, word [rcx]
jne 0x140017738
add rcx, 2
sub r9, 1
jne 0x140017720
jmp 0x1400172e8
cmp rdi, 7
jbe 0x14001776f
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140017767
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017795
mov rcx, rbx
call fcn.140085540
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140017260
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14001732e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3