Function at 0x14007b5d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r14, r8
mov qword [rsp + 0x50], r8
mov rdi, rdx
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x70], r8
cmp dword [0x1403a1c6c], 0
jne 0x14007b6c3
cmp byte [0x1403a1c32], 0
je 0x14007b6c3
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHQueryUserNotificationState]
mov eax, dword [rsp + 0x40]
add eax, 0xfffffffe
cmp eax, 1
ja 0x14007b6c3
xor esi, esi
mov qword [rbx], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
mov qword [rbx + 0x10], 0xa
lea r8d, [rsi + 0xa]
lea rdx, str.Fullscreen
mov rcx, rbx
call fcn.140257930
mov byte [rbx + 0xa], sil
mov rcx, rdi
call fcn.14004c1e0
nop
mov rcx, r14
call fcn.14004c1e0
mov rax, rbx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140255050
mov rbx, qword [rsp + 0x3a8]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, qword [rdi]
mov qword [rsp + 0x78], r15
mov rdx, qword [rdi + 8]
mov qword [rbp - 0x80], rdx
mov rax, qword [r14]
mov qword [rsp + 0x60], rax
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x58], rcx
cmp r15, rdx
jne 0x14007b712
cmp rax, rcx
jne 0x14007b712
xor esi, esi
mov qword [rbx], rsi
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 4
mov dword [rbx], 0x656e6f6e
mov byte [rbx + 4], sil
jmp 0x14007b685
mov dword [rbp - 0x60], 0x238
xor r12d, r12d
mov qword [rbp + 0x220], r12
mov r13d, 0xf
mov qword [rbp + 0x238], r13
mov qword [rbp + 0x230], 4
mov dword [rbp + 0x220], 0x656e6f6e
mov byte [rbp + 0x224], r12b
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov qword [rsp + 0x68], rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14007b79a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], r12
mov qword [rbx + 0x18], r13
mov byte [rbx], r12b
mov qword [rbx + 0x10], 4
mov dword [rbx], 0x656e6f6e
mov byte [rbx + 4], r12b
jmp 0x14007b685
mov rax, qword [rbp + 0x220]
mov qword [rsp + 0x40], rax
movabs rdx, 0x7ffffffffffffffe
mov ecx, 0xa
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x210], r12
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], r12w
lea rax, [rbp - 0x34]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14007b7e1
cmp rbx, 7
ja 0x14007b820
mov qword [rbp + 0x210], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x34]
lea rcx, [rbp + 0x200]
call fcn.140257930
mov word [rbp + rbx + 0x200], r12w
mov rsi, qword [rbp + 0x200]
jmp 0x14007b886
cmp rbx, rdx
ja 0x14007bd7d
mov rdi, rbx
or rdi, 7
cmp rdi, rdx
jbe 0x14007b83a
mov rdi, rdx
jmp 0x14007b842
cmp rdi, 0xa
cmovb rdi, rcx
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x200]
call fcn.14004e7e0
mov rsi, rax
mov qword [rbp + 0x210], rbx
mov qword [rbp + 0x218], rdi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x34]
mov rcx, rax
call fcn.140257930
mov word [rsi + rbx], r12w
mov qword [rbp + 0x200], rsi
mov rdi, qword [rsp + 0x48]
lea r8, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae r8, rsi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, dword [rbp + 0x210]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov qword [rbp + 0x1e0], r12
mov qword [rbp + 0x1f0], r12
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], 0
mov rdx, rbx
xor r8d, r8d
lea rcx, [rbp + 0x1e0]
call fcn.14004c840
lea rcx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0x10
cmovae rcx, qword [rbp + 0x1e0]
lea r8, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae r8, qword [rbp + 0x200]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x210]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x14007b992
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b98d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd83
call fcn.1402550ac
mov qword [rbp + 0x210], r12
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], r12w
cmp r15, qword [rbp - 0x80]
je 0x14007bba1
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi]
mov r15, qword [rbp + 0x1f8]
mov r14, qword [rbp + 0x1f0]
mov rsi, qword [rbp + 0x1e0]
cmp rdi, rbx
je 0x14007bbb6
nop dword [rax + rax]
lea rdx, [rbp + 0x1e0]
cmp r15, 0x10
cmovae rdx, rsi
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14007b9fc
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, r14
jne 0x14007ba0e
call fcn.140258180
test eax, eax
je 0x14007ba17
add rdi, 0x20
cmp rdi, rbx
jne 0x14007b9e0
cmp rdi, rbx
je 0x14007bbb6
lea r12, [rbp + 0x1e0]
cmp r15, 0x10
cmovae r12, rsi
cmp r14, r13
ja 0x14007ba79
lea rbx, [rbp + 0x220]
cmp r13, 0x10
cmovae rbx, qword [rsp + 0x40]
mov qword [rbp + 0x230], r14
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.140257930
mov byte [rbx + r14], 0
mov r13, qword [rbp + 0x238]
mov rdi, qword [rbp + 0x220]
mov qword [rsp + 0x40], rdi
xor esi, esi
jmp 0x14007bb8e
movabs rdx, 0x7fffffffffffffff
cmp r14, rdx
ja 0x14007bd9b
mov rdi, r13
mov r13, r14
or r13, 0xf
cmp r13, rdx
jbe 0x14007baaa
mov r13, rdx
movabs rax, 0x8000000000000027
jmp 0x14007baef
mov rcx, rdi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rdi, rax
jbe 0x14007baca
mov r13, rdx
movabs rax, 0x8000000000000027
jmp 0x14007baef
lea rax, [rdi + rcx]
cmp r13, rax
cmovb r13, rax
lea rcx, [r13 + 1]
cmp rcx, 0x1000
jb 0x14007bb10
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007bd89
mov rcx, rax
call fcn.140255070
test rax, rax
je 0x14007bd8f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
xor esi, esi
jmp 0x14007bb25
test rcx, rcx
je 0x14007bb21
call fcn.140255070
mov rbx, rax
xor esi, esi
jmp 0x14007bb25
xor esi, esi
mov ebx, esi
mov qword [rbp + 0x230], r14
mov qword [rbp + 0x238], r13
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.140257930
mov byte [rbx + r14], 0
cmp rdi, 0x10
jb 0x14007bb7f
lea rdx, [rdi + 1]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bb7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd8f
call fcn.1402550ac
mov qword [rbp + 0x220], rbx
mov qword [rsp + 0x40], rbx
mov rdi, rbx
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x60], rax
je 0x14007bcb8
xor r12d, r12d
mov r15, qword [rbp + 0x1f8]
mov r14, qword [rbp + 0x1f0]
mov rsi, qword [rbp + 0x1e0]
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x60], rax
je 0x14007bc58
mov rax, qword [rsp + 0x50]
mov rbx, qword [rax + 8]
mov rdi, qword [rax]
cmp rdi, rbx
je 0x14007bc58
nop dword [rax + rax]
lea rdx, [rbp + 0x1e0]
cmp r15, 0x10
cmovae rdx, rsi
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14007bbfc
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, r14
jne 0x14007bc0e
call fcn.140258180
test eax, eax
je 0x14007bc17
add rdi, 0x20
cmp rdi, rbx
jne 0x14007bbe0
cmp rdi, rbx
je 0x14007bc58
mov r8d, dword [rbp - 0x58]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14007bc4a
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp + 0x1e0]
mov r15, qword [rbp + 0x1f8]
cmp r15, 0x10
jb 0x14007bc8f
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14007bc87
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd77
mov rcx, rsi
call fcn.1402550ac
lea rdx, [rbp - 0x60]
mov rsi, qword [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14007bd3f
mov rdi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x78]
jmp 0x14007b7a6
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
movups xmm0, xmmword [rbp + 0x1e0]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f0]
movups xmmword [rbx + 0x10], xmm1
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], 0
cmp r13, 0x10
jb 0x14007bd2a
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14007bd21
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd95
mov rcx, rdi
call fcn.1402550ac
nop
mov rcx, qword [rsp + 0x48]
call fcn.14004c1e0
nop
mov rcx, qword [rsp + 0x50]
jmp 0x14007b691
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
movups xmm0, xmmword [rbp + 0x220]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x230]
movups xmmword [rbx + 0x10], xmm1
mov rcx, qword [rsp + 0x48]
call fcn.14004c1e0
nop
mov rcx, qword [rsp + 0x50]
jmp 0x14007b691
call fcn.140260990
int3
call fcn.140012ae0
nop
call fcn.140260990
int3
call fcn.140012a20
int3
call fcn.140260990
nop
call fcn.140260990
nop
call fcn.140012ae0
int3