Function at 0x1400067e0
Capabilities:
Enumerate processes

Disassembly:
push rdi
push r15
sub rsp, 0x488
mov rax, qword [0x140024078]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15d, 2
xor edx, edx
mov ecx, r15d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
cmp dword [0x140024854], 0
jne 0x140006a82
mov qword [rsp + 0x4a0], rbx
lea rbx, [r15 - 3]
test rdi, rdi
je 0x140006964
mov qword [rsp + 0x4a8], rbp
lea rcx, [rsp + 0x24]
mov qword [rsp + 0x4b0], rsi
xor edx, edx
mov r8d, 0x234
mov qword [rsp + 0x480], r14
call sub.VCRUNTIME140.dll_memset
mov esi, ebx
mov dword [rsp + 0x20], 0x238
mov r14d, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebp, eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400068b4
cmp dword [rsp + 0x28], ebp
je 0x1400068b0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140006897
jmp 0x1400068b4
mov esi, dword [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
mov rbp, qword [rsp + 0x4a8]
test eax, eax
je 0x140006907
nop dword [rax]
cmp dword [rsp + 0x28], esi
je 0x1400068e9
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400068d0
jmp 0x140006907
mov r14d, dword [rsp + 0x40]
lea rdx, [rsp + 0x4c]
mov r8d, 0x104
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
mov rsi, qword [rsp + 0x4b0]
test eax, eax
je 0x140006953
cmp dword [rsp + 0x28], r14d
je 0x14000693a
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140006920
jmp 0x140006953
mov r8d, 0x104
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x480]
lea rcx, [rsp + 0x260]
mov dword [0x140024854], 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
lea r8, str.firefox.exe
xor edx, edx
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x1400069d5
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x1400069d5
add rdx, r15
cmp rdx, 0xc
jne 0x140006985
mov dword [0x140024038], 0
xor eax, eax
mov rbx, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140017790
add rsp, 0x488
pop r15
pop rdi
ret
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
lea r9, str.chrome.exe
mov rdx, rbx
mov r8, rax
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x140006a13
add rdx, r15
cmp rdx, 0xb
je 0x140006a6e
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x1400069f0
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov r8, rax
lea r9, str.msedge.exe
nop dword [rax + rax]
movzx edx, word [r8 + rbx*2 + 2]
movzx ecx, word [r9 + rbx*2 + 2]
sub edx, ecx
jne 0x140006a57
add rbx, r15
cmp rbx, 0xb
je 0x140006a57
movzx edx, word [r8 + rbx*2]
movzx eax, word [r9 + rbx*2]
sub edx, eax
je 0x140006a30
mov eax, dword [0x140024038]
test edx, edx
cmove eax, r15d
mov dword [0x140024038], eax
jmp 0x1400069b2
mov dword [0x140024038], 1
mov eax, 1
jmp 0x1400069b2
mov eax, dword [0x140024038]
jmp 0x1400069ba