Function at 0x14003a8f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14010d0c0]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
xor bl, bl
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, 1
test eax, eax
je 0x14003a98f
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003a98f
lea rdx, str.KsDumperClient.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003a963
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b0db
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003aa0c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003aa0c
nop dword [rax]
lea rdx, str.HTTPDebuggerUI.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003a9e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b0f5
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003aa8c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003aa8c
nop dword [rax]
lea rdx, str.HTTPDebuggerSvc.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003aa60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b10f
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ab0c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003ab0c
nop dword [rax]
lea rdx, str.FolderChangesView.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003aae0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b129
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ab8c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003ab8c
nop dword [rax]
lea rdx, str.ProcessHacker.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ab60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b143
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ac0c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003ac0c
nop dword [rax]
lea rdx, str.procmon.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003abe0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b15d
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ac8c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003ac8c
nop dword [rax]
lea rdx, str.idaq.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ac60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b177
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ad0c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003ad0c
nop dword [rax]
lea rdx, [0x1400f7f00]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ace0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b191
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ad8c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003ad8c
nop dword [rax]
lea rdx, str.Wireshark.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ad60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b1ab
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ae0c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003ae0c
nop dword [rax]
lea rdx, str.Fiddler.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ade0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b1c5
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ae8c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003ae8c
nop dword [rax]
lea rdx, str.Xenos64.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ae60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b1df
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003af0c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003af0c
nop dword [rax]
lea rdx, str.Cheat_Engine.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003aee0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b1f9
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003af8c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003af8c
nop dword [rax]
lea rdx, str.HTTP_Debugger_Windows_Service__32_bit_.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003af60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b213
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003b00c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003b00c
nop dword [rax]
lea rdx, str.KsDumper.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003afe0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b22d
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003b08c
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003b08c
nop dword [rax]
lea rdx, str.x64dbg.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x50]
test eax, eax
mov rcx, rdi
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003b060
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x14003b0c1
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400da5d0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rdx, str.x64dbg
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.KsDumper
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.HttpDebuggerPro
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.HttpDebuggerPro___Service
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.FolderChangesView
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.Process_Hacker
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.Process_Monitor
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, [0x1400f7efc]
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, [0x1400f7efc]
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.Wireshark
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.Fiddler
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.Xenos
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.Cheat_Engine
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.HTTP_Debugger___Service__2_
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3
lea rdx, str.KSDumper
lea rcx, [rsp + 0x28]
call fcn.14003bf30
mov rcx, rax
call fcn.14003a770
int3