Function at 0x14000b790
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1400930a8]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000b7d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateToolhelp32Snapshot_failed._Error:__d_n
call fcn.14000ec50
jmp 0x14000b818
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000b9ae
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14000b831
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Process32First_failed._Error:__d_n
call fcn.14000ec50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140072550
add rsp, 0x160
pop rbx
ret
lea rdx, str.Beamer.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x14000b990
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000b831
lea rdx, str.Beamer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000b9ae
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000b7be
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000b9f0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000b7fb
nop
lea rdx, str.ProcessHacker.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x14000b9d5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000b8c0
lea rdx, str.ProcessHacker.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000b9f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000b7be
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000b9b4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000b7fb
nop
lea rdx, str.ida64.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x14000b9ba
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000b950
lea rdx, str.ida64.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000b9b4
jmp 0x14000b80f
lea rcx, str.x64dbg.exe_is_running_n
call fcn.14000ec50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140006bd0
int3
call fcn.140006bd0
int3
lea rcx, str.ida64.exe_is_running_n
call fcn.14000ec50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140006bd0
int3
lea rcx, str.x64dbg.exe_is_running_n
call fcn.14000ec50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140006bd0
int3
call fcn.140006bd0
int3