Function at 0x140014540
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rbp + 0x280], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14001487c
lea rax, str.ollydbg
mov qword [rbp + 0x180], rax
lea rbx, [rbp + 0x180]
lea rax, [0x14009e4d8]
mov qword [rbp + 0x188], rax
lea rax, str.ida32
mov qword [rbp + 0x190], rax
lea rax, str.ida64
mov qword [rbp + 0x198], rax
lea rax, str.ollydbg.exe
mov qword [rbp + 0x1a0], rax
lea rax, str.ida.exe
mov qword [rbp + 0x1a8], rax
lea rax, str.idaq.exe
mov qword [rbp + 0x1b0], rax
lea rax, str.idaq64.exe
mov qword [rbp + 0x1b8], rax
lea rax, str.idaq32.exe
mov qword [rbp + 0x1c0], rax
lea rax, str.immunity
mov qword [rbp + 0x1c8], rax
lea rax, str.windbg
mov qword [rbp + 0x1d0], rax
lea rax, str.x64dbg
mov qword [rbp + 0x1d8], rax
lea rax, str.x32dbg
mov qword [rbp + 0x1e0], rax
lea rax, str.dbg64
mov qword [rbp + 0x1e8], rax
lea rax, str.dbg32
mov qword [rbp + 0x1f0], rax
lea rax, [0x14009e5d8]
mov qword [rbp + 0x1f8], rax
lea rax, [0x14009e5e0]
mov qword [rbp + 0x200], rax
lea rax, str.scylla
mov qword [rbp + 0x208], rax
lea rax, str.scylla_x64
mov qword [rbp + 0x210], rax
lea rax, str.scylla_x86
mov qword [rbp + 0x218], rax
lea rax, str.x96dbg
mov qword [rbp + 0x220], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x228], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x230], rax
lea rax, str.Cheat_Engine
mov qword [rbp + 0x238], rax
lea rax, str.fiddler
mov qword [rbp + 0x240], rax
lea rax, str.charles
mov qword [rbp + 0x248], rax
lea rax, str.wireshark
mov qword [rbp + 0x250], rax
lea rax, str.netmon
mov qword [rbp + 0x258], rax
lea rax, str.procmon
mov qword [rbp + 0x260], rax
lea rax, str.import_reconstructor
mov qword [rbp + 0x268], rax
lea rax, str.Registry_Editor
mov qword [rbp + 0x270], rax
nop
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14001487c
add rbx, 8
lea rax, [rbp + 0x278]
cmp rbx, rax
jne 0x140014740
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140014cd5
xor r14d, r14d
lea r12, str.taskmgr.exe
lea r13, str.procmon.exe
lea r15, str.cheatengine.exe
nop dword [rax + rax]
xorps xmm0, xmm0
mov qword [rsp + 0x30], r14
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x1400147d0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.1400129d0
mov rdi, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
cmp rdi, 7
mov r9, qword [rsp + 0x30]
cmova r8, rbx
cmp r9, 0xb
jne 0x1400148ae
mov rdx, r9
mov rcx, r12
test r9, r9
je 0x140014838
sub r8, r12
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400148ae
add rcx, 2
sub rdx, 1
jne 0x140014820
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 7
jbe 0x14001487c
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140014874
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014ce5
mov rcx, rbx
call fcn.140089574
mov al, 1
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140089510
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xb
jne 0x1400148ec
mov rdx, r9
mov rcx, r13
test r9, r9
je 0x140014838
sub r8, r13
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400148ec
add rcx, 2
sub rdx, 1
jne 0x1400148d3
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x10
jne 0x140014939
lea rax, str.Cheat_Engine.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
nop dword [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140014939
add rcx, 2
sub rdx, 1
jne 0x140014920
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x14
jne 0x14001497e
lea rax, str.cheatengine_i386.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14001497e
add rcx, 2
sub rdx, 1
jne 0x140014965
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x16
jne 0x1400149c9
lea rax, str.cheatengine_x86_64.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400149c9
add rcx, 2
sub rdx, 1
jne 0x1400149b0
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x20
jne 0x140014a0e
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014a0e
add rcx, 2
sub rdx, 1
jne 0x1400149f5
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 7
jne 0x140014a59
lea rax, str.HxD.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014a59
add rcx, 2
sub rdx, 1
jne 0x140014a40
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x11
jne 0x140014a9e
lea rax, str.ProcessHacker.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014a9e
add rcx, 2
sub rdx, 1
jne 0x140014a85
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xb
jne 0x140014ae9
lea rax, str.procexp.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014ae9
add rcx, 2
sub rdx, 1
jne 0x140014ad0
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xd
jne 0x140014b2e
lea rax, str.wireshark.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014b2e
add rcx, 2
sub rdx, 1
jne 0x140014b15
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xb
jne 0x140014b79
lea rax, str.ollydbg.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014b79
add rcx, 2
sub rdx, 1
jne 0x140014b60
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 7
jne 0x140014bbe
lea rax, str.ida.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014bbe
add rcx, 2
sub rdx, 1
jne 0x140014ba5
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xa
jne 0x140014c09
lea rax, str.x32dbg.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014c09
add rcx, 2
sub rdx, 1
jne 0x140014bf0
jmp 0x140014838
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xa
jne 0x140014c4e
lea rax, str.x64dbg.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014838
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140014c4e
add rcx, 2
sub rdx, 1
jne 0x140014c35
jmp 0x140014838
cmp rdi, 7
lea rdx, [rsp + 0x20]
cmova rdx, rbx
cmp r9, 0xf
jne 0x140014c88
mov rcx, r15
test r9, r9
je 0x140014838
sub rdx, r15
movzx eax, word [rdx + rcx]
cmp ax, word [rcx]
jne 0x140014c88
add rcx, 2
sub r9, 1
jne 0x140014c70
jmp 0x140014838
cmp rdi, 7
jbe 0x140014cbf
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140014cb7
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014ce5
mov rcx, rbx
call fcn.140089574
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400147b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14001487e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3