Function at 0x140014570
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x1400af0c0]
xor rax, rsp
mov qword [rbp + 0x280], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400148ac
lea rax, str.ollydbg
mov qword [rbp + 0x180], rax
lea rbx, [rbp + 0x180]
lea rax, [0x14009f4c8]
mov qword [rbp + 0x188], rax
lea rax, str.ida32
mov qword [rbp + 0x190], rax
lea rax, str.ida64
mov qword [rbp + 0x198], rax
lea rax, str.ollydbg.exe
mov qword [rbp + 0x1a0], rax
lea rax, str.ida.exe
mov qword [rbp + 0x1a8], rax
lea rax, str.idaq.exe
mov qword [rbp + 0x1b0], rax
lea rax, str.idaq64.exe
mov qword [rbp + 0x1b8], rax
lea rax, str.idaq32.exe
mov qword [rbp + 0x1c0], rax
lea rax, str.immunity
mov qword [rbp + 0x1c8], rax
lea rax, str.windbg
mov qword [rbp + 0x1d0], rax
lea rax, str.x64dbg
mov qword [rbp + 0x1d8], rax
lea rax, str.x32dbg
mov qword [rbp + 0x1e0], rax
lea rax, str.dbg64
mov qword [rbp + 0x1e8], rax
lea rax, str.dbg32
mov qword [rbp + 0x1f0], rax
lea rax, [0x14009f5c8]
mov qword [rbp + 0x1f8], rax
lea rax, [0x14009f5d0]
mov qword [rbp + 0x200], rax
lea rax, str.scylla
mov qword [rbp + 0x208], rax
lea rax, str.scylla_x64
mov qword [rbp + 0x210], rax
lea rax, str.scylla_x86
mov qword [rbp + 0x218], rax
lea rax, str.x96dbg
mov qword [rbp + 0x220], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x228], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x230], rax
lea rax, str.Cheat_Engine
mov qword [rbp + 0x238], rax
lea rax, str.fiddler
mov qword [rbp + 0x240], rax
lea rax, str.charles
mov qword [rbp + 0x248], rax
lea rax, str.wireshark
mov qword [rbp + 0x250], rax
lea rax, str.netmon
mov qword [rbp + 0x258], rax
lea rax, str.procmon
mov qword [rbp + 0x260], rax
lea rax, str.import_reconstructor
mov qword [rbp + 0x268], rax
lea rax, str.Registry_Editor
mov qword [rbp + 0x270], rax
nop
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x1400148ac
add rbx, 8
lea rax, [rbp + 0x278]
cmp rbx, rax
jne 0x140014770
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140014d05
xor r14d, r14d
lea r12, str.taskmgr.exe
lea r13, str.procmon.exe
lea r15, str.cheatengine.exe
nop dword [rax + rax]
xorps xmm0, xmm0
mov qword [rsp + 0x30], r14
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x140014800
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140012a00
mov rdi, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
cmp rdi, 7
mov r9, qword [rsp + 0x30]
cmova r8, rbx
cmp r9, 0xb
jne 0x1400148de
mov rdx, r9
mov rcx, r12
test r9, r9
je 0x140014868
sub r8, r12
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400148de
add rcx, 2
sub rdx, 1
jne 0x140014850
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 7
jbe 0x1400148ac
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400148a4
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014d15
mov rcx, rbx
call fcn.140089ab4
mov al, 1
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140089a50
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xb
jne 0x14001491c
mov rdx, r9
mov rcx, r13
test r9, r9
je 0x140014868
sub r8, r13
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14001491c
add rcx, 2
sub rdx, 1
jne 0x140014903
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x10
jne 0x140014969
lea rax, str.Cheat_Engine.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
nop dword [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140014969
add rcx, 2
sub rdx, 1
jne 0x140014950
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x14
jne 0x1400149ae
lea rax, str.cheatengine_i386.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400149ae
add rcx, 2
sub rdx, 1
jne 0x140014995
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x16
jne 0x1400149f9
lea rax, str.cheatengine_x86_64.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400149f9
add rcx, 2
sub rdx, 1
jne 0x1400149e0
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x20
jne 0x140014a3e
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014a3e
add rcx, 2
sub rdx, 1
jne 0x140014a25
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 7
jne 0x140014a89
lea rax, str.HxD.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014a89
add rcx, 2
sub rdx, 1
jne 0x140014a70
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0x11
jne 0x140014ace
lea rax, str.ProcessHacker.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014ace
add rcx, 2
sub rdx, 1
jne 0x140014ab5
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xb
jne 0x140014b19
lea rax, str.procexp.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014b19
add rcx, 2
sub rdx, 1
jne 0x140014b00
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xd
jne 0x140014b5e
lea rax, str.wireshark.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014b5e
add rcx, 2
sub rdx, 1
jne 0x140014b45
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xb
jne 0x140014ba9
lea rax, str.ollydbg.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014ba9
add rcx, 2
sub rdx, 1
jne 0x140014b90
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 7
jne 0x140014bee
lea rax, str.ida.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014bee
add rcx, 2
sub rdx, 1
jne 0x140014bd5
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xa
jne 0x140014c39
lea rax, str.x32dbg.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140014c39
add rcx, 2
sub rdx, 1
jne 0x140014c20
jmp 0x140014868
cmp rdi, 7
lea r8, [rsp + 0x20]
cmova r8, rbx
cmp r9, 0xa
jne 0x140014c7e
lea rax, str.x64dbg.exe
mov rdx, r9
mov rcx, rax
test r9, r9
je 0x140014868
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140014c7e
add rcx, 2
sub rdx, 1
jne 0x140014c65
jmp 0x140014868
cmp rdi, 7
lea rdx, [rsp + 0x20]
cmova rdx, rbx
cmp r9, 0xf
jne 0x140014cb8
mov rcx, r15
test r9, r9
je 0x140014868
sub rdx, r15
movzx eax, word [rdx + rcx]
cmp ax, word [rcx]
jne 0x140014cb8
add rcx, 2
sub r9, 1
jne 0x140014ca0
jmp 0x140014868
cmp rdi, 7
jbe 0x140014cef
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140014ce7
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014d15
mov rcx, rbx
call fcn.140089ab4
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400147e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400148ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3