Function at 0x14000be70
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1400940a8]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000beb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateToolhelp32Snapshot_failed._Error:__d_n
call fcn.14000f330
jmp 0x14000bef8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000c08e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14000bf11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Process32First_failed._Error:__d_n
call fcn.14000f330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140072c30
add rsp, 0x160
pop rbx
ret
lea rdx, str.Beamer.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x14000c070
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000bf11
lea rdx, str.Beamer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000c08e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000be9e
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000c0d0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000bedb
nop
lea rdx, str.ProcessHacker.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x14000c0b5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000bfa0
lea rdx, str.ProcessHacker.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000c0d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000be9e
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000c094
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000bedb
nop
lea rdx, str.ida64.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x14000c09a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000c030
lea rdx, str.ida64.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000c094
jmp 0x14000beef
lea rcx, str.x64dbg.exe_is_running_n
call fcn.14000f330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400072b0
int3
call fcn.1400072b0
int3
lea rcx, str.ida64.exe_is_running_n
call fcn.14000f330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400072b0
int3
lea rcx, str.x64dbg.exe_is_running_n
call fcn.14000f330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400072b0
int3
call fcn.1400072b0
int3