Function at 0x140007290
Capabilities:
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x480
mov rax, qword [0x140026080]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
cmp dword [0x140026894], 0
jne 0x140007535
mov qword [rsp + 0x490], rbx
mov rbx, 0xffffffffffffffff
test rdi, rdi
je 0x14000740c
mov qword [rsp + 0x498], rbp
lea rcx, [rsp + 0x24]
mov qword [rsp + 0x4a0], rsi
xor edx, edx
mov r8d, 0x234
mov qword [rsp + 0x4a8], r14
call sub.VCRUNTIME140.dll_memset
mov esi, ebx
mov dword [rsp + 0x20], 0x238
mov r14d, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebp, eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000735f
cmp dword [rsp + 0x28], ebp
je 0x14000735b
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140007342
jmp 0x14000735f
mov esi, dword [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
mov rbp, qword [rsp + 0x498]
test eax, eax
je 0x1400073af
cmp dword [rsp + 0x28], esi
je 0x140007391
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140007378
jmp 0x1400073af
mov r14d, dword [rsp + 0x40]
lea rdx, [rsp + 0x4c]
mov r8d, 0x104
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
mov rsi, qword [rsp + 0x4a0]
test eax, eax
je 0x1400073fb
cmp dword [rsp + 0x28], r14d
je 0x1400073e2
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400073c8
jmp 0x1400073fb
mov r8d, 0x104
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x4a8]
lea rcx, [rsp + 0x260]
mov dword [0x140026894], 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
lea r8, str.firefox.exe
xor edx, edx
nop dword [rax]
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x14000747f
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x14000747f
add rdx, 2
cmp rdx, 0xc
jne 0x140007430
mov dword [0x140026038], 0
xor eax, eax
mov rbx, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140019140
add rsp, 0x480
pop rdi
ret
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
lea r9, str.chrome.exe
mov rdx, rbx
mov r8, rax
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x1400074c4
add rdx, 2
cmp rdx, 0xb
je 0x14000750d
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x1400074a0
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov rdx, rax
lea r8, str.msedge.exe
nop dword [rax]
movzx ecx, word [rdx + rbx*2 + 2]
cmp cx, word [r8 + rbx*2 + 2]
jne 0x140007502
add rbx, 2
cmp rbx, 0xb
je 0x140007521
movzx eax, word [rdx + rbx*2]
cmp ax, word [r8 + rbx*2]
je 0x1400074e0
mov eax, dword [0x140026038]
jmp 0x14000745e
mov dword [0x140026038], 1
mov eax, 1
jmp 0x14000745e
mov dword [0x140026038], 2
mov eax, 2
jmp 0x14000745e
mov eax, dword [0x140026038]
jmp 0x140007466