Function at 0x140006020
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x14004a100]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r15, rcx
xor ebx, ebx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400060b2
lea rdx, str.Chyba_pri_vytvoreni_snimku_procesu.
lea rcx, [0x14004b8e0]
call fcn.14000bfb0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14000be00
movzx edx, al
mov rcx, rbx
call fcn.14000db10
mov rcx, rbx
call fcn.14000d670
jmp 0x1400067f1
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400067e8
nop
lea rdx, str.ProcessHacker.exe
lea rcx, [rbp + 0x5c]
call fcn.1400178cc
test eax, eax
je 0x140006136
lea rdx, str.Aimbot.exe
lea rcx, [rbp + 0x5c]
call fcn.1400178cc
test eax, eax
je 0x140006136
lea rdx, str.aimbot.exe
lea rcx, [rbp + 0x5c]
call fcn.1400178cc
test eax, eax
je 0x140006136
lea rdx, str.ptm.exe
lea rcx, [rbp + 0x5c]
call fcn.1400178cc
test eax, eax
je 0x140006136
lea rdx, [rbp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400060d0
jmp 0x1400067e8
lea rcx, [rbp + 8]
call fcn.140002fe0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rbp + 0x5c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140006160
lea rdx, [rbp + 0x5c]
lea rcx, [rsp + 0x20]
call fcn.14000cb20
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x18]
call fcn.140002e30
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x1400061cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006833
call fcn.140011680
movdqa xmm0, xmmword [0x1400433d0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], bx
mov r14, qword [rbp - 8]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 9
jb 0x140006839
lea r13, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova r13, qword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r12, [r14 + 9]
mov ebx, 0xf
lea rdi, [rsp + 0x40]
movabs rdx, 0x8000000000000000
mov eax, 0x16
cmp r12, rbx
jbe 0x1400062a8
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000626f
mov rbx, rcx
lea rax, [rdx + 0x27]
mov rcx, rax
call fcn.140011928
test rax, rax
je 0x14000683f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400062a3
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140006283
xor edi, edi
jmp 0x1400062a3
cmp rcx, 0x1000
jb 0x14000629b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006827
jmp 0x140006250
call fcn.140011928
mov rdi, rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
movsd xmm0, qword [0x140042d38]
movsd qword [rdi], xmm0
movzx ecx, byte [0x140042d40]
mov byte [rdi + 8], cl
lea rcx, [rdi + 9]
mov r8, r14
mov rdx, r13
call fcn.1400340f0
mov byte [rdi + r12], 0
mov r8d, 0x16
lea rdx, str.___Verejna_IP_adresa:
lea rcx, [rsp + 0x40]
call fcn.14000bc00
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rdx, qword [rbp + 8]
mov r8, qword [rbp + 0x18]
lea rcx, [rbp - 0x80]
call fcn.14000bc00
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400063a6
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006845
call fcn.140011680
movdqa xmm0, xmmword [0x1400433e0]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400063fc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000684b
call fcn.140011680
movdqa xmm0, xmmword [0x1400433e0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140006414
mov rdx, qword [r15]
lea rcx, [rbp - 0x38]
mov rbx, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x20]
cmp rdi, 0xf
cmova rcx, rbx
mov r14, qword [rbp - 0x28]
cmp r14, qword [r15 + 0x10]
jne 0x14000644b
test r14, r14
je 0x14000671f
mov r8, r14
call fcn.140034bd0
test eax, eax
je 0x14000671f
cmp dword [0x14004d440], 1
jne 0x140006496
lea rdx, [rbp - 0x38]
cmp rdi, 0xf
cmova rdx, rbx
mov r8, r14
lea rcx, [0x14004b8e0]
call fcn.14000e060
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14000be00
movzx edx, al
mov rcx, rbx
call fcn.14000db10
mov rcx, rbx
call fcn.14000d670
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
mov r8d, 0xc
lea rdx, str.ProcesDetect
lea rcx, [rbp - 0x58]
call fcn.14000cc50
nop
mov r13, qword [rbp - 8]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 9
jb 0x140006851
lea r12, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova r12, qword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r14, [r13 + 9]
mov ebx, 0xf
lea rdi, [rsp + 0x60]
cmp r14, rbx
jbe 0x140006587
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140006548
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140011928
test rax, rax
je 0x14000685d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140006582
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140006562
xor edi, edi
jmp 0x140006582
cmp rcx, 0x1000
jb 0x14000657a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000682d
jmp 0x140006529
call fcn.140011928
mov rdi, rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
movsd xmm0, qword [0x140042d38]
movsd qword [rdi], xmm0
movzx ecx, byte [0x140042d40]
mov byte [rdi + 8], cl
lea rcx, [rdi + 9]
mov r8, r13
mov rdx, r12
call fcn.1400340f0
mov byte [rdi + r14], 0
mov r8d, 8
lea rdx, str._nalezen
lea rcx, [rsp + 0x60]
call fcn.14000bc00
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
lea r8, [rbp - 0x58]
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x20]
call fcn.140003630
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140006656
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006651
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006857
call fcn.140011680
movdqa xmm0, xmmword [0x1400433e0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400066ae
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000685d
call fcn.140011680
movdqa xmm0, xmmword [0x1400433e0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x1400066f4
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006863
call fcn.140011680
lea rax, [rbp - 0x38]
cmp r15, rax
je 0x140006717
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
mov rcx, r15
call fcn.14000baa0
mov rbx, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x20]
cmp rdi, 0xf
jbe 0x140006756
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000674e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006869
mov rcx, rbx
call fcn.140011680
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400067a1
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000679c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000686f
call fcn.140011680
mov qword [rbp - 8], r12
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x1400067e8
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006821
call fcn.140011680
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140011660
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001ba50
nop
call fcn.140001850
nop
call fcn.140001850
nop
call fcn.14001ba50
int3
call fcn.1400018f0
int3
call fcn.14001ba50
nop
call fcn.14001ba50
nop
call fcn.14001ba50
nop
call fcn.1400018f0
nop
call fcn.14001ba50
nop
call fcn.14001ba50
nop
call fcn.14001ba50
nop
call fcn.14001ba50
nop
call fcn.14001ba50
int3