Function at 0x14007dbe0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
lea rax, str.ollydbg
mov qword [rsp + 0x20], rax
lea r10, str.wireshark
lea rax, [0x1401fe780]
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x28], rax
lea r9, str.ghidra
lea rax, str.ida64
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x30], rax
lea rdx, str.radare2
lea rax, str.lordpe
mov qword [rbp - 0x58], rdx
mov qword [rsp + 0x40], rax
lea r8, str.valgrind
lea rax, str.sysser
mov qword [rbp - 0x50], r8
mov qword [rsp + 0x48], rax
lea rcx, str.softice
lea rax, str.x64dbg
mov qword [rbp - 0x40], rcx
mov qword [rsp + 0x50], rax
lea rax, str.x32dbg
mov qword [rsp + 0x58], rax
lea rax, str.cheatengine
mov qword [rsp + 0x68], rax
lea rax, str.scylla
mov qword [rsp + 0x70], rax
lea rax, str.immunitydebugger
mov qword [rsp + 0x78], rax
lea rax, str.winhex
mov qword [rbp - 0x80], rax
lea rax, str.reshacker
mov qword [rbp - 0x78], rax
lea rax, str.peid
mov qword [rbp - 0x70], rax
lea rax, str.windbg
mov qword [rbp - 0x68], rax
lea rax, str.procdump
mov qword [rbp - 0x60], rax
lea rax, str.binaryninja
mov qword [rbp - 0x48], rax
lea rax, str.trw2000
mov qword [rbp - 0x38], rax
lea rax, [0x1401fe910]
mov qword [rbp - 0x30], rax
lea rax, str.rocke
mov qword [rbp - 0x28], rax
lea rax, str.rock
mov qword [rbp - 0x20], rax
lea rax, str.drmemory
mov qword [rbp - 0x18], rax
lea rax, str.libdisasm
mov qword [rbp - 0x10], rax
lea rax, str.cutter
mov qword [rbp - 8], rax
lea rax, str.apate
mov qword [rbp], rax
lea rax, str.apate64
mov qword [rbp + 8], rax
lea rax, str.extradbg
mov qword [rbp + 0x10], rax
lea rax, str.syser
mov qword [rbp + 0x18], rax
lea rax, str.ollyadvanced
mov qword [rbp + 0x20], rax
lea rax, str.ollyext
mov qword [rbp + 0x28], rax
lea rax, str.ida_pro
mov qword [rbp + 0x30], rax
lea rax, str.ida_free
mov qword [rbp + 0x38], rax
lea rax, [0x1401fea18]
mov qword [rbp + 0x40], rax
lea rax, str.hnvd
mov qword [rbp + 0x48], rax
lea rax, str.msvsmon
mov qword [rbp + 0x50], rax
lea rax, [0x1401fea40]
mov qword [rbp + 0x58], rax
lea rax, str.lldb
mov qword [rbp + 0x60], rax
lea rax, str.radare
mov qword [rbp + 0x68], rax
lea rax, str.ollydebug
mov qword [rbp + 0x70], rax
lea rax, str.visual_studio
mov qword [rbp + 0x78], rax
lea rax, str.visualstudio
mov qword [rbp + 0x80], rax
lea rax, str.pycharm
mov qword [rbp + 0x88], rax
lea rax, str.pydebug
mov qword [rbp + 0x90], rax
lea rax, str.kali
mov qword [rbp + 0x98], rax
lea rax, str.parrot
mov qword [rbp + 0xa0], rax
lea rax, str.xpos
mov qword [rbp + 0xa8], rax
lea rax, str.xpsc
mov qword [rbp + 0xb0], rax
lea rax, str.api_monitor
mov qword [rbp + 0xb8], rax
lea rax, str.sysinternals
mov qword [rbp + 0xc0], rax
lea rax, [0x1401feb58]
mov qword [rbp + 0xc8], rax
lea rax, str.windbgx
mov qword [rbp + 0xd8], rax
lea rax, str.ollydbg2
mov qword [rbp + 0xe0], rax
lea rax, str.dnspy
mov qword [rbp + 0xe8], rax
lea rax, str.dnspy_x86
mov qword [rbp + 0xf0], rax
lea rax, str.dnspy_x64
mov qword [rbp + 0xf8], rax
lea rax, str.xray
mov qword [rbp + 0x100], rax
lea rax, str.ilspy
mov qword [rbp + 0x108], rax
lea rax, str.reflector
mov qword [rbp + 0x110], rax
lea rax, str.telerik_fiddler
mov qword [rbp + 0x118], rax
lea rax, str.telerik
mov qword [rbp + 0x120], rax
lea rax, str.fiddler
mov qword [rbp + 0x128], rax
lea rax, str.httpanalyzer
mov qword [rbp + 0x130], rax
lea rax, str.burpsuite
mov qword [rbp + 0x138], rax
lea rax, str.charles
mov qword [rbp + 0x140], rax
lea rax, str.burp
mov qword [rbp + 0x148], rax
lea rax, str.charlesproxy
mov qword [rbp + 0x150], rax
lea rax, str.mitmproxy
mov qword [rbp + 0x158], rax
lea rax, str.tcpview
mov qword [rbp + 0x160], rax
lea rax, str.procmon
mov qword [rbp + 0x168], rax
lea rax, str.processhacker
mov qword [rbp + 0x170], rax
lea rax, str.processhacker2
mov qword [rbp + 0x178], rax
lea rax, str.procexp
mov qword [rbp + 0x180], rax
lea rax, str.peexplorer
mov qword [rbp + 0x188], rax
lea rax, str.cain
mov qword [rbp + 0x1a0], rax
lea rax, str.abel
mov qword [rbp + 0xd0], rcx
lea rcx, str.petools
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x190], rcx
mov qword [rbp + 0x198], r9
lea rax, str.angr
mov qword [rbp + 0x208], rcx
mov qword [rbp + 0x1b0], rax
lea rcx, str.networkminer
lea rax, [0x1401fed94]
mov qword [rbp + 0x230], rcx
mov qword [rbp + 0x1b8], rax
lea rbx, [rsp + 0x20]
lea rax, str.dynamo
mov qword [rbp + 0x250], rcx
mov qword [rbp + 0x1c8], rax
mov ecx, 0x370
lea rax, [0x1401fedb0]
mov qword [rbp + 0x1c0], rdx
mov qword [rbp + 0x1d8], rax
lea rax, str.lida
mov qword [rbp + 0x1e0], rax
lea rax, [0x1401fedc8]
mov qword [rbp + 0x1e8], rax
lea rax, str.bfinjector
mov qword [rbp + 0x1f0], rax
lea rax, str.quarkslab
mov qword [rbp + 0x1f8], rax
lea rax, str.cyanide
mov qword [rbp + 0x200], rax
lea rax, str.kali_linux
mov qword [rbp + 0x210], rax
lea rax, str.snoopy
mov qword [rbp + 0x218], rax
lea rax, str.ethercap
mov qword [rbp + 0x220], rax
lea rax, str.tshark
mov qword [rbp + 0x238], rax
lea rax, str.suricata
mov qword [rbp + 0x240], rax
lea rax, str.zeek
mov qword [rbp + 0x248], rax
lea rax, str.glasswire
mov qword [rbp + 0x258], rax
lea rax, str.sniffer
mov qword [rbp + 0x260], rax
lea rax, str.netmon
mov qword [rbp + 0x268], rax
lea rax, str.msnetworkmonitor
mov qword [rbp + 0x270], rax
lea rax, str.tcpdump
mov qword [rbp + 0x278], rax
lea rax, str.fiddler2
mov qword [rbp + 0x280], rax
lea rax, str.httpwatch
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x1d0], r8
mov qword [rbp + 0x228], r10
call fcn.14015d5ac
mov r8d, 0x370
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call fcn.1401a2e10
xor edx, edx
lea rdi, [rsi + 0x370]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14007e209
lea rdx, [rbp + 0x290]
mov dword [rbp + 0x290], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14007e200
nop dword [rax]
mov rbx, rsi
cmp rsi, rdi
je 0x14007e1ec
nop dword [rax + rax]
mov rdx, qword [rbx]
lea rcx, [rbp + 0x2bc]
call fcn.1401824a4
test eax, eax
je 0x14007e23d
add rbx, 8
cmp rbx, rdi
jne 0x14007e1d0
lea rdx, [rbp + 0x290]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14007e1c0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
test rsi, rsi
je 0x14007e21d
mov edx, 0x370
mov rcx, rsi
call fcn.14015d5e8
lea r11, [rsp + 0x5d0]
movzx eax, bl
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x14007e20b