Function at 0x1400093a4
Capabilities:
Enumerate process modules

Disassembly:
sub rsp, 0x28
lea rbp, [0x1400c3d54]
mov dword [rbp], 0x238
mov qword [0x1400c350c], 0
push qword [0x1400c34d4]
push 8
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [0x1400c38cc], rax
cmp qword [0x1400c38cc], 0
je 0x1400096a8
movabs rax, 0x1400c3d54
push rax
push qword [0x1400c38cc]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32First
and rax, rax
je 0x14000969a
mov rax, qword [0x1400c4620]
push rax
sub rsp, 8
push rax
push qword [0x1400c34fc]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000fc50
add rsp, 0x28
inc qword [0x1400c4620]
mov rdx, qword [0x1400c4620]
push rdx
push rdx
mov rdx, qword [0x1400c4620]
push rdx
push rdx
lea rbp, [0x1400c3d54]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001d730
add rsp, 0x20
mov rdx, qword [0x1400c4630]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000fc50
add rsp, 0x20
pop rcx
pop rdx
mov qword [0x1400c4620], rdx
add rdx, qword [0x1400c4630]
add rcx, qword [0x1400c4630]
call fcn.14001e570
or rax, rax
je 0x1400095b7
lea rbp, [0x1400c3d54]
mov rax, qword [rbp + 0x18]
mov qword [0x1400c350c], rax
push qword [0x1400c4620]
sub rsp, 8
mov rcx, qword [0x1400c35cc]
push qword [0x1400c4620]
sub rsp, 0x28
call fcn.14001e410
add rsp, 0x28
movabs rcx, str.Copy.dll
sub rsp, 0x28
call fcn.14001e410
add rsp, 0x28
mov rdx, qword [0x1400c4630]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140019744
add rsp, 0x28
pop qword [0x1400c4620]
mov qword [0x1400c347c], rax
push 0x12c
pop rcx
call fcn.140013018
push qword [0x1400c4620]
sub rsp, 8
mov rcx, qword [0x1400c35cc]
push qword [0x1400c4620]
sub rsp, 0x28
call fcn.14001e410
add rsp, 0x28
movabs rcx, str.Copy.dll
sub rsp, 0x28
call fcn.14001e410
add rsp, 0x28
inc qword [0x1400c4620]
mov rdx, qword [0x1400c4620]
push rdx
push rdx
lea rax, [rbp + 0x130]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001d730
add rsp, 0x20
mov rdx, qword [0x1400c4630]
add qword [rsp], rdx
mov rdx, qword [0x1400c4630]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140019760
add rsp, 0x28
pop qword [0x1400c4620]
mov qword [0x1400c347c], rax
movabs rax, 0x1400c3d54
push rax
push qword [0x1400c38cc]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32Next
mov qword [0x1400c347c], rax
cmp qword [0x1400c347c], 0
je 0x14000968a
mov rax, qword [0x1400c4620]
push rax
sub rsp, 8
push rax
push qword [0x1400c34fc]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000fc50
add rsp, 0x28
inc qword [0x1400c4620]
mov rdx, qword [0x1400c4620]
push rdx
push rdx
mov rdx, qword [0x1400c4620]
push rdx
push rdx
lea rbp, [0x1400c3d54]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001d730
add rsp, 0x20
mov rdx, qword [0x1400c4630]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000fc50
add rsp, 0x20
pop rcx
pop rdx
mov qword [0x1400c4620], rdx
add rdx, qword [0x1400c4630]
add rcx, qword [0x1400c4630]
call fcn.14001e570
or rax, rax
je 0x14000968a
lea rbp, [0x1400c3d54]
mov rax, qword [rbp + 0x18]
mov qword [0x1400c350c], rax
mov r15, qword [0x1400c347c]
and r15, r15
jne 0x1400095b7
push qword [0x1400c38cc]
pop rcx
call sub.KERNEL32.dll_CloseHandle
jmp 0x1400096c5
movabs rax, str.CreateToolhelp32Snapshot____failed_
push rax
movabs rax, str.Error
push rax
pop rcx
pop rdx
call fcn.140012718
add rsp, 0x28
ret