Function at 0x180013058
Capabilities:
Enumerate process modules
Enumerate processes
Get file size
Get process image filename

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xb40]
sub rsp, 0xc40
mov r15, qword [rcx]
xor edx, edx
and qword [rbp + 0xb88], 0
lea rcx, [rbp + 0x54]
and dword [rbp + 0xb80], 0
mov r8d, 0x234
call sub.ntdll.dll_memset
xor edx, edx
lea rcx, [rbp + 0x930]
mov r8d, 0x208
call sub.ntdll.dll_memset
xor edx, edx
lea rcx, [rbp]
lea r8d, [rdx + 0x48]
call sub.ntdll.dll_memset
movabs rax, 0x6bc1629f3926102c
mov qword [rbp + 0xb90], r15
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0x60]
movabs rax, 0xc935ac473cdbee1
movabs rdi, 0x9c0d6af2d1d2f7fb
mov qword [rsp + 0x50], rax
movabs r13, 0x551360233190ca10
movabs rax, 0x9ead7275034fe1de
mov qword [rbp - 0x70], rdi
mov qword [rsp + 0x58], rax
movabs rbx, 0xb1f5694e331e1997
movabs rax, 0xb190690a337b19c4
mov qword [rbp - 0x68], r13
movups xmm2, xmmword [rbp - 0x70]
mov qword [rsp + 0x70], rax
mov edx, 1
movabs rax, 0x6b9162f83953104e
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x78], rax
movabs rax, 0xcfa5ab273a4be93
movups xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x80], rax
movabs rax, 0x9ec87212032ae1b2
mov qword [rbp - 0x78], rax
movups xmm1, xmmword [rbp - 0x80]
mov qword [rsp + 0x60], rdi
pxor xmm0, xmmword [rsp + 0x40]
pxor xmm1, xmmword [rsp + 0x50]
mov qword [rsp + 0x68], r13
pxor xmm2, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x40], xmm2
call fcn.180015f80
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18001356c
call fcn.1800042a4
lea rdx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x238
mov rcx, rsi
mov r14, rax
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x1800133fd
mov r13d, 0x694
movabs r15, 0x6bc1629f3926102c
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
test dword [rbp + 0x58], 0xfffffff3
mov rdi, rax
jne 0x18001320a
cmp dword [rbp + 0x58], 0xc
jne 0x1800133bf
mov r8, r13
lea rcx, [rbp + 0x290]
xor edx, edx
call sub.ntdll.dll_memset
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.DLL_lstrcpyW]
mov eax, dword [rbp + 0x58]
mov rcx, rdi
mov dword [rbp + 0x498], eax
call qword [sym.imp.KERNEL32.DLL_GetPriorityClass]
mov dword [rbp + 0x49c], eax
lea rdx, [rbp + 0x4a4]
mov eax, dword [rbp + 0x6c]
mov rcx, rdi
mov dword [rbp + 0x4a0], eax
call fcn.180016858
mov ecx, dword [rbp + 0x58]
lea rdx, [rbp + 0x508]
call qword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
xor edx, edx
lea rcx, [rbp]
lea r8d, [rdx + 0x48]
call qword [sym.imp.ntdll.dll_memset]
mov r8d, 0x48
mov dword [rbp], 0x48
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_K32GetProcessMemoryInfo]
test eax, eax
je 0x1800132aa
mov rax, qword [rbp + 0x10]
shr rax, 0xa
mov dword [rbp + 0x50c], eax
jmp 0x1800132b1
and dword [rbp + 0x50c], 0
lea r9, [rbp + 0xb80]
mov r8d, 8
lea rdx, [rbp + 0xb88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_K32EnumProcessModules]
mov r8d, 0x104
lea rdx, [rbp + 0x930]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_K32GetProcessImageFileNameW]
test eax, eax
jne 0x180013331
movabs rax, 0xb19b6925337019e2
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x10]
movabs rax, 0x6bc162f139511043
mov qword [rbp - 0x18], r15
movdqa xmm1, xmmword [rbp - 0x20]
lea rcx, [rbp + 0x514]
mov qword [rbp - 0x28], rax
movups xmm0, xmmword [rbp - 0x30]
pxor xmm1, xmm0
movdqa xmmword [rbp - 0x10], xmm1
call qword [sym.imp.KERNEL32.DLL_lstrcpyW]
jmp 0x180013344
lea rdx, [rbp + 0x514]
lea rcx, [rbp + 0x930]
call fcn.1800164bc
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x514]
and dword [rsp + 0x28], 0
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001339d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
shr eax, 0xa
mov dword [rbp + 0x510], eax
test rbx, rbx
je 0x1800133a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1800133a4
and dword [rbp + 0x510], 0
mov r8d, r13d
lea rdx, [rbp + 0x290]
mov rcx, r14
call qword [r14 + 0x28]
movabs rbx, 0xb1f5694e331e1997
test rdi, rdi
je 0x1800133cd
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rdx, [rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x1800131e3
mov r15, qword [rbp + 0xb90]
movabs rdi, 0x9c0d6af2d1d2f7fb
movabs r13, 0x551360233190ca10
mov qword [rsp + 0x60], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x68], r13
movabs rax, 0x6bc1629f3926102c
movups xmm3, xmmword [rsp + 0x60]
mov qword [rbp - 0x58], rax
xor edx, edx
movabs rax, 0xc935ac473cdbee1
mov qword [rbp - 0x60], rbx
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp - 0x50], rax
movabs rax, 0x9ead7275034fe1de
mov qword [rbp - 0x48], rax
movabs rax, 0xb190690a337b19c4
mov qword [rsp + 0x40], rax
movabs rax, 0x6b9162f83953104e
mov qword [rsp + 0x48], rax
movabs rax, 0xcfa5ab273a4be93
movups xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movabs rax, 0x9ec87212032ae1b2
mov qword [rsp + 0x58], rax
movups xmm2, xmmword [rsp + 0x50]
mov qword [rbp - 0x40], rdi
pxor xmm0, xmm1
mov qword [rbp - 0x38], r13
pxor xmm2, xmmword [rbp - 0x50]
pxor xmm3, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x50], xmm2
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x60], xmm3
call fcn.180015f80
test rsi, rsi
je 0x1800134c7
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [rbp - 0x74], 0
xorps xmm0, xmm0
and dword [rbp - 0x6c], 0
mov rcx, r14
movdqu xmmword [rsp + 0x74], xmm0
mov dword [rsp + 0x70], 0x134d74f
mov dword [rbp - 0x7c], 0x5000
mov rax, qword [r14 + 0x30]
call rax
and dword [rbp - 0x70], 0
mov dword [rbp - 0x78], eax
call fcn.1800042a4
mov r8d, 0x28
lea rdx, [rsp + 0x70]
mov rcx, rax
mov rsi, rax
call qword [rax + 0x28]
mov rdx, qword [r14 + 0x30]
mov rcx, r14
mov rdi, qword [rsi + 0x28]
call rdx
mov r8, qword [r14 + 0x38]
xor edx, edx
mov rcx, r14
mov ebx, eax
call r8
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call rdi
mov rax, qword [rsi + 0x30]
mov rcx, rsi
mov rdi, qword [r15 + 0x30]
call rax
mov r8, qword [rsi + 0x38]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call r8
mov r8d, ebx
mov rdx, rax
mov rcx, r15
call rdi
mov rcx, r14
call fcn.180004324
mov rcx, rsi
call fcn.180004324
xor eax, eax
add rsp, 0xc40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret