Function at 0x1400016b0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x140015010]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x1a0], 0x130
xor r15d, r15d
mov edi, r15d
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000174d
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rbp + 0x1cc]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140001747
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x14000171a
mov edi, dword [rbp + 0x1a8]
mov edx, edi
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1400017a8
nop word [rax + rax]
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x1400017a8
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140001780
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
mov ecx, dword [rsp + 0x60]
mov edi, ecx
movdqu xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
test ecx, ecx
je 0x14000183b
cmp rcx, 0x1000
jb 0x14000180c
add rcx, 0x27
cmp rcx, rdi
jbe 0x140001a52
call fcn.14000d790
mov rcx, rax
test rax, rax
je 0x14000190e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001811
call fcn.14000d790
mov qword [rbp + 0x180], rax
lea rbx, [rax + rdi]
mov qword [rbp + 0x190], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x188], rbx
mov ecx, dword [rsp + 0x60]
mov r9d, ecx
mov qword [rsp + 0x20], r15
mov r8, qword [rbp + 0x180]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, r15d
mov r11d, dword [rsp + 0x60]
test r11d, r11d
je 0x1400018c1
mov r10, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, r10
sar rdx, 2
mov r9, qword [rbp + 0x180]
nop word [rax + rax]
mov rcx, r15
test rdx, rdx
je 0x1400018b7
nop dword [rax + rax]
cmp rdx, rcx
jbe 0x140001a4c
mov r8d, dword [r10 + rcx*4]
cmp r8d, 0xffffffff
je 0x1400018ad
movzx eax, byte [r9 + rcx]
cmp r8d, eax
jne 0x1400018b7
inc rcx
cmp rcx, rdx
je 0x140001915
jb 0x140001890
inc ebx
inc r9
cmp ebx, r11d
jb 0x140001880
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x1400019d3
mov rdx, qword [rbp + 0x190]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rbx, ebx
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x14000196f
mov rdx, qword [rbp + 0x190]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001958
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000190e
call fcn.14000da1c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400019b7
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x1400019a7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140001a45
mov rcx, r8
call fcn.14000da1c
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
mov rax, rbx
jmp 0x140001a19
call fcn.14000da1c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
mov rcx, qword [rsi]
test rcx, rcx
je 0x140001a17
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140001a07
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a45
mov rcx, r8
call fcn.14000da1c
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
xor eax, eax
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.14000d770
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000c660
nop
call fcn.140001210
int3