Function at 0x14001e1f2
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push rbp
mov rax, 0x8b
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14001e204
sub rsp, 0x28
call fcn.14003ec20
mov rdx, qword [rsp + 0x498]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14003ec90
add rsp, 0x10
mov dword [0x1400f7001], 0x2000085
mov dword [0x1400f7001], 0x2000088
lea rbp, [rsp + 0x38]
mov dword [rbp], 0x438
mov dword [0x1400f7001], 0x200008b
movsxd rax, dword [rsp + 0x490]
mov rax, rax
push rax
push 8
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
mov dword [0x1400f7001], 0x200008c
cmp qword [rsp + 0x30], 0
je 0x14001e4ac
mov dword [0x1400f7001], 0x200008d
lea rax, [rsp + 0x38]
mov rax, rax
push rax
push qword [rsp + 0x38]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32FirstW
and rax, rax
je 0x14001e48e
mov dword [0x1400f7001], 0x200008e
mov dword [0x1400f7001], 0x200008f
push rcx
sub rsp, 0x28
call fcn.14003e800
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003e800
add rsp, 0x28
pop rcx
push rax
lea rbp, [rsp + 0x50]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003d330
add rsp, 0x28
lea rcx, [rsp + 0x478]
pop rdx
call fcn.14003e8c0
mov dword [0x1400f7001], 0x2000090
push rcx
sub rsp, 0x28
call fcn.14003e800
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003e800
add rsp, 0x28
pop rcx
push rax
lea rax, [rbp + 0x230]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003d330
add rsp, 0x28
lea rcx, [0x1401422a0]
pop rdx
call fcn.14003e8c0
mov dword [0x1400f7001], 0x2000094
push rcx
sub rsp, 0x28
call fcn.14003e800
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003e800
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x488]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003c2e0
add rsp, 0x28
call fcn.14003eb50
push rcx
sub rsp, 0x20
call fcn.14003e800
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003e800
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003c2e0
add rsp, 0x20
pop rcx
sub rsp, 8
call fcn.14003eb80
add rsp, 8
mov rcx, rax
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.14003eb80
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.14003e9a0
or rax, rax
je 0x14001e44c
mov dword [0x1400f7001], 0x2000096
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f7001], 0x2000097
lea rbp, [rsp + 0x38]
mov rax, qword [rbp + 0x18]
jmp 0x14001e4d2
mov dword [0x1400f7001], 0x2000098
mov dword [0x1400f7001], 0x2000099
lea rax, [rsp + 0x38]
mov rax, rax
push rax
push qword [rsp + 0x38]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32NextW
and rax, rax
je 0x14001e47e
xor rax, rax
jmp 0x14001e485
mov rax, 1
and rax, rax
je 0x14001e2bc
mov dword [0x1400f7001], 0x200009a
mov dword [0x1400f7001], 0x200009b
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f7001], 0x200009c
mov dword [0x1400f7001], 0x200009e
xor rax, rax
jmp 0x14001e4d2
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14003ed00
add rsp, 0x28
mov rcx, qword [rsp + 0x478]
sub rsp, 0x28
call fcn.14003ed00
add rsp, 0x28
pop rax
add rsp, 0x480
pop rbp
ret