Function at 0x140003ed0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2260]
mov eax, 0x2360
call fcn.140073ae0
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x23b0], rbx
mov rax, qword [0x1400a3008]
xor rax, rsp
mov qword [rbp + 0x2250], rax
mov r13, rcx
cmp dword [rcx + 0x17c], 0
jne 0x140004585
mov qword [rbp - 0x70], 0xf
xor ebx, ebx
mov qword [rbp - 0x78], rbx
mov byte [rsp + 0x78], bl
cmp byte [rdx], bl
jne 0x140003f3e
mov r8d, ebx
jmp 0x140003f4b
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], bl
jne 0x140003f42
lea rcx, [rsp + 0x78]
call fcn.140002500
nop
mov eax, 1
mov r8, qword [rbp - 0x78]
test r8, r8
je 0x1400044d8
lea r14, [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x70]
cmp rcx, 0x10
cmovae r14, rdx
lea rax, [rsp + 0x78]
cmovae rax, rdx
add rax, r8
lea rsi, [rsp + 0x78]
cmp rcx, 0x10
cmovae rsi, rdx
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, rbx
test rdi, rdi
je 0x140003fc7
nop dword [rax]
movsx ecx, byte [rbx + rsi]
call fcn.14005ff94
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jne 0x140003fb0
xor ebx, ebx
mov r8d, dword [r13 + 0x70]
xor edx, edx
mov ecx, 0x1410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140004492
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x2030]
call fcn.14005db90
mov dword [rsp + 0x44], 0x104
xor r12b, r12b
lea r9, [rsp + 0x44]
lea r8, [rbp + 0x2030]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
cmp byte [rbp + 0x2030], r12b
je 0x140004485
lea rax, [rbp - 0x58]
mov qword [rbp - 0x60], rax
lea rax, [rbp + 0x2030]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140004040
inc ebx
lea r8, [rbp - 0x58]
mov edx, ebx
lea rcx, [rbp - 0x60]
call fcn.140002d00
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp + 0x2030]
mov rcx, qword [rbp - 0x60]
call fcn.140001490
test eax, eax
je 0x1400040a9
cmp eax, 0xc
je 0x14000409e
cmp eax, 0x16
je 0x140004093
cmp eax, 0x22
je 0x140004093
cmp eax, 0x50
je 0x1400040a9
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
nop
mov qword [rsp + 0x70], 0xf
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x58], bl
mov rdx, qword [rbp - 0x60]
cmp byte [rdx], bl
jne 0x1400040ca
mov r8d, ebx
jmp 0x1400040d9
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], bl
jne 0x1400040d0
lea rcx, [rsp + 0x58]
call fcn.140002500
nop
lea rax, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x1400040f6
call fcn.14005fb6c
lea r14, [rsp + 0x58]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
cmovae r14, r8
lea rcx, [rsp + 0x58]
cmovae rcx, r8
mov rax, qword [rsp + 0x68]
add rax, rcx
lea rsi, [rsp + 0x58]
cmp rdx, 0x10
cmovae rsi, r8
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, rbx
test rdi, rdi
je 0x140004155
nop dword [rax]
movsx ecx, byte [rbx + rsi]
call fcn.14005ff94
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jne 0x140004140
mov r9d, 0xb
lea rdx, str.wwahost.exe
lea rcx, [rsp + 0x58]
call fcn.140005af0
movzx ebx, r12b
cmp rax, 0xffffffffffffffff
mov eax, 1
cmovne ebx, eax
lea rcx, [rsp + 0x58]
call fcn.140002380
test bl, bl
je 0x140004485
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x40]
mov r8d, 0x2000
lea rdx, [rbp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
mov r12d, ebx
cmp dword [r13 + 0x17c], ebx
jne 0x140004485
mov eax, dword [rsp + 0x40]
shr eax, 3
cmp r12d, eax
jae 0x140004485
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x2140]
call fcn.14005db90
mov edx, r12d
mov r9d, 0x104
lea r8, [rbp + 0x2140]
mov rdx, qword [rbp + rdx*8 + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x140004454
cmp byte [rbp + 0x2140], 0
je 0x140004454
lea rax, [rbp - 0x58]
mov qword [rbp - 0x60], rax
lea rax, [rbp + 0x2140]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140004230
inc ebx
lea r8, [rbp - 0x58]
mov edx, ebx
lea rcx, [rbp - 0x60]
call fcn.140002d00
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp + 0x2140]
mov rcx, qword [rbp - 0x60]
call fcn.140001490
test eax, eax
je 0x140004288
cmp eax, 0xc
je 0x14000447a
cmp eax, 0x16
je 0x14000446f
cmp eax, 0x22
je 0x14000446f
cmp eax, 0x50
jne 0x140004464
mov qword [rsp + 0x70], 0xf
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov byte [rsp + 0x58], r15b
mov rdx, qword [rbp - 0x60]
cmp byte [rdx], r15b
jne 0x1400042ac
mov r8d, r15d
jmp 0x1400042b9
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r15b
jne 0x1400042b0
lea rcx, [rsp + 0x58]
call fcn.140002500
nop
lea rax, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x1400042d6
call fcn.14005fb6c
lea r14, [rsp + 0x58]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x70]
cmp r9, 0x10
cmovae r14, r8
lea rax, [rsp + 0x58]
cmovae rax, r8
mov rbx, qword [rsp + 0x68]
add rax, rbx
lea rsi, [rsp + 0x58]
cmp r9, 0x10
cmovae rsi, r8
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, r15
test rdi, rdi
je 0x140004344
mov rbx, r15
movsx ecx, byte [rbx + rsi]
call fcn.14005ff94
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jne 0x140004320
mov r9, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
mov r15, qword [rbp - 0x78]
lea r14, [rsp + 0x78]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
cmovae r14, rcx
test r15, r15
je 0x1400043f8
test rbx, rbx
je 0x140004445
cmp r15, rbx
ja 0x140004445
sub rbx, r15
inc rbx
lea rsi, [rsp + 0x58]
cmp r9, 0x10
cmovae rsi, r8
nop dword [rax]
test rbx, rbx
je 0x140004445
movsx edx, byte [r14]
mov r8, rbx
mov rcx, rsi
call fcn.14005d7f4
mov rdi, rax
test rax, rax
je 0x140004445
mov r8, r15
mov rdx, r14
mov rcx, rax
call fcn.140073cb0
test eax, eax
je 0x1400043d5
sub rsi, rdi
dec rsi
add rbx, rsi
lea rsi, [rdi + 1]
jmp 0x140004390
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rax, qword [rsp + 0x58]
sub rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x140004445
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rsp + 0x78]
mov dword [r13 + 0x17c], 2
lea rax, [rsp + 0x78]
cmp rdx, 0x10
cmovae rax, rcx
mov qword [rsp + 0x30], rax
lea rax, str._s_module_is_in_memory.
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 5]
lea r8, [0x1400a73c8]
mov edx, 0x1ad
lea rcx, str...SharedAudioSession.cpp
call fcn.140002f50
nop
lea rcx, [rsp + 0x58]
call fcn.140002380
mov r15, qword [rsp + 0x48]
inc r12d
cmp dword [r13 + 0x17c], 0
jmp 0x1400041be
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x1400044d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
mov eax, dword [r13 + 0x70]
mov dword [rsp + 0x30], eax
lea rax, str.Failed_to_open_a_process___d___Error_code___d.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, 5
lea r8, [0x1400a73c8]
mov edx, 0x1b9
lea rcx, str...SharedAudioSession.cpp
call fcn.140002f50
mov eax, 1
cmp dword [r13 + 0x17c], 0
jne 0x14000452e
mov dword [r13 + 0x17c], eax
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, str._s_module_is_not_in_memory.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, 5
lea r8, [0x1400a73c8]
mov edx, 0x1c0
lea rcx, str...SharedAudioSession.cpp
call fcn.140002f50
nop
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x140004585
inc rax
mov rcx, qword [rsp + 0x78]
cmp rax, 0x1000
jb 0x140004580
test cl, 0x1f
je 0x140004553
call fcn.14005f9bc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140004562
call fcn.14005f9bc
int3
sub rcx, rax
cmp rcx, 8
jae 0x140004571
call fcn.14005f9bc
int3
cmp rcx, 0x27
jbe 0x14000457d
call fcn.14005f9bc
int3
mov rcx, rax
call fcn.14003ccec
cmp dword [r13 + 0x17c], 2
sete al
mov rcx, qword [rbp + 0x2250]
xor rcx, rsp
call fcn.14003cd10
mov rbx, qword [rsp + 0x23b0]
add rsp, 0x2360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret