Function at 0x14006de30
Capabilities:
Enumerate process modules

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
movaps xmmword [r11 - 0x38], xmm6
mov rax, qword [0x1402bf200]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
mov rax, rcx
mov qword [rsp + 0xa0], rcx
xor r15d, r15d
mov r12d, r15d
mov dword [rsp + 0x50], r15d
mov rax, qword [rcx + 8]
cmp byte [rax + 0x70], r15b
je 0x14006e25e
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14032a4e8], eax
jle 0x14006df96
lea rcx, [0x14032a4e8]
call fcn.14019b210
cmp dword [0x14032a4e8], 0xffffffff
jne 0x14006df96
call fcn.1400455d0
lea rcx, str.ToolsSvc.exe
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0x168], 0xe
lea rcx, [rax + 0x50]
cmp qword [rax + 0x68], 7
jbe 0x14006defd
mov rcx, qword [rax + 0x50]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x68], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x90], xmm0
movaps xmm1, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xd0], xmm1
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xd0]
lea rcx, [0x14032a4f0]
call fcn.1400150d0
mov r12d, 2
mov dword [rsp + 0x50], r12d
lea rcx, [0x140202e40]
call fcn.14019af00
nop
lea rcx, [0x14032a4e8]
call fcn.14019b1a0
lea rdx, [0x14032a4f0]
lea rcx, [rsp + 0x100]
call fcn.140024420
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x130], xmm1
mov r8d, 0xd
lea rdx, str.aswEngSrv.exe
lea rcx, [rsp + 0x120]
call fcn.14002a920
nop
mov qword [rsp + 0x148], r15
mov qword [rsp + 0x150], r15
mov ecx, 0x40
call fcn.14019af70
mov r14, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x148], rax
lea rsi, [rsp + 0x100]
movabs r13, 0x3ffffffffffffff
nop word [rax + rax]
mov r9, rsi
mov r8, r14
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x148]
call fcn.1400710c0
movups xmm6, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x70], xmm0
cmp byte [rsp + 0x70], 0
jne 0x14006e0dc
cmp qword [rsp + 0x150], r13
je 0x14006e76e
mov rbx, qword [rsp + 0x148]
lea rax, [rsp + 0x148]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
mov ecx, 0x40
call fcn.14019af70
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax + 0x20]
mov rdx, rsi
call fcn.140024420
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov word [rdi + 0x18], 0
mov qword [rsp + 0x48], r15
movaps xmmword [rsp + 0x90], xmm6
mov r8, rdi
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x148]
call fcn.14000a290
add rsi, 0x20
lea rax, [rsp + 0x140]
cmp rsi, rax
jne 0x14006e030
lea r9, [fcn.1400026b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rsp + 0x100]
call fcn.14019b9c0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x170], xmm1
mov qword [rsp + 0x180], r15
mov ecx, 0x800
call fcn.14002aac0
mov qword [rsp + 0x170], rax
lea rbx, [rax + 0x800]
mov qword [rsp + 0x180], rbx
xor edx, edx
mov r8d, 0x800
mov rcx, rax
call fcn.1401d80e0
mov qword [rsp + 0x178], rbx
mov rsi, qword [rsp + 0x170]
nop dword [rax]
nop word [rax + rax]
sub rbx, rsi
sar rbx, 2
lea edx, [rbx*4]
lea r8, [rsp + 0x140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14006e290
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x160], 0x35383841
mov dword [rsp + 0x164], 0x36323642
movsd xmm0, qword [str.dump]
movsd qword [rsp + 0xb0], xmm0
mov eax, dword [0x14023c298]
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0xbc], rax
mov dword [rsp + 0xc4], 0x199
lea rax, str.Unable_to_enumerate_processes__error_code_
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x2c
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb0]
call fcn.140066880
nop
lea rcx, [rsp + 0x170]
call fcn.1400495e0
nop
mov r8, qword [rsp + 0x148]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x148]
call fcn.14003ca20
mov edx, 0x40
mov rcx, qword [rsp + 0x148]
call fcn.14019af20
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.14019acb0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, dword [rsp + 0x140]
shr eax, 2
mov dword [rsp + 0x140], eax
mov rbx, qword [rsp + 0x178]
mov rcx, rbx
mov rsi, qword [rsp + 0x170]
sub rcx, rsi
sar rcx, 2
cmp rcx, rax
jbe 0x14006e6f4
lea r14, [rsi + rax*4]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x178], r14
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xa8], rsi
cmp rsi, r14
je 0x14006e21d
mov r13d, dword [rsi]
mov dword [rsp + 0x5c], r13d
mov r8d, r13d
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x160], rax
test rax, rax
jne 0x14006e31f
add rsi, 4
jmp 0x14006e2e0
mov dword [rsp + 0x140], 0x104
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x188]
call fcn.140028660
nop
lea r8, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 7
cmova r8, qword [rsp + 0x188]
lea r9, [rsp + 0x140]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x14006e391
lea rcx, [rsp + 0x188]
call fcn.14002adf0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 4
jmp 0x14006e2e0
mov ecx, dword [rsp + 0x140]
mov r8, qword [rsp + 0x198]
cmp rcx, r8
ja 0x14006e3ce
lea rax, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 7
cmova rax, qword [rsp + 0x188]
mov qword [rsp + 0x198], rcx
mov word [rax + rcx*2], r15w
jmp 0x14006e43e
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rsp + 0x1a0]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x14006e422
mov qword [rsp + 0x198], rcx
lea r9, [rsp + 0x188]
cmp rdi, 7
cmova r9, qword [rsp + 0x188]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14006e417
movzx eax, r15w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r15w
jmp 0x14006e43e
mov word [rsp + 0x20], r15w
mov r9, rdx
movzx r8d, byte [rsp + 0x58]
lea rcx, [rsp + 0x188]
call fcn.14002a180
mov dword [rsp + 0x54], r15d
mov rcx, rbx
call fcn.14004a150
mov edi, eax
mov dword [rsp + 0x54], eax
jmp 0x14006e484
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, eax
je 0x14006e5cc
lea r14, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 7
cmova r14, qword [rsp + 0x188]
mov qword [rsp + 0xd0], r14
mov rdi, qword [rsp + 0x198]
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x20], 2
lea r9, [0x140240d50]
mov rdx, rdi
mov rcx, r14
call fcn.140058140
cmp rax, 0xffffffffffffffff
je 0x14006e520
inc rax
cmp rdi, rax
jb 0x14006e774
sub rdi, rax
mov rcx, 0xffffffffffffffff
cmp rdi, rcx
cmovb rcx, rdi
lea rax, [r14 + rax*2]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rcx
lea rdx, [rsp + 0xe8]
jmp 0x14006e539
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0xb0], xmm0
lea rdx, [rsp + 0xb0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x60]
call fcn.14002a920
or r12d, 4
or r12d, 1
mov dword [rsp + 0x50], r12d
mov r14, qword [rsp + 0x148]
mov rdi, qword [r14 + 8]
cmp byte [rdi + 0x19], 0
jne 0x14006e5a4
nop dword [rax + rax]
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x60]
call fcn.140070fe0
test al, al
je 0x14006e598
mov rdi, qword [rdi + 0x10]
jmp 0x14006e59e
mov r14, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x14006e580
cmp byte [r14 + 0x19], 0
jne 0x14006e5c7
lea r8, [r14 + 0x20]
lea rdx, [rsp + 0x60]
call fcn.140070fe0
test al, al
jne 0x14006e5c7
cmp r14, qword [rsp + 0x148]
jne 0x14006e5cc
mov dil, 1
jmp 0x14006e5cf
xor dil, dil
test r12b, 1
je 0x14006e5e8
and r12d, 0xfffffffe
mov dword [rsp + 0x50], r12d
lea rcx, [rsp + 0x60]
call fcn.14002adf0
test dil, dil
jne 0x14006e6cc
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
lea r9, str.Cause:_Process_watcher__connected_to_previous_dump
xor r8d, r8d
xor edx, edx
mov rax, qword [rax + 0x58]
call qword [case.0x1400617cf.0]
test eax, eax
je 0x14006e6cc
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], r13d
lea r9, str.Cause:_Process_watcher__connected_to_previous_dump
xor r8d, r8d
xor edx, edx
mov rax, qword [rax + 0x50]
call qword [case.0x1400617cf.0]
test eax, eax
je 0x14006e6cc
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x40], 0x35383841
mov dword [rsp + 0x44], 0x36323642
movsd xmm0, qword [str.dump]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x14023c298]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x6c], rax
mov dword [rsp + 0x74], 0x1c5
lea rax, str.Connected_process_dump_unsuccessful__error_code_
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0x32
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x60]
mov ecx, 7
call fcn.14006c050
nop
lea rcx, [rsp + 0x188]
call fcn.14002adf0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x80]
add rsi, 4
jmp 0x14006e2e0
add eax, 0xa
mov edi, eax
cmp rdi, rcx
jae 0x14006e70f
lea rbx, [rsi + rax*4]
mov qword [rsp + 0x178], rbx
jmp 0x14006e170
jbe 0x14006e170
mov rax, qword [rsp + 0x180]
sub rax, rsi
sar rax, 2
cmp rdi, rax
jbe 0x14006e746
mov rdx, rdi
lea rcx, [rsp + 0x170]
call fcn.140070d60
mov rbx, qword [rsp + 0x178]
jmp 0x14006e15b
sub rdi, rcx
lea rdi, [rdi*4]
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.1401d80e0
add rbx, rdi
mov qword [rsp + 0x178], rbx
jmp 0x14006e15b
call fcn.140022e60
nop
call fcn.140043670
int3