Function at 0x140008c90
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3280
call fcn.1400c2560
sub rsp, rax
mov rax, qword [0x14013e100]
xor rax, rsp
mov qword [rsp + 0x3270], rax
mov r13, r8
mov qword [rsp + 0x28], rdx
mov rbp, rdx
lea r8, [rsp + 0x3c]
mov r12, rcx
mov edx, 0x1000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140008fa2
mov esi, dword [rsp + 0x3c]
xor edi, edi
shr esi, 2
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x20], edi
test esi, esi
je 0x140008fa2
mov r8d, dword [rsp + rdi*4 + 0x60]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x140008f94
lea r9, [rsp + 0x38]
mov r8d, 0x2000
lea rdx, [rsp + 0x1060]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140008f8b
xor r15d, r15d
test dword [rsp + 0x38], 0xfffffff8
jbe 0x140008f8b
nop dword [rax + rax]
mov rdx, qword [rsp + r15*8 + 0x1060]
lea r8, [rsp + 0x3060]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x140008f70
xorps xmm0, xmm0
mov qword [rsp + 0x50], 0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x3060]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140008db0
lea rdx, [rsp + 0x3060]
lea rcx, [rsp + 0x40]
call fcn.140005cb0
cmp qword [r12 + 0x18], 7
mov r11, r12
mov rbx, qword [r12 + 0x10]
jbe 0x140008de1
mov r11, qword [r12]
mov r14, qword [rsp + 0x58]
lea rdi, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
cmp r14, 7
mov rax, qword [rsp + 0x50]
cmova rdi, rsi
cmp rbx, rax
ja 0x140008f34
sub rax, rbx
test rbx, rbx
je 0x140008ead
movzx r10d, word [r11]
lea rbp, [rdi + 2]
lea rbp, [rbp + rax*2]
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
mov rax, rbp
mov edx, 0
sub rax, rcx
sar rax, 1
je 0x140008e5c
cmp word [rcx], r10w
je 0x140008e59
cmp rax, 1
je 0x140008e5c
add rcx, 2
dec rax
cmp word [rcx], r10w
jne 0x140008e46
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140008f2f
mov r8, rbx
mov rdx, r11
test rbx, rbx
je 0x140008e98
mov r9, rcx
sub r9, r11
nop dword [rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140008f26
add rdx, 2
sub r8, 1
jne 0x140008e80
mov rbp, qword [rsp + 0x28]
sub rcx, rdi
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x140008f34
cmp qword [r13 + 0x18], 7
mov r9, r13
jbe 0x140008ebb
mov r9, qword [r13]
cmp qword [rbp + 0x18], 7
mov r8, rbp
jbe 0x140008ec9
mov r8, qword [rbp]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x140008f34
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14, 7
jbe 0x140008f21
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140008f19
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008fcf
mov rcx, rsi
call fcn.1400c1b20
mov rax, rbx
jmp 0x140008fa4
add rcx, 2
jmp 0x140008e30
mov rbp, qword [rsp + 0x28]
cmp r14, 7
jbe 0x140008f6b
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140008f63
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008fcf
mov rcx, rsi
call fcn.1400c1b20
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
inc r15d
shr eax, 3
cmp r15d, eax
jb 0x140008d60
mov edi, dword [rsp + 0x20]
mov esi, dword [rsp + 0x24]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
mov dword [rsp + 0x20], edi
cmp edi, esi
jb 0x140008d03
xor eax, eax
mov rcx, qword [rsp + 0x3270]
xor rcx, rsp
call fcn.1400c1b00
mov rbx, qword [rsp + 0x32c0]
add rsp, 0x3280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400c7f74
int3