Function at 0x413f40
Capabilities:
Enumerate process modules

Disassembly:
push r15
mov eax, 0x2288
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.017c4f30
sub rsp, rax
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x22d8], rdx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x1280], rsi
cmp rsi, 7
ja 0x4141f0
mov rbp, qword [rsp + 0x30]
mov rcx, rsi
lea rbx, [rsp + 0x1280]
xor eax, eax
test rsi, rsi
je 0x413fc3
nop word [rax + rax]
movsx dx, byte [rdi + rax]
mov word [rbp + rax*2], dx
add rax, 1
cmp rax, rsi
jne 0x413fb0
xor r10d, r10d
mov qword [rsp + 0x58], rcx
lea r8, [rsp + 0x40]
mov edx, 0x1000
mov word [rbp + rcx*2], r10w
mov rcx, rbx
mov dword [rsp + 0x40], 0
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x414228
mov eax, dword [rsp + 0x40]
shr eax, 2
je 0x414234
movabs r14, 0x6b006e0075003c
sub eax, 1
xor esi, esi
movabs r15, 0x6e0077006f006e
lea r13, [rsp + rax*4 + 0x1284]
jmp 0x414035
add rbx, 4
cmp r13, rbx
je 0x414140
mov r8d, dword [rbx]
test r8d, r8d
je 0x414028
lea rdi, [rsp + 0x90]
xor eax, eax
xor r9d, r9d
xor edx, edx
mov ecx, 0x3d
mov qword [rsp + 0x70], r14
rep stosq qword [rdi], rax
mov qword [rsp + 0x78], r15
mov ecx, 0x410
mov qword [rsp + 0x80], 0x3e
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x48], 0
mov word [rdi], r9w
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x414028
mov rax, qword [0x024d9060]
lea rdx, [rsp + 0x48]
test rax, rax
je 0x4141d8
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x44]
mov r8d, 8
mov rcx, r12
call rax
test eax, eax
je 0x414028
lea rdi, [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
mov r9d, 0x104
mov rcx, r12
mov r8, rdi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov edx, eax
xor ecx, ecx
mov word [rsp + rdx*2 + 0x70], cx
test eax, eax
je 0x4141b0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x414028
mov edx, dword [rbx]
lea eax, [rsi + 1]
mov dword [rsp + rsi*4 + 0x280], edx
cmp eax, 0x3ff
ja 0x41423c
add rbx, 4
mov esi, eax
cmp r13, rbx
jne 0x414035
nop word [rax + rax]
xor r12d, r12d
test esi, esi
je 0x41417b
mov r8, qword [rsp + 0x22d8]
xor eax, eax
lea rcx, [rsp + 0x280]
nop dword [rax]
mov edx, dword [rcx + rax*4]
mov dword [r8 + rax*4], edx
add rax, 1
cmp esi, eax
ja 0x414160
test esi, esi
mov r12d, 1
cmovne r12d, esi
mov rcx, qword [rsp + 0x50]
cmp rcx, qword [rsp + 0x30]
je 0x414196
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call fcn.01871510
mov eax, r12d
add rsp, 0x2288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x48]
mov r9d, 0x104
mov r8, rdi
mov rcx, r12
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov eax, eax
xor edx, edx
mov word [rsp + rax*2 + 0x70], dx
jmp 0x4140f7
lea r9, [rsp + 0x44]
mov r8d, 8
mov rcx, r12
call sub.KERNEL32.dll_K32EnumProcessModules
jmp 0x4140c3
mov rcx, qword [rsp + 0x38]
lea rbx, [rsp + 0x1280]
xor r8d, r8d
mov rdx, rbx
call fcn.01862410
mov rcx, qword [rsp + 0x1280]
mov qword [rsp + 0x50], rax
mov rbp, rax
mov qword [rsp + 0x60], rcx
jmp 0x413fa3
lea rcx, str.ERROR:_Can_not_execute_EnumProcesses__..._n
call fcn.00413e40
xor r12d, r12d
jmp 0x41417b
mov esi, eax
jmp 0x414147