Function at 0x14002a560
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push r14
mov eax, 0x11c8
call fcn.14002db10
sub rsp, rax
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rsp + 0x1190], rax
mov rax, qword [0x14005be38]
lea rcx, [rsp + 0x80]
movsxd rbx, dword [0x14005be30]
mov edx, 0x1000
mov qword [rsp + 0x60], r8
mov r14, r9
lea r8, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], r9
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14002a5c9
mov eax, 0xffffffff
jmp 0x14002a894
mov qword [rsp + 0x11e0], rbp
mov edx, 0x210
mov ebp, dword [rsp + 0x70]
mov qword [rsp + 0x11c0], rsi
shr rbp, 2
mov qword [rsp + 0x11b8], rdi
mov rcx, rbp
mov qword [rsp + 0x11b0], r12
mov qword [rsp + 0x11a0], r15
mov qword [rsp + 0x50], rbp
call fcn.14002f9e8
xor r12d, r12d
mov qword [rsp + 0x48], rbx
mov dword [r14], r12d
mov r15, rax
mov dword [rsp + 0x30], r12d
mov esi, r12d
mov rdi, rbx
test rbp, rbp
je 0x14002a822
lea rbx, [rsp + 0x80]
mov qword [rsp + 0x11a8], r13
mov qword [rsp + 0x40], rbx
mov r8d, dword [rbx]
test r8d, r8d
je 0x14002a7fc
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
test rax, rax
je 0x14002a7fc
lea r9, [rsp + 0x74]
mov dword [rsp + 0x20], 3
mov r8d, 8
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
test eax, eax
je 0x14002a7f3
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x1080]
mov r9d, 0x104
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x14002a7f3
mov edx, 0x5c
lea rcx, [rsp + 0x1080]
call fcn.14002e408
mov r14d, r12d
mov rbp, r12
lea rbx, [rax + 1]
test rdi, rdi
jle 0x14002a7e4
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x58]
movsxd rsi, dword [rax]
nop word [rax + rax]
mov r11, r12
test rsi, rsi
jle 0x14002a8c9
mov r10, rbx
mov r9, r15
sub r10, r15
test r9, r9
je 0x14002a8af
test rbx, rbx
je 0x14002a8af
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [r9 + rax], r12b
jne 0x14002a720
test rax, rax
je 0x14002a8af
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], r12b
jne 0x14002a740
test rax, rax
je 0x14002a8af
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r9 + rcx], r12b
jne 0x14002a760
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r12b
jne 0x14002a770
cmp rcx, rax
jne 0x14002a8af
cmp byte [r9], r12b
je 0x14002a7c3
mov rax, r9
nop word [rax + rax]
movzx ecx, byte [r10 + rax]
test cl, cl
je 0x14002a7c3
movzx edx, byte [rax]
cmp dl, cl
je 0x14002a7bb
movsx r8d, dl
movsx edx, cl
lea ecx, [r8 + 0x20]
cmp ecx, edx
je 0x14002a7bb
lea ecx, [rdx + 0x20]
cmp r8d, ecx
jne 0x14002a8af
inc rax
cmp byte [rax], r12b
jne 0x14002a790
inc r14d
inc rbp
add rdi, 0x110
cmp rbp, qword [rsp + 0x48]
jl 0x14002a6f0
mov rdi, qword [rsp + 0x48]
mov esi, dword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
add rbx, 4
movsxd rax, esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x40], rbx
cmp rax, rbp
jb 0x14002a642
mov r12d, dword [r14]
mov r13, qword [rsp + 0x11a8]
movsxd rcx, r12d
mov edx, 0x210
call fcn.14002f9e8
mov rcx, qword [rsp + 0x60]
mov rdx, r15
mov qword [rcx], rax
movsxd rcx, dword [r14]
imul r8, rcx, 0x210
mov rcx, rax
call fcn.14002e590
mov r12, qword [rsp + 0x11b0]
mov rdi, qword [rsp + 0x11b8]
mov rsi, qword [rsp + 0x11c0]
test r15, r15
je 0x14002a882
imul r8, rbp, 0x210
xor edx, edx
mov rcx, r15
call fcn.14002ec20
mov rcx, r15
call fcn.14002fc28
mov r15, qword [rsp + 0x11a0]
xor eax, eax
mov rbp, qword [rsp + 0x11e0]
mov rcx, qword [rsp + 0x1190]
xor rcx, rsp
call fcn.14002d5c0
add rsp, 0x11c8
pop r14
pop rbx
ret
inc r11
add r9, 0x210
sub r10, 0x210
cmp r11, rsi
jl 0x14002a705
test rbx, rbx
je 0x14002a7c3
test rdi, rdi
je 0x14002a7c3
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r12b
jne 0x14002a8e2
test rax, rax
je 0x14002a7c3
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], r12b
jne 0x14002a900
test rax, rax
je 0x14002a7c3
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], r12b
jne 0x14002a920
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r12b
jne 0x14002a930
cmp rax, rcx
jne 0x14002a7c3
cmp byte [rbx], r12b
je 0x14002a983
mov r9, rdi
mov rcx, rbx
sub r9, rbx
movzx eax, byte [rcx + r9]
test al, al
je 0x14002a983
movzx edx, byte [rcx]
cmp dl, al
je 0x14002a97b
movsx r8d, dl
movsx edx, al
lea eax, [r8 + 0x20]
cmp eax, edx
je 0x14002a97b
lea eax, [rdx + 0x20]
cmp r8d, eax
jne 0x14002a7c3
inc rcx
cmp byte [rcx], r12b
jne 0x14002a950
movsxd rax, r14d
lea r8, [rsp + 0x1080]
mov r14, qword [rsp + 0x38]
mov edx, 0x104
imul rcx, rax, 0x110
imul rax, rsi, 0x210
add rcx, qword [rsp + 0x58]
mov qword [rax + r15 + 0x208], rcx
movsxd rax, dword [r14]
imul rcx, rax, 0x210
add rcx, 0x104
add rcx, r15
call fcn.14002fbc8
movsxd rdx, dword [r14]
mov r8, rbx
imul rcx, rdx, 0x210
lea eax, [rdx + 1]
mov edx, 0x104
add rcx, r15
mov dword [r14], eax
call fcn.14002fbc8
mov rdi, qword [rsp + 0x48]
mov esi, dword [rsp + 0x30]
jmp 0x14002a7e9