Function at 0x140005460
Capabilities:
Enumerate process modules

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rdi
mov eax, 0x2298
call fcn.140085380
sub rsp, rax
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400a94c0]
xor rax, rsp
mov qword [rbp + 0x2240], rax
mov r8d, dword [rsp + 0x22b0]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
jne 0x1400054b7
mov eax, 1
jmp 0x14000599a
lea r9, [rbp + 0x120]
mov r8d, 0x2000
lea rdx, [rbp + 0x130]
mov rcx, qword [rbp + 0x18]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x14000598e
mov dword [rbp + 0x20], 0
jmp 0x1400054ed
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x20]
mov qword [rbp + 0x60], rax
mov ecx, dword [rbp + 0x120]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rbp + 0x60]
cmp rcx, rax
jae 0x14000598e
mov eax, dword [rbp + 0x20]
mov r9d, 0x104
lea r8, [rbp + 0x2130]
mov rdx, qword [rbp + rax*8 + 0x130]
mov rcx, qword [rbp + 0x18]
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x140005989
lea rax, [rbp]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp]
movzx r8d, byte [rbp + 1]
movzx edx, byte [rbp + 0x34]
lea rcx, [rbp + 0x70]
call fcn.140007070
mov rcx, rax
call fcn.140010980
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140012820
test rax, rax
je 0x1400055b4
mov dword [rbp + 0x38], 0xffffffff
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x35]
call fcn.140008170
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000599a
lea rax, [rbp + 2]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 3]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 2]
movzx r8d, byte [rbp + 3]
movzx edx, byte [rbp + 0x24]
lea rcx, [rbp + 0x80]
call fcn.1400073b0
mov rcx, rax
call fcn.140010af0
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140012820
test rax, rax
je 0x14000562f
mov dword [rbp + 0x3c], 0xffffffff
lea rdx, [rbp + 0x3c]
lea rcx, [rbp + 0x25]
call fcn.1400082f0
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000599a
lea rax, [rbp + 4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 5]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 4]
movzx r8d, byte [rbp + 5]
movzx edx, byte [rbp + 0x26]
lea rcx, [rbp + 0x90]
call fcn.1400074f0
mov rcx, rax
call fcn.140010f40
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140012820
test rax, rax
je 0x1400056aa
mov dword [rbp + 0x40], 0xffffffff
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x27]
call fcn.140008230
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000599a
lea rax, [rbp + 6]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 7]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 6]
movzx r8d, byte [rbp + 7]
movzx edx, byte [rbp + 0x28]
lea rcx, [rbp + 0xa0]
call fcn.140007610
mov rcx, rax
call fcn.140010980
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140012820
test rax, rax
je 0x140005725
mov dword [rbp + 0x44], 0xffffffff
lea rdx, [rbp + 0x44]
lea rcx, [rbp + 0x29]
call fcn.1400082c0
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000599a
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 9]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 8]
movzx r8d, byte [rbp + 9]
movzx edx, byte [rbp + 0x2a]
lea rcx, [rbp + 0xb0]
call fcn.140007700
mov rcx, rax
call fcn.140010dd0
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140012820
test rax, rax
je 0x1400057a0
mov dword [rbp + 0x48], 0xffffffff
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x2b]
call fcn.140008290
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000599a
lea rax, [rbp + 0xa]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xa]
movzx r8d, byte [rbp + 0xb]
movzx edx, byte [rbp + 0x2c]
lea rcx, [rbp + 0xc0]
call fcn.1400077f0
mov rcx, rax
call fcn.140010c60
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140012820
test rax, rax
je 0x14000581b
mov dword [rbp + 0x4c], 0xffffffff
lea rdx, [rbp + 0x4c]
lea rcx, [rbp + 0x2d]
call fcn.1400081a0
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000599a
lea rax, [rbp + 0xc]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xd]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xc]
movzx r8d, byte [rbp + 0xd]
movzx edx, byte [rbp + 0x2e]
lea rcx, [rbp + 0xd0]
call fcn.140007a30
mov rcx, rax
call fcn.140010c60
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140012820
test rax, rax
je 0x140005896
mov dword [rbp + 0x50], 0xffffffff
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x2f]
call fcn.140008260
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000599a
lea rax, [rbp + 0xe]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xf]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xe]
movzx r8d, byte [rbp + 0xf]
movzx edx, byte [rbp + 0x30]
lea rcx, [rbp + 0xe0]
call fcn.140007ad0
mov rcx, rax
call fcn.140010f40
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140012820
test rax, rax
je 0x140005911
mov dword [rbp + 0x54], 0xffffffff
lea rdx, [rbp + 0x54]
lea rcx, [rbp + 0x31]
call fcn.140008200
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000599a
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x11]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x10]
movzx r8d, byte [rbp + 0x11]
movzx edx, byte [rbp + 0x32]
lea rcx, [rbp + 0x100]
call fcn.140007ba0
mov rcx, rax
call fcn.14000f7c0
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140012820
test rax, rax
je 0x140005989
mov dword [rbp + 0x58], 0xffffffff
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x33]
call fcn.140008350
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000599a
jmp 0x1400054e5
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x2240]
xor rcx, rsp
call fcn.140085270
add rsp, 0x2298
pop rdi
pop rbp
ret