Function at 0x14001eda0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2bc0]
mov eax, 0x2cc0
call fcn.14007c170
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2d00], rbx
mov rbx, rdx
mov r12, rcx
mov dword [r9], 0
mov dword [rsp + 0x70], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14001f112
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x14001f109
lea rdx, [rsp + 0x70]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x14001f109
nop dword [rax + rax]
mov rdi, qword [rbx]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14001f0d5
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14001ee5e
mov rdx, qword [rdx]
lea rcx, [rbp - 0x64]
call fcn.1400e8af8
test eax, eax
je 0x14001ee78
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14001ee50
jmp 0x14001f0d5
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x14001f0d5
mov dword [rsp + 0x40], 0x400
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x3c0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x14001f0cc
lea r9, [rsp + 0x44]
mov r8d, 0x2000
lea rdx, [rbp + 0xbc0]
mov rcx, r15
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14001f0cc
xor esi, esi
mov r14d, dword [rsp + 0x44]
shr r14, 3
test r14, r14
je 0x14001f00f
mov r9d, 0x104
lea r8, [rbp + 0x1b0]
mov rdx, qword [rbp + rsi*8 + 0xbc0]
mov rcx, r15
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x14001efd6
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, rax
call fcn.14000bcc0
test rax, rax
je 0x14001f0fe
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
test rdi, rdi
je 0x14001ef8c
test rdi, 0xffffffffffff0000
jne 0x14001ef79
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.14000b6e0
test rax, rax
je 0x14001efa3
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000bf00
jmp 0x14001ef9e
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14001ef80
jmp 0x14001ef8e
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.1400144a0
mov rbx, qword [rsp + 0x38]
mov rdx, qword [r12]
test rdx, rdx
je 0x14001f0f3
mov rcx, rbx
call fcn.1400e8af8
test eax, eax
je 0x14001efe3
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001efd6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc rsi
cmp rsi, r14
jge 0x14001f00f
jmp 0x14001eef3
mov rsi, qword [rbp + 0x2c18]
inc dword [rsi]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001f0cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x14001f0cc
mov rsi, qword [rbp + 0x2c10]
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
mov rbx, rax
mov edx, dword [rsp + 0x78]
cmp byte [rcx + 0x19], 0
jne 0x14001f047
nop word [rax + rax]
cmp dword [rcx + 0x20], edx
jae 0x14001f03b
mov rcx, qword [rcx + 0x10]
jmp 0x14001f041
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x14001f030
mov qword [rsp + 0x60], rax
cmp rbx, rax
je 0x14001f056
cmp edx, dword [rbx + 0x20]
jae 0x14001f097
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [0x14012e9e0]
mov rcx, rsi
call fcn.140021310
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400221f0
mov rbx, qword [rsp + 0x50]
cmp word [rbp + 0x3c0], 0
jne 0x14001f0a6
xor r8d, r8d
jmp 0x14001f0bc
lea rax, [rbp + 0x3c0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14001f0b1
lea rcx, [rbx + 0x28]
lea rdx, [rbp + 0x3c0]
call fcn.1400237c0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x14001f109
mov rbx, qword [rbp + 0x2c08]
jmp 0x14001ee40
mov ecx, 0x80004005
call fcn.14000b790
nop
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x2d00]
add rsp, 0x2cc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret