Function at 0x1400016c0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x140014010]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x1a0], 0x130
xor r15d, r15d
mov edi, r15d
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000175d
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rbp + 0x1cc]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140001757
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x14000172a
mov edi, dword [rbp + 0x1a8]
mov edx, edi
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1400017b8
nop word [rax + rax]
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x1400017b8
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140001790
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
mov ecx, dword [rsp + 0x60]
mov edi, ecx
movdqu xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
test ecx, ecx
je 0x14000184b
cmp rcx, 0x1000
jb 0x14000181c
add rcx, 0x27
cmp rcx, rdi
jbe 0x140001a62
call fcn.14000ccf0
mov rcx, rax
test rax, rax
je 0x14000191e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001821
call fcn.14000ccf0
mov qword [rbp + 0x180], rax
lea rbx, [rax + rdi]
mov qword [rbp + 0x190], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x188], rbx
mov ecx, dword [rsp + 0x60]
mov r9d, ecx
mov qword [rsp + 0x20], r15
mov r8, qword [rbp + 0x180]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, r15d
mov r11d, dword [rsp + 0x60]
test r11d, r11d
je 0x1400018d1
mov r10, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, r10
sar rdx, 2
mov r9, qword [rbp + 0x180]
nop word [rax + rax]
mov rcx, r15
test rdx, rdx
je 0x1400018c7
nop dword [rax + rax]
cmp rdx, rcx
jbe 0x140001a5c
mov r8d, dword [r10 + rcx*4]
cmp r8d, 0xffffffff
je 0x1400018bd
movzx eax, byte [r9 + rcx]
cmp r8d, eax
jne 0x1400018c7
inc rcx
cmp rcx, rdx
je 0x140001925
jb 0x1400018a0
inc ebx
inc r9
cmp ebx, r11d
jb 0x140001890
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x1400019e3
mov rdx, qword [rbp + 0x190]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rbx, ebx
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x14000197f
mov rdx, qword [rbp + 0x190]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001968
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000191e
call fcn.14000cf7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400019c7
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x1400019b7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140001a55
mov rcx, r8
call fcn.14000cf7c
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
mov rax, rbx
jmp 0x140001a29
call fcn.14000cf7c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
mov rcx, qword [rsi]
test rcx, rcx
je 0x140001a27
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140001a17
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a55
mov rcx, r8
call fcn.14000cf7c
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
xor eax, eax
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.14000ccd0
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000bc60
nop
call fcn.140001210
int3