Function at 0x1800c1220
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x5b0
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x5c8], 0
je 0x1800c12a5
lea rax, [rsp + 0x130]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x5c8]
mov rcx, qword [rsp + 0x40]
call fcn.1800056f0
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0xf0]
call fcn.1800c03e0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
jmp 0x1800c12d3
lea rdx, [0x1801799cc]
lea rcx, [rsp + 0xd0]
call fcn.1800056f0
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xb0]
call fcn.180005670
nop
mov eax, dword [rsp + 0x20]
and eax, 2
test eax, eax
je 0x1800c130e
and dword [rsp + 0x20], 0xfffffffd
lea rcx, [rsp + 0xd0]
call fcn.180005580
nop
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x1800c132b
and dword [rsp + 0x20], 0xfffffffe
lea rcx, [rsp + 0xf0]
call fcn.180005580
mov edx, dword [rsp + 0x5c0]
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1800c136a
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0xb0]
call fcn.180005580
mov rax, qword [rsp + 0x70]
jmp 0x1800c153a
mov dword [rsp + 0x170], 0x438
lea rax, [rsp + 0x174]
mov rdi, rax
xor eax, eax
mov ecx, 0x434
rep stosb byte [rdi], al
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1800c150e
cmp qword [rsp + 0x5c8], 0
jne 0x1800c13fb
cmp qword [rsp + 0x5d0], 0
je 0x1800c13cc
mov eax, dword [rsp + 0x190]
mov rcx, qword [rsp + 0x5d0]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xb0]
call fcn.180005580
mov rax, qword [rsp + 0x78]
jmp 0x1800c153a
lea rax, [rsp + 0x150]
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x3a0]
mov rcx, qword [rsp + 0x80]
call fcn.1800056f0
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x110]
call fcn.1800c03e0
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x98], rax
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x98]
call fcn.1800262d0
cmp rax, 0xffffffffffffffff
je 0x1800c147d
mov dword [rsp + 0x30], 1
jmp 0x1800c1485
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x24], al
lea rcx, [rsp + 0x110]
call fcn.180005580
movzx eax, byte [rsp + 0x24]
test eax, eax
je 0x1800c14f3
cmp qword [rsp + 0x5d0], 0
je 0x1800c14c1
mov eax, dword [rsp + 0x190]
mov rcx, qword [rsp + 0x5d0]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0xb0]
call fcn.180005580
mov rax, qword [rsp + 0xa0]
jmp 0x1800c153a
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1800c13a4
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0xb0]
call fcn.180005580
mov rax, qword [rsp + 0xa8]
add rsp, 0x5b0
pop rdi
ret