Function at 0x1400092e9
Capabilities:
Enumerate process modules

Disassembly:
sub rsp, 0x28
lea rbp, [0x1400c6828]
mov dword [rbp], 0x238
mov qword [0x1400c5f60], 0
push qword [0x1400c5f28]
push 8
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [0x1400c63d0], rax
cmp qword [0x1400c63d0], 0
je 0x1400095ed
movabs rax, 0x1400c6828
push rax
push qword [0x1400c63d0]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32First
and rax, rax
je 0x1400095df
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
push qword [0x1400c5f50]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140010c60
add rsp, 0x28
inc qword [0x1400c7100]
mov rdx, qword [0x1400c7100]
push rdx
push rdx
mov rdx, qword [0x1400c7100]
push rdx
push rdx
lea rbp, [0x1400c6828]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e8c0
add rsp, 0x20
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140010c60
add rsp, 0x20
pop rcx
pop rdx
mov qword [0x1400c7100], rdx
add rdx, qword [0x1400c7110]
add rcx, qword [0x1400c7110]
call fcn.14001f6d0
or rax, rax
je 0x1400094fc
lea rbp, [0x1400c6828]
mov rax, qword [rbp + 0x18]
mov qword [0x1400c5f60], rax
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c6050]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.Copy.dll
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14001a764
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
push 0x12c
pop rcx
call fcn.140014038
push qword [0x1400c7100]
sub rsp, 8
mov rcx, qword [0x1400c6050]
push qword [0x1400c7100]
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
movabs rcx, str.Copy.dll
sub rsp, 0x28
call fcn.14001f570
add rsp, 0x28
inc qword [0x1400c7100]
mov rdx, qword [0x1400c7100]
push rdx
push rdx
lea rax, [rbp + 0x130]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e8c0
add rsp, 0x20
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
mov rdx, qword [0x1400c7110]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001a780
add rsp, 0x28
pop qword [0x1400c7100]
mov qword [0x1400c5ed0], rax
movabs rax, 0x1400c6828
push rax
push qword [0x1400c63d0]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32Next
mov qword [0x1400c5ed0], rax
cmp qword [0x1400c5ed0], 0
je 0x1400095cf
mov rax, qword [0x1400c7100]
push rax
sub rsp, 8
push rax
push qword [0x1400c5f50]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140010c60
add rsp, 0x28
inc qword [0x1400c7100]
mov rdx, qword [0x1400c7100]
push rdx
push rdx
mov rdx, qword [0x1400c7100]
push rdx
push rdx
lea rbp, [0x1400c6828]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001e8c0
add rsp, 0x20
mov rdx, qword [0x1400c7110]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140010c60
add rsp, 0x20
pop rcx
pop rdx
mov qword [0x1400c7100], rdx
add rdx, qword [0x1400c7110]
add rcx, qword [0x1400c7110]
call fcn.14001f6d0
or rax, rax
je 0x1400095cf
lea rbp, [0x1400c6828]
mov rax, qword [rbp + 0x18]
mov qword [0x1400c5f60], rax
mov r15, qword [0x1400c5ed0]
and r15, r15
jne 0x1400094fc
push qword [0x1400c63d0]
pop rcx
call sub.KERNEL32.dll_CloseHandle
jmp 0x14000960a
movabs rax, str.CreateToolhelp32Snapshot____failed_
push rax
movabs rax, str.Error
push rax
pop rcx
pop rdx
call fcn.140013738
add rsp, 0x28
ret