Function at 0x140001d90
Capabilities:
Enumerate process modules

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rdi
mov eax, 0x2298
call fcn.1400858f0
sub rsp, rax
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400aa140]
xor rax, rsp
mov qword [rbp + 0x2240], rax
mov r8d, dword [rsp + 0x22b0]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
jne 0x140001de7
mov eax, 1
jmp 0x1400022ca
lea r9, [rbp + 0x120]
mov r8d, 0x2000
lea rdx, [rbp + 0x130]
mov rcx, qword [rbp + 0x18]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400022be
mov dword [rbp + 0x20], 0
jmp 0x140001e1d
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x20]
mov qword [rbp + 0x60], rax
mov ecx, dword [rbp + 0x120]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rbp + 0x60]
cmp rcx, rax
jae 0x1400022be
mov eax, dword [rbp + 0x20]
mov r9d, 0x104
lea r8, [rbp + 0x2130]
mov rdx, qword [rbp + rax*8 + 0x130]
mov rcx, qword [rbp + 0x18]
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x1400022b9
lea rax, [rbp]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp]
movzx r8d, byte [rbp + 1]
movzx edx, byte [rbp + 0x34]
lea rcx, [rbp + 0x70]
call fcn.140003810
mov rcx, rax
call fcn.14000f080
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140011240
test rax, rax
je 0x140001ee4
mov dword [rbp + 0x38], 0xffffffff
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x35]
call fcn.140004750
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400022ca
lea rax, [rbp + 2]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 3]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 2]
movzx r8d, byte [rbp + 3]
movzx edx, byte [rbp + 0x24]
lea rcx, [rbp + 0x80]
call fcn.140003a00
mov rcx, rax
call fcn.14000f1f0
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140011240
test rax, rax
je 0x140001f5f
mov dword [rbp + 0x3c], 0xffffffff
lea rdx, [rbp + 0x3c]
lea rcx, [rbp + 0x25]
call fcn.1400046f0
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400022ca
lea rax, [rbp + 4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 5]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 4]
movzx r8d, byte [rbp + 5]
movzx edx, byte [rbp + 0x26]
lea rcx, [rbp + 0x90]
call fcn.140003be0
mov rcx, rax
call fcn.14000f640
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140011240
test rax, rax
je 0x140001fda
mov dword [rbp + 0x40], 0xffffffff
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x27]
call fcn.140004720
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400022ca
lea rax, [rbp + 6]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 7]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 6]
movzx r8d, byte [rbp + 7]
movzx edx, byte [rbp + 0x28]
lea rcx, [rbp + 0xa0]
call fcn.140003c80
mov rcx, rax
call fcn.14000f080
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140011240
test rax, rax
je 0x140002055
mov dword [rbp + 0x44], 0xffffffff
lea rdx, [rbp + 0x44]
lea rcx, [rbp + 0x29]
call fcn.140004840
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400022ca
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 9]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 8]
movzx r8d, byte [rbp + 9]
movzx edx, byte [rbp + 0x2a]
lea rcx, [rbp + 0xb0]
call fcn.140003d20
mov rcx, rax
call fcn.14000f4d0
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140011240
test rax, rax
je 0x1400020d0
mov dword [rbp + 0x48], 0xffffffff
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x2b]
call fcn.140004810
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400022ca
lea rax, [rbp + 0xa]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xa]
movzx r8d, byte [rbp + 0xb]
movzx edx, byte [rbp + 0x2c]
lea rcx, [rbp + 0xc0]
call fcn.140003dc0
mov rcx, rax
call fcn.14000f360
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140011240
test rax, rax
je 0x14000214b
mov dword [rbp + 0x4c], 0xffffffff
lea rdx, [rbp + 0x4c]
lea rcx, [rbp + 0x2d]
call fcn.140004660
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400022ca
lea rax, [rbp + 0xc]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xd]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xc]
movzx r8d, byte [rbp + 0xd]
movzx edx, byte [rbp + 0x2e]
lea rcx, [rbp + 0xd0]
call fcn.140003f20
mov rcx, rax
call fcn.14000f360
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140011240
test rax, rax
je 0x1400021c6
mov dword [rbp + 0x50], 0xffffffff
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x2f]
call fcn.140004630
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400022ca
lea rax, [rbp + 0xe]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xf]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xe]
movzx r8d, byte [rbp + 0xf]
movzx edx, byte [rbp + 0x30]
lea rcx, [rbp + 0xe0]
call fcn.140003fc0
mov rcx, rax
call fcn.14000f640
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140011240
test rax, rax
je 0x140002241
mov dword [rbp + 0x54], 0xffffffff
lea rdx, [rbp + 0x54]
lea rcx, [rbp + 0x31]
call fcn.140004870
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400022ca
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x11]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x10]
movzx r8d, byte [rbp + 0x11]
movzx edx, byte [rbp + 0x32]
lea rcx, [rbp + 0x100]
call fcn.140004090
mov rcx, rax
call fcn.14000dce0
mov rdx, rax
lea rcx, [rbp + 0x2130]
call fcn.140011240
test rax, rax
je 0x1400022b9
mov dword [rbp + 0x58], 0xffffffff
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x33]
call fcn.1400046c0
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400022ca
jmp 0x140001e15
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x2240]
xor rcx, rsp
call fcn.140085950
add rsp, 0x2298
pop rdi
pop rbp
ret