Function at 0x14001a6b0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1780]
mov eax, 0x1880
call fcn.14001dcc0
sub rsp, rax
mov rax, qword [0x1400590c0]
xor rax, rsp
mov qword [rbp + 0x1770], rax
mov r13, rcx
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.14001a4f0
nop
lea r8, [rsp + 0x50]
mov edx, 0x1000
lea rcx, [rsp + 0x70]
call sub.KERNEL32.dll_K32EnumProcesses
mov r15, 0xffffffffffffffff
test eax, eax
je 0x14001aa3b
mov eax, dword [rsp + 0x50]
shr eax, 2
mov dword [rsp + 0x54], eax
mov r12d, r14d
test eax, eax
je 0x14001aa3b
lea rsi, [0x1400437dc]
mov eax, r12d
mov ebx, dword [rsp + rax*4 + 0x70]
test ebx, ebx
je 0x14001a921
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14001aa89
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
cmp rsi, 0x10000
jae 0x14001a796
movzx edx, si
call fcn.140007210
jmp 0x14001a7a2
xor r8d, r8d
mov rdx, rsi
call fcn.1400048b0
nop
or edi, 2
mov dword [rsp + 0x20], edi
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14001a8e4
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xf70]
call fcn.14003fd50
mov r9d, 0x400
lea r8, [rbp + 0xf70]
xor edx, edx
mov rcx, r14
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x14001a8da
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14001aa9a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xf70]
cmp rax, 0x10000
lea rax, [rbp + 0xf70]
jae 0x14001a83d
movzx edx, ax
lea rcx, [rsp + 0x30]
call fcn.140007210
jmp 0x14001a85d
mov r8, r15
inc r8
cmp word [rax + r8*2], 0
jne 0x14001a840
lea rdx, [rbp + 0xf70]
lea rcx, [rsp + 0x30]
call fcn.1400048b0
nop
mov rdx, qword [rsp + 0x30]
lea rbx, [rdx - 0x18]
mov rdi, qword [rsp + 0x28]
add rdi, 0xffffffffffffffe8
cmp rbx, rdi
je 0x14001a8c1
cmp dword [rdi + 0x10], 0
jl 0x14001a8b2
mov rax, qword [rdi]
cmp qword [rbx], rax
jne 0x14001a8b2
mov rcx, rbx
call fcn.140002eb0
mov rsi, rax
mov ecx, r15d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14001a8a7
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x14001a8c1
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.1400048b0
nop
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14001a8da
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov edi, 1
mov dword [rsp + 0x20], edi
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14001aaa5
mov rcx, qword [rsp + 0x58]
sub rax, rcx
movzx r8d, word [rcx]
movzx edx, word [rcx + rax]
sub r8d, edx
jne 0x14001a918
add rcx, 2
test edx, edx
jne 0x14001a903
test r8d, r8d
jne 0x14001a921
mov bl, 1
jmp 0x14001a923
xor bl, bl
test dil, 1
je 0x14001a953
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001a94f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov edi, dword [rsp + 0x20]
test bl, bl
je 0x14001aa2d
mov eax, r12d
lea rsi, [rsp + 0x70]
lea rsi, [rsi + rax*4]
mov rcx, qword [r13]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x40], rcx
cmp byte [rax + 0x19], r14b
jne 0x14001a9be
mov edx, dword [rsi]
nop dword [rax]
mov qword [rsp + 0x30], rax
cmp dword [rax + 0x1c], edx
jae 0x14001a9a5
mov dword [rsp + 0x38], r14d
mov rax, qword [rax + 0x10]
jmp 0x14001a9b8
mov dword [rsp + 0x38], 1
mov rcx, rax
mov qword [rsp + 0x40], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r14b
je 0x14001a990
cmp byte [rcx + 0x19], r14b
jne 0x14001a9cb
mov eax, dword [rcx + 0x1c]
cmp dword [rsi], eax
jae 0x14001aa2d
movabs rax, 0x7ffffffffffffff
cmp qword [r13 + 8], rax
je 0x14001aa94
mov rbx, qword [r13]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r14
mov ecx, 0x20
call fcn.14001d5b0
nop
mov ecx, dword [rsi]
mov dword [rax + 0x1c], ecx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov word [rax + 0x18], 0
mov qword [rsp + 0x68], r14
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140015ca0
inc r12d
cmp r12d, dword [rsp + 0x54]
jb 0x14001a748
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14001aa59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x1770]
xor rcx, rsp
call fcn.14001d590
lea r11, [rsp + 0x1880]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002a90
int3
call fcn.140016890
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
int3