Function at 0x14005aeb0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x3a0
mov rax, qword [0x1400c2080]
xor rax, rsp
mov qword [rsp + 0x390], rax
xor edx, edx
lea rcx, [rsp + 0x264]
mov r8d, 0x12c
call fcn.140091db0
xor edx, edx
mov dword [rsp + 0x260], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor esi, esi
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14005af10
mov dword [0x1400c5568], esi
jmp 0x14005b19b
mov qword [rsp + 0x3b0], rbx
lea rdx, [rsp + 0x260]
mov rcx, rdi
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14005af63
nop
lea rdx, [rsp + 0x28c]
lea rcx, str.javaw.exe
call fcn.140090d80
test eax, eax
lea rdx, [rsp + 0x260]
mov rcx, rdi
cmove ebx, dword [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005af30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1400c5568], ebx
test ebx, ebx
je 0x14005b193
mov edx, ebx
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005affc
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x14005affc
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x14005affc
lea rdi, str.jvm.dll
nop dword [rax]
nop word [rax + rax]
mov rax, rsi
lea rdx, [rsp + 0x50]
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [rdi + rax - 1]
jne 0x14005b081
cmp rax, 8
jne 0x14005afe0
mov rsi, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [0x1400c5568]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400c5618], rax
lea rcx, str.net_minecraft_client_Minecraft
mov eax, esi
mov qword [0x1400c5450], rax
call fcn.140057d70
mov rsi, rax
lea rdi, [0x1400c2e00]
mov rax, qword [0x1400c2e18]
cmp rax, 5
jb 0x14005b09c
cmp rax, 0xf
mov qword [0x1400c2e10], 5
mov rbx, rdi
lea rdx, str.forge
cmova rbx, qword [0x1400c2e00]
mov r8d, 5
mov rcx, rbx
call fcn.140091710
mov byte [rbx + 5], 0
jmp 0x14005b0b0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x14005afd0
jmp 0x14005affc
lea r9, str.forge
mov edx, 5
mov rcx, rdi
call fcn.140005640
test rsi, rsi
jne 0x14005b189
lea rcx, str.net_minecraft_client_Minecraft
call fcn.140057c90
test rax, rax
jne 0x14005b189
lea rcx, [0x1400a5810]
call fcn.140057c90
mov rcx, qword [0x1400c2e18]
mov rsi, rax
cmp rcx, 7
jb 0x14005b11f
cmp rcx, 0xf
mov qword [0x1400c2e10], 7
mov rbx, rdi
lea rdx, str.labymod
cmova rbx, qword [0x1400c2e00]
mov r8d, 7
mov rcx, rbx
call fcn.140091710
mov byte [rbx + 7], 0
jmp 0x14005b133
lea r9, str.labymod
mov edx, 7
mov rcx, rdi
call fcn.140005640
test rsi, rsi
jne 0x14005b189
mov rax, qword [0x1400c2e18]
cmp rax, 6
jb 0x14005b175
cmp rax, 0xf
mov qword [0x1400c2e10], 6
lea r8d, [rsi + 6]
cmova rdi, qword [0x1400c2e00]
lea rdx, str.vanila
mov rcx, rdi
call fcn.140091710
mov byte [rdi + 6], sil
jmp 0x14005b189
lea r9, str.vanila
mov edx, 6
mov rcx, rdi
call fcn.140005640
call fcn.140057e50
call fcn.1400586c0
mov rbx, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.140060e90
mov rsi, qword [rsp + 0x3b8]
add rsp, 0x3a0
pop rdi
ret