Function at 0x14000ac92
Capabilities:
Enumerate process modules

Disassembly:
sub rsp, 0x28
lea rbp, [0x1400ca3d4]
mov dword [rbp], 0x238
mov qword [0x1400c9b74], 0
push qword [0x1400c9b3c]
push 8
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [0x1400c9f74], rax
cmp qword [0x1400c9f74], 0
je 0x14000af96
movabs rax, 0x1400ca3d4
push rax
push qword [0x1400c9f74]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32First
and rax, rax
je 0x14000af88
mov rax, qword [0x1400cace0]
push rax
sub rsp, 8
push rax
push qword [0x1400c9b64]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140011de0
add rsp, 0x28
inc qword [0x1400cace0]
mov rdx, qword [0x1400cace0]
push rdx
push rdx
mov rdx, qword [0x1400cace0]
push rdx
push rdx
lea rbp, [0x1400ca3d4]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001feb0
add rsp, 0x20
mov rdx, qword [0x1400cacf0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140011de0
add rsp, 0x20
pop rcx
pop rdx
mov qword [0x1400cace0], rdx
add rdx, qword [0x1400cacf0]
add rcx, qword [0x1400cacf0]
call fcn.140020cf0
or rax, rax
je 0x14000aea5
lea rbp, [0x1400ca3d4]
mov rax, qword [rbp + 0x18]
mov qword [0x1400c9b74], rax
push qword [0x1400cace0]
sub rsp, 8
mov rcx, qword [0x1400c9c64]
push qword [0x1400cace0]
sub rsp, 0x28
call fcn.140020b90
add rsp, 0x28
movabs rcx, str.Copy.dll
sub rsp, 0x28
call fcn.140020b90
add rsp, 0x28
mov rdx, qword [0x1400cacf0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14001bdc4
add rsp, 0x28
pop qword [0x1400cace0]
mov qword [0x1400c9ae4], rax
push 0x12c
pop rcx
call fcn.140015690
push qword [0x1400cace0]
sub rsp, 8
mov rcx, qword [0x1400c9c64]
push qword [0x1400cace0]
sub rsp, 0x28
call fcn.140020b90
add rsp, 0x28
movabs rcx, str.Copy.dll
sub rsp, 0x28
call fcn.140020b90
add rsp, 0x28
inc qword [0x1400cace0]
mov rdx, qword [0x1400cace0]
push rdx
push rdx
lea rax, [rbp + 0x130]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001feb0
add rsp, 0x20
mov rdx, qword [0x1400cacf0]
add qword [rsp], rdx
mov rdx, qword [0x1400cacf0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001bde0
add rsp, 0x28
pop qword [0x1400cace0]
mov qword [0x1400c9ae4], rax
movabs rax, 0x1400ca3d4
push rax
push qword [0x1400c9f74]
pop rcx
pop rdx
call sub.KERNEL32.dll_Module32Next
mov qword [0x1400c9ae4], rax
cmp qword [0x1400c9ae4], 0
je 0x14000af78
mov rax, qword [0x1400cace0]
push rax
sub rsp, 8
push rax
push qword [0x1400c9b64]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140011de0
add rsp, 0x28
inc qword [0x1400cace0]
mov rdx, qword [0x1400cace0]
push rdx
push rdx
mov rdx, qword [0x1400cace0]
push rdx
push rdx
lea rbp, [0x1400ca3d4]
lea rax, [rbp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001feb0
add rsp, 0x20
mov rdx, qword [0x1400cacf0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140011de0
add rsp, 0x20
pop rcx
pop rdx
mov qword [0x1400cace0], rdx
add rdx, qword [0x1400cacf0]
add rcx, qword [0x1400cacf0]
call fcn.140020cf0
or rax, rax
je 0x14000af78
lea rbp, [0x1400ca3d4]
mov rax, qword [rbp + 0x18]
mov qword [0x1400c9b74], rax
mov r15, qword [0x1400c9ae4]
and r15, r15
jne 0x14000aea5
push qword [0x1400c9f74]
pop rcx
call sub.KERNEL32.dll_CloseHandle
jmp 0x14000afb3
movabs rax, str.CreateToolhelp32Snapshot____failed_
push rax
movabs rax, str.Error
push rax
pop rcx
pop rdx
call fcn.140014738
add rsp, 0x28
ret