Function at 0x14001f690
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x12b8
call fcn.140023110
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x140050040]
xor rax, rsp
mov qword [rsp + 0x12a0], rax
mov byte [rsp + 0x21], 0
cmp qword [rsp + 0x12d0], 0
jne 0x14001f6e4
lea rax, [rsp + 0x21]
mov qword [rsp + 0x12d0], rax
mov edx, 0x400
lea rcx, [rsp + 0x80]
call fcn.14001f9c0
nop
lea rcx, [rsp + 0x80]
call fcn.140020010
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x80]
call fcn.14001fcd0
lea r8, [rsp + 0x30]
mov ecx, dword [rsp + 0x40]
mov edx, ecx
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcesses
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jne 0x14001f79e
lea rcx, [rsp + 0x80]
call fcn.140020010
cmp dword [rsp + 0x30], eax
jl 0x14001f79e
lea rcx, [rsp + 0x80]
call fcn.140020010
add eax, 0x400
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.14001ffd0
lea rcx, [rsp + 0x80]
call fcn.140020010
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x80]
call fcn.14001fcd0
lea r8, [rsp + 0x30]
mov ecx, dword [rsp + 0x44]
mov edx, ecx
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcesses
mov dword [rsp + 0x2c], eax
jmp 0x14001f72c
cmp dword [rsp + 0x2c], 0
jne 0x14001f7cc
mov rax, qword [rsp + 0x12d0]
mov byte [rax], 1
mov byte [rsp + 0x22], 0
lea rcx, [rsp + 0x80]
call fcn.14001fb10
movzx eax, byte [rsp + 0x22]
jmp 0x14001f8ff
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
jmp 0x14001f7e5
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x80]
call fcn.140020010
cmp dword [rsp + 0x28], eax
jge 0x14001f8d9
mov edx, dword [rsp + 0x28]
lea rcx, [rsp + 0x80]
call fcn.14001fbe0
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14001f8d4
lea r9, [rsp + 0x4c]
mov r8d, 8
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x14001f8c9
mov r9d, 0x104
lea r8, [rsp + 0x1090]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov r8d, 0xffffffff
lea rdx, [rsp + 0x1090]
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf16_unsigned_short_int_const____ptr64__int_]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x12c8]
call qword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const____ptr64__class_QString_const____ptr64_]
mov byte [rsp + 0x23], al
lea rcx, [rsp + 0x68]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
movzx eax, byte [rsp + 0x23]
test eax, eax
je 0x14001f8c9
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001f7db
mov rax, qword [rsp + 0x12d0]
mov byte [rax], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x24], al
lea rcx, [rsp + 0x80]
call fcn.14001fb10
movzx eax, byte [rsp + 0x24]
mov rcx, qword [rsp + 0x12a0]
xor rcx, rsp
call fcn.140022a90
add rsp, 0x12b8
ret