Function at 0x140006780
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push rbp
mov eax, 0x11a0
call fcn.140044f90
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1118], 0xfffffffffffffffe
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x10d0], rcx
mov qword [rbp + 0x10d8], rdx
lea rcx, [rbp + 0x2c]
xor edx, edx
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x102c], 0
lea rax, [rbp + 0x2c]
mov qword [rbp + 0x1108], rax
mov qword [rbp + 0x1110], 0x400
xor eax, eax
test al, 1
jne 0x140006814
lea rcx, [rbp + 0x2c]
mov edx, 0x1000
lea r8, [rbp + 0x102c]
call sub.PSAPI.DLL_EnumProcesses
mov eax, dword [rbp + 0x102c]
mov dword [rbp + 0x14], eax
xor eax, eax
test al, 1
jne 0x140006867
jmp 0x14000682c
lea rcx, [0x1400479e0]
lea r8, str.srcmain.rs
mov edx, 0x21
call fcn.1400465e0
mov eax, dword [rbp + 0x14]
shr eax, 2
mov dword [rbp + 0x10e4], eax
mov dword [rbp + 0x1030], 0
mov dword [rbp + 0x1034], eax
mov ecx, dword [rbp + 0x1030]
mov edx, dword [rbp + 0x1034]
call fcn.140029ba0
mov dword [rbp + 0x1038], eax
mov dword [rbp + 0x103c], edx
jmp 0x14000687f
lea rcx, [0x140047a20]
lea r8, str.srcmain.rs
mov edx, 0x19
call fcn.1400465e0
lea rcx, [rbp + 0x1038]
call fcn.140029b60
mov dword [rbp + 0x1044], edx
mov dword [rbp + 0x1040], eax
mov eax, dword [rbp + 0x1040]
cmp rax, 0
jne 0x1400068a9
mov byte [rbp + 0x2b], 0
jmp 0x1400068ca
mov eax, dword [rbp + 0x1044]
mov dword [rbp + 0x10e8], eax
mov eax, eax
mov qword [rbp + 8], rax
cmp rax, 0x400
setb al
test al, 1
jne 0x1400068db
jmp 0x140006914
mov al, byte [rbp + 0x2b]
and al, 1
movzx eax, al
add rsp, 0x11a0
pop rbp
ret
mov rax, qword [rbp + 8]
mov r8d, dword [rbp + rax*4 + 0x2c]
mov dword [rbp + 0x10ec], r8d
mov ecx, 0x410
xor edx, edx
call sub.KERNEL32.dll_OpenProcess
mov rcx, rax
mov qword [rbp], rcx
mov qword [rbp + 0x10f0], rcx
call fcn.140016db0
test al, 1
jne 0x14000687f
jmp 0x140006929
mov rcx, qword [rbp + 8]
lea r8, str.srcmain.rs
mov edx, 0x400
call fcn.140046680
lea rcx, [rbp + 0x1048]
mov qword [rbp - 0x10], rcx
mov edx, 0x200
call fcn.14000b920
mov rcx, qword [rbp - 0x10]
call fcn.14000b970
mov qword [rbp - 8], rax
jmp 0x14000694d
mov rax, qword [rbp - 8]
mov qword [rbp + 0x10f8], rax
lea rcx, [rbp + 0x1048]
call fcn.14000bc10
mov qword [rbp - 0x18], rax
jmp 0x14000696a
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp]
mov rax, qword [rbp - 0x18]
mov r8d, eax
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov dword [rbp - 0x1c], eax
jmp 0x140006983
mov eax, dword [rbp - 0x1c]
mov dword [rbp + 0x1104], eax
cmp eax, 0
jne 0x1400069a0
mov rcx, qword [rbp]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x1400069b5
mov eax, dword [rbp - 0x1c]
mov eax, eax
mov edx, eax
lea rcx, [rbp + 0x1048]
call fcn.14000bb90
jmp 0x1400069c6
lea rcx, [rbp + 0x1048]
call fcn.14000d600
jmp 0x14000687f
lea rcx, [rbp + 0x1048]
call fcn.14000bc50
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rax
jmp 0x1400069dc
mov r8, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp + 0x1098]
call fcn.14002ec50
jmp 0x1400069f2
lea rcx, [rbp + 0x1078]
lea rdx, [rbp + 0x1098]
call fcn.140007d50
jmp 0x140006a07
lea r8, str.srcmain.rs
lea rcx, [rbp + 0x1060]
lea rdx, [rbp + 0x1078]
call fcn.14000dce0
jmp 0x140006a23
lea rcx, [rbp + 0x1060]
call fcn.140007c20
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], rax
jmp 0x140006a39
mov r8, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0x10b8]
call fcn.14003e110
jmp 0x140006a4f
lea rcx, [rbp + 0x10b8]
call fcn.140007c20
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x48], rax
jmp 0x140006a65
mov r9, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
call fcn.1400014e0
mov byte [rbp - 0x51], al
jmp 0x140006a7f
mov al, byte [rbp - 0x51]
test al, 1
jne 0x140006a96
jmp 0x140006a88
lea rcx, [rbp + 0x10b8]
call fcn.140026e90
jmp 0x140006aa4
lea rcx, [rbp + 0x10b8]
call fcn.140026e90
jmp 0x140006ad2
mov rcx, qword [rbp]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140006ab3
lea rcx, [rbp + 0x1060]
call fcn.140026e90
jmp 0x140006ac1
lea rcx, [rbp + 0x1048]
call fcn.14000d600
jmp 0x14000687f
mov rcx, qword [rbp]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140006ae1
mov byte [rbp + 0x2b], 1
lea rcx, [rbp + 0x1060]
call fcn.140026e90
jmp 0x140006af3
lea rcx, [rbp + 0x1048]
call fcn.14000d600
jmp 0x1400068ca