Function at 0x140002730
Capabilities:
Enumerate process modules
Get session user name

Disassembly:
push rbp
lea rbp, [rsp - 0x824b0]
mov eax, 0x825b0
call fcn.1400311a0
sub rsp, rax
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rbp + 0x82490], rax
mov qword [rsp + 0x825c0], rbx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x825d0], rdi
lea rcx, [rbp + 0x8160]
mov qword [rsp + 0x825d8], r12
mov dword [rsp + 0x30], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rcx, [rbp + 0x8160]
call fcn.140002490
lea r8, [rsp + 0x34]
mov edx, 0x2000
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
movups xmm0, xmmword [0x1400666a8]
mov r12d, dword [rsp + 0x34]
lea rcx, [rbp + 0x7f64]
mov ebx, dword [0x1400666b8]
xor edx, edx
mov r8d, 0x1f4
movaps xmmword [rbp + 0x7f50], xmm0
shr r12d, 2
mov dword [rbp + 0x7f60], ebx
call fcn.140057af0
movups xmm0, xmmword [0x1400666a8]
movabs rax, 0x20002c0020
mov dword [rbp + 0x20a20], ebx
xor edx, edx
mov qword [rbp + 0x7f40], rax
mov r8d, 0x30d2c
movaps xmmword [rbp + 0x20a10], xmm0
lea rcx, [rbp + 0x20a24]
call fcn.140057af0
xor ebx, ebx
mov edi, ebx
test r12d, r12d
je 0x140002910
mov qword [rsp + 0x825c8], rsi
mov qword [rsp + 0x825a8], r14
lea r14, [rsp + 0x40]
mov qword [rsp + 0x825a0], r15
lea r15, [rbp + 0x3f40]
nop dword [rax]
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400028e5
mov ecx, edi
lea r9, [rbp + 0x1f40]
lea rdx, [rbp + 0x3f40]
mov r8d, 8
lea r9, [r9 + rcx*4]
lea rdx, [rdx + rcx*8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400028e5
mov rdx, qword [r15]
lea r8, [rbp + 0x7f50]
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea r8, [rbp + 0x7f50]
mov edx, 0x186a0
lea rcx, [rbp + 0x20a10]
call fcn.1400373a4
lea r8, [rbp + 0x7f40]
mov edx, 0x186a0
lea rcx, [rbp + 0x20a10]
call fcn.1400373a4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add r14, 4
add r15, 8
cmp edi, r12d
jb 0x140002850
mov r15, qword [rsp + 0x825a0]
mov r14, qword [rsp + 0x825a8]
mov rsi, qword [rsp + 0x825c8]
mov r8d, 0x186a0
lea rdx, [rbp + 0x20a10]
lea rcx, [rbp + 0x8370]
call fcn.1400379a0
mov r12, qword [rsp + 0x825d8]
mov rdi, qword [rsp + 0x825d0]
nop dword [rax]
movzx eax, byte [rbp + rbx + 0x8370]
test al, al
je 0x1400029b6
add al, 3
mov byte [rbp + rbx + 0x8370], al
movzx eax, byte [rbp + rbx + 0x8371]
test al, al
je 0x1400029b6
add al, 3
mov byte [rbp + rbx + 0x8371], al
movzx eax, byte [rbp + rbx + 0x8372]
test al, al
je 0x1400029b6
add al, 3
mov byte [rbp + rbx + 0x8372], al
movzx eax, byte [rbp + rbx + 0x8373]
test al, al
je 0x1400029b6
add al, 3
mov byte [rbp + rbx + 0x8373], al
movzx eax, byte [rbp + rbx + 0x8374]
test al, al
je 0x1400029b6
add al, 3
mov byte [rbp + rbx + 0x8374], al
add rbx, 5
cmp rbx, 0x186a0
jl 0x140002940
xor edx, edx
lea rcx, [rbp + 0x51750]
mov r8d, 0x30d40
call fcn.140057af0
mov rbx, qword [rsp + 0x825c0]
lea rax, [rbp + 0x8370]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x1400029e0
lea rax, [rbp + 0x51750]
mov dword [rsp + 0x28], 0x186a0
lea r8, [rbp + 0x8370]
mov qword [rsp + 0x20], rax
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0x51750]
call fcn.140002490
mov rcx, qword [rbp + 0x82490]
xor rcx, rsp
call fcn.140030700
add rsp, 0x825b0
pop rbp
ret