Function at 0x140014950
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x1260
call fcn.140031df0
sub rsp, rax
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x1250], rax
cmp qword [0x14004f2b0], 0
je 0x140014a8d
lea r8, [rsp + 0x30]
mov edx, 0x1000
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32EnumProcesses]
test eax, eax
je 0x140014a8d
mov ebp, dword [rsp + 0x30]
xor r15d, r15d
shr ebp, 2
mov ebx, r15d
test ebp, ebp
je 0x140014a8d
lea r14, [rsp + 0x40]
lea r12d, [r15 + 1]
mov r8d, dword [r14]
test r8d, r8d
je 0x140014a7f
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140014a7f
mov rcx, rax
mov esi, r15d
mov rax, qword [0x14004f2b0]
call qword [0x1400335f0]
test eax, eax
je 0x140014a72
xor edx, edx
lea rcx, [rsp + 0x1040]
mov r8d, 0x208
call fcn.14001c070
mov r8d, 0x104
lea rdx, [rsp + 0x1040]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x140014a72
lea rdx, str.B9ECED6F.ASUSPCAssistant_
lea rcx, [rsp + 0x1040]
call fcn.14001b900
test rax, rax
je 0x140014a72
lea rdx, str.__qmba6cd70vzyyMyASUS.exe
lea rcx, [rsp + 0x1040]
call fcn.14001b900
test rax, rax
cmovne esi, r12d
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
jne 0x140014ac1
inc ebx
add r14, 4
cmp ebx, ebp
jb 0x1400149d2
xor eax, eax
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.14001a990
lea r11, [rsp + 0x1260]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov eax, ebx
mov ebp, dword [rsp + rax*4 + 0x40]
test ebp, ebp
je 0x140014a8d
mov rcx, qword [0x14004a6a8]
lea rax, [0x14004a6a8]
cmp rcx, rax
je 0x140014af9
test byte [rcx + 0x1c], 8
je 0x140014af9
mov rcx, qword [rcx + 0x10]
lea rax, str.MyASUS_process_is_running
mov qword [rsp + 0x20], rax
call fcn.140019c20
mov rax, qword [0x14004f1d8]
test rax, rax
je 0x140014a8d
cmp qword [0x14004f2b8], r15
je 0x140014a8d
cmp qword [0x14004f210], r15
je 0x140014a8d
lea r9, str.MyASUS
xor edx, edx
lea r8, str.ApplicationFrameWindow
xor ecx, ecx
mov rsi, r15
mov edi, r15d
call qword [0x1400335f0]
mov rbx, rax
test rax, rax
je 0x140014a8d
nop dword [rax]
mov rax, qword [0x14004f2b8]
mov rcx, rbx
call qword [0x1400335f0]
test eax, eax
je 0x140014bb6
mov rax, qword [0x14004f1d8]
lea r9, str.MyASUS
lea r8, str.Windows.UI.Core.CoreWindow
xor edx, edx
mov rcx, rbx
call qword [0x1400335f0]
test rax, rax
je 0x140014bb1
mov rcx, rax
mov dword [rsp + 0x30], r15d
mov rax, qword [0x14004f210]
lea rdx, [rsp + 0x30]
call qword [0x1400335f0]
cmp dword [rsp + 0x30], ebp
jne 0x140014bb6
mov rax, rbx
jmp 0x140014a8f
mov rsi, rbx
inc edi
mov rax, qword [0x14004f1d8]
lea r9, str.MyASUS
lea r8, str.ApplicationFrameWindow
mov rdx, rbx
xor ecx, ecx
call qword [0x1400335f0]
mov rbx, rax
test rax, rax
jne 0x140014b50
cmp edi, r12d
jne 0x140014a8d
test rsi, rsi
je 0x140014a8d
mov rax, qword [0x14004f1d0]
lea rdx, str.MyASUS
lea rcx, str.Windows.UI.Core.CoreWindow
call qword [0x1400335f0]
test rax, rax
je 0x140014a8d
mov rcx, rax
mov dword [rsp + 0x30], r15d
mov rax, qword [0x14004f210]
lea rdx, [rsp + 0x30]
call qword [0x1400335f0]
cmp dword [rsp + 0x30], ebp
jne 0x140014a8d
mov rax, rsi
jmp 0x140014a8f