Function at 0x14000b090
Capabilities:
Check if file exists
Enumerate process modules
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd60
mov rax, qword [0x1400597a8]
xor rax, rsp
mov qword [rsp + 0xd50], rax
mov rsi, rcx
mov edi, edx
lea rcx, [rsp + 0x722]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x720], bp
call fcn.14002ea20
lea rcx, [rsp + 0xb42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xb40], bp
call fcn.14002ea20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rsp + 0xb40]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000b4e7
lea rdx, [rsp + 0x90]
mov r8d, 0x104
xor ecx, ecx
mov qword [rsp + 0xd78], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000b1b8
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [0x14004b958]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, ebx
cmp eax, 0x104
jge 0x14000b1b8
lea rdx, [0x14004b8e8]
lea rcx, [rsp + 0x90]
call qword [0x1400464b0]
lea rcx, [rsp + 0x90]
call qword [0x1400464c8]
lea rdx, [0x14004b958]
lea rcx, [rsp + 0x90]
call qword [0x1400464b0]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x720]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, [rsp + 0xb40]
call qword [0x140046488]
lea rcx, [rsp + 0x720]
mov rdx, rax
call qword [0x1400464b0]
lea rdx, [rsp + 0x720]
xor ecx, ecx
call qword [0x140046448]
lea rcx, [rsp + 0x720]
call qword [0x140046490]
test eax, eax
jne 0x14000b235
lea rcx, str._GetDefaultLogPath.SHCreateDirectory_failed
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, ebp
mov rbx, qword [rsp + 0xd78]
mov rcx, qword [rsp + 0xd50]
xor rcx, rsp
call fcn.140028300
lea r11, [rsp + 0xd60]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test edi, edi
je 0x14000b251
lea rdx, [rsp + 0x720]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 1
jmp 0x14000b208
lea rcx, [rsp + 0x932]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x930], bp
call fcn.14002ea20
xor eax, eax
lea rbx, [fcn.14000b090]
lea rdx, [rsp + 0x60]
lea r8d, [rax + 0x30]
mov rcx, rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000b4d3
cmp dword [rsp + 0x80], 0x1000
jne 0x14000b4d3
lea rcx, [rsp + 0x98]
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x90], rbx
call fcn.14002ea20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea rax, [fcn.1400097c0]
test rax, rax
je 0x14000b3bf
lea rcx, [rsp + 0x2a4]
xor edx, edx
mov r8d, 0x434
call fcn.14002ea20
mov edx, ebx
mov ecx, 8
mov dword [rsp + 0x2a0], 0x438
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000b3bf
lea rdx, [rsp + 0x2a0]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x14000b3b6
nop dword [rax]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x2b8]
mov r8d, dword [rsp + 0x2c0]
cmp rcx, rdx
ja 0x14000b376
lea rax, [rdx + r8]
cmp rcx, rax
jae 0x14000b39a
cmp rcx, rdx
jb 0x14000b384
lea rax, [rdx + r8]
cmp rcx, rax
jbe 0x14000b39a
lea rdx, [rsp + 0x2a0]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x14000b350
jmp 0x14000b3b6
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x98]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [rsp + 0x98], bp
je 0x14000b4d3
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x930]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
lea rcx, [rsp + 0x50]
mov word [rsp + 0x6e0], bp
mov qword [rsp + 0x6e2], rax
mov qword [rsp + 0x6ea], rax
mov qword [rsp + 0x6f2], rax
mov qword [rsp + 0x6fa], rax
mov qword [rsp + 0x702], rax
mov qword [rsp + 0x70a], rax
mov qword [rsp + 0x712], rax
mov dword [rsp + 0x71a], eax
mov word [rsp + 0x71e], ax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x58]
movzx edx, word [rsp + 0x56]
movzx r8d, word [rsp + 0x52]
movzx r11d, word [rsp + 0x5c]
movzx eax, word [rsp + 0x5a]
movzx r9d, word [rsp + 0x50]
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
lea rcx, [rsp + 0x6e0]
lea r8, str._04d_02d_02d_02d_02d_02d
mov edx, 0x20
call qword [0x140046498]
lea rcx, [rsp + 0x930]
call qword [0x140046488]
lea r9, [rsp + 0x6e0]
lea r8, [rsp + 0x720]
lea rdx, str._s_s__s_0.log
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov eax, 1
jmp 0x14000b208
lea rcx, str._GetDefaultLogPath.YProcGetModuleNameAt_failed
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, ebp
jmp 0x14000b208
mov eax, ebp
jmp 0x14000b210