Function at 0x140003e50
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2260]
mov eax, 0x2360
call fcn.140071640
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x23b0], rbx
mov rax, qword [0x14009f008]
xor rax, rsp
mov qword [rbp + 0x2250], rax
mov r13, rcx
cmp dword [rcx + 0x17c], 0
jne 0x140004505
mov qword [rbp - 0x70], 0xf
xor ebx, ebx
mov qword [rbp - 0x78], rbx
mov byte [rsp + 0x78], bl
cmp byte [rdx], bl
jne 0x140003ebe
mov r8d, ebx
jmp 0x140003ecb
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], bl
jne 0x140003ec2
lea rcx, [rsp + 0x78]
call fcn.140002500
nop
mov eax, 1
mov r8, qword [rbp - 0x78]
test r8, r8
je 0x140004458
lea r14, [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x70]
cmp rcx, 0x10
cmovae r14, rdx
lea rax, [rsp + 0x78]
cmovae rax, rdx
add rax, r8
lea rsi, [rsp + 0x78]
cmp rcx, 0x10
cmovae rsi, rdx
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, rbx
test rdi, rdi
je 0x140003f47
nop dword [rax]
movsx ecx, byte [rbx + rsi]
call fcn.14005db04
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jne 0x140003f30
xor ebx, ebx
mov r8d, dword [r13 + 0x70]
xor edx, edx
mov ecx, 0x1410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140004412
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x2030]
call fcn.14005b700
mov dword [rsp + 0x44], 0x104
xor r12b, r12b
lea r9, [rsp + 0x44]
lea r8, [rbp + 0x2030]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
cmp byte [rbp + 0x2030], r12b
je 0x140004405
lea rax, [rbp - 0x58]
mov qword [rbp - 0x60], rax
lea rax, [rbp + 0x2030]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003fc0
inc ebx
lea r8, [rbp - 0x58]
mov edx, ebx
lea rcx, [rbp - 0x60]
call fcn.140002c80
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp + 0x2030]
mov rcx, qword [rbp - 0x60]
call fcn.140001490
test eax, eax
je 0x140004029
cmp eax, 0xc
je 0x14000401e
cmp eax, 0x16
je 0x140004013
cmp eax, 0x22
je 0x140004013
cmp eax, 0x50
je 0x140004029
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
nop
mov qword [rsp + 0x70], 0xf
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x58], bl
mov rdx, qword [rbp - 0x60]
cmp byte [rdx], bl
jne 0x14000404a
mov r8d, ebx
jmp 0x140004059
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], bl
jne 0x140004050
lea rcx, [rsp + 0x58]
call fcn.140002500
nop
lea rax, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x140004076
call fcn.14005d6dc
lea r14, [rsp + 0x58]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
cmovae r14, r8
lea rcx, [rsp + 0x58]
cmovae rcx, r8
mov rax, qword [rsp + 0x68]
add rax, rcx
lea rsi, [rsp + 0x58]
cmp rdx, 0x10
cmovae rsi, r8
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, rbx
test rdi, rdi
je 0x1400040d5
nop dword [rax]
movsx ecx, byte [rbx + rsi]
call fcn.14005db04
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jne 0x1400040c0
mov r9d, 0xb
lea rdx, str.wwahost.exe
lea rcx, [rsp + 0x58]
call fcn.1400059f0
movzx ebx, r12b
cmp rax, 0xffffffffffffffff
mov eax, 1
cmovne ebx, eax
lea rcx, [rsp + 0x58]
call fcn.140002380
test bl, bl
je 0x140004405
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x40]
mov r8d, 0x2000
lea rdx, [rbp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModulesEx]
mov r12d, ebx
cmp dword [r13 + 0x17c], ebx
jne 0x140004405
mov eax, dword [rsp + 0x40]
shr eax, 3
cmp r12d, eax
jae 0x140004405
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x2140]
call fcn.14005b700
mov edx, r12d
mov r9d, 0x104
lea r8, [rbp + 0x2140]
mov rdx, qword [rbp + rdx*8 + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x1400043d4
cmp byte [rbp + 0x2140], 0
je 0x1400043d4
lea rax, [rbp - 0x58]
mov qword [rbp - 0x60], rax
lea rax, [rbp + 0x2140]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400041b0
inc ebx
lea r8, [rbp - 0x58]
mov edx, ebx
lea rcx, [rbp - 0x60]
call fcn.140002c80
movsxd rdx, ebx
mov r9, rdx
lea r8, [rbp + 0x2140]
mov rcx, qword [rbp - 0x60]
call fcn.140001490
test eax, eax
je 0x140004208
cmp eax, 0xc
je 0x1400043fa
cmp eax, 0x16
je 0x1400043ef
cmp eax, 0x22
je 0x1400043ef
cmp eax, 0x50
jne 0x1400043e4
mov qword [rsp + 0x70], 0xf
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov byte [rsp + 0x58], r15b
mov rdx, qword [rbp - 0x60]
cmp byte [rdx], r15b
jne 0x14000422c
mov r8d, r15d
jmp 0x140004239
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r15b
jne 0x140004230
lea rcx, [rsp + 0x58]
call fcn.140002500
nop
lea rax, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x140004256
call fcn.14005d6dc
lea r14, [rsp + 0x58]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x70]
cmp r9, 0x10
cmovae r14, r8
lea rax, [rsp + 0x58]
cmovae rax, r8
mov rbx, qword [rsp + 0x68]
add rax, rbx
lea rsi, [rsp + 0x58]
cmp r9, 0x10
cmovae rsi, r8
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, r15
test rdi, rdi
je 0x1400042c4
mov rbx, r15
movsx ecx, byte [rbx + rsi]
call fcn.14005db04
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jne 0x1400042a0
mov r9, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
mov r15, qword [rbp - 0x78]
lea r14, [rsp + 0x78]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
cmovae r14, rcx
test r15, r15
je 0x140004378
test rbx, rbx
je 0x1400043c5
cmp r15, rbx
ja 0x1400043c5
sub rbx, r15
inc rbx
lea rsi, [rsp + 0x58]
cmp r9, 0x10
cmovae rsi, r8
nop dword [rax]
test rbx, rbx
je 0x1400043c5
movsx edx, byte [r14]
mov r8, rbx
mov rcx, rsi
call fcn.14005b364
mov rdi, rax
test rax, rax
je 0x1400043c5
mov r8, r15
mov rdx, r14
mov rcx, rax
call fcn.140071810
test eax, eax
je 0x140004355
sub rsi, rdi
dec rsi
add rbx, rsi
lea rsi, [rdi + 1]
jmp 0x140004310
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rax, qword [rsp + 0x58]
sub rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x1400043c5
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rsp + 0x78]
mov dword [r13 + 0x17c], 2
lea rax, [rsp + 0x78]
cmp rdx, 0x10
cmovae rax, rcx
mov qword [rsp + 0x30], rax
lea rax, str._s_module_is_in_memory.
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 5]
lea r8, [0x1400a3128]
mov edx, 0x1ad
lea rcx, str...SharedAudioSession.cpp
call fcn.140002ed0
nop
lea rcx, [rsp + 0x58]
call fcn.140002380
mov r15, qword [rsp + 0x48]
inc r12d
cmp dword [r13 + 0x17c], 0
jmp 0x14000413e
mov ecx, 0x80004005
call fcn.1400015b0
int3
mov ecx, 0x80070057
call fcn.1400015b0
int3
mov ecx, 0x8007000e
call fcn.1400015b0
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x140004453
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
mov eax, dword [r13 + 0x70]
mov dword [rsp + 0x30], eax
lea rax, str.Failed_to_open_a_process___d___Error_code___d.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, 5
lea r8, [0x1400a3128]
mov edx, 0x1b9
lea rcx, str...SharedAudioSession.cpp
call fcn.140002ed0
mov eax, 1
cmp dword [r13 + 0x17c], 0
jne 0x1400044ae
mov dword [r13 + 0x17c], eax
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, str._s_module_is_not_in_memory.
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, 5
lea r8, [0x1400a3128]
mov edx, 0x1c0
lea rcx, str...SharedAudioSession.cpp
call fcn.140002ed0
nop
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x140004505
inc rax
mov rcx, qword [rsp + 0x78]
cmp rax, 0x1000
jb 0x140004500
test cl, 0x1f
je 0x1400044d3
call fcn.14005d52c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400044e2
call fcn.14005d52c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400044f1
call fcn.14005d52c
int3
cmp rcx, 0x27
jbe 0x1400044fd
call fcn.14005d52c
int3
mov rcx, rax
call fcn.14003a87c
cmp dword [r13 + 0x17c], 2
sete al
mov rcx, qword [rbp + 0x2250]
xor rcx, rsp
call fcn.14003a8a0
mov rbx, qword [rsp + 0x23b0]
add rsp, 0x2360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret