Function at 0x140005ea0
Capabilities:
Enumerate process modules
Get session user name

Disassembly:
push rbp
lea rbp, [rsp - 0x824b0]
mov eax, 0x825b0
call fcn.1400367f0
sub rsp, rax
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rbp + 0x82490], rax
mov qword [rsp + 0x825c0], rbx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x825d0], rdi
lea rcx, [rbp + 0x8160]
mov qword [rsp + 0x825d8], r12
mov dword [rsp + 0x30], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rcx, [rbp + 0x8160]
call fcn.140005c10
lea r8, [rsp + 0x34]
mov edx, 0x2000
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
movups xmm0, xmmword [str._unknown_]
mov r12d, dword [rsp + 0x34]
lea rcx, [rbp + 0x7f64]
mov ebx, dword [0x14006c8f8]
xor edx, edx
mov r8d, 0x1f4
movaps xmmword [rbp + 0x7f50], xmm0
shr r12d, 2
mov dword [rbp + 0x7f60], ebx
call fcn.14005dc90
movups xmm0, xmmword [str._unknown_]
movabs rax, 0x20002c0020
mov dword [rbp + 0x20a20], ebx
xor edx, edx
mov qword [rbp + 0x7f40], rax
mov r8d, 0x30d2c
movaps xmmword [rbp + 0x20a10], xmm0
lea rcx, [rbp + 0x20a24]
call fcn.14005dc90
xor ebx, ebx
mov edi, ebx
test r12d, r12d
je 0x140006080
mov qword [rsp + 0x825c8], rsi
mov qword [rsp + 0x825a8], r14
lea r14, [rsp + 0x40]
mov qword [rsp + 0x825a0], r15
lea r15, [rbp + 0x3f40]
nop dword [rax]
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140006055
mov ecx, edi
lea r9, [rbp + 0x1f40]
lea rdx, [rbp + 0x3f40]
mov r8d, 8
lea r9, [r9 + rcx*4]
lea rdx, [rdx + rcx*8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140006055
mov rdx, qword [r15]
lea r8, [rbp + 0x7f50]
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea r8, [rbp + 0x7f50]
mov edx, 0x186a0
lea rcx, [rbp + 0x20a10]
call fcn.14003f028
lea r8, [rbp + 0x7f40]
mov edx, 0x186a0
lea rcx, [rbp + 0x20a10]
call fcn.14003f028
mov rcx, rsi
call qword [0x140079a68]
inc edi
add r14, 4
add r15, 8
cmp edi, r12d
jb 0x140005fc0
mov r15, qword [rsp + 0x825a0]
mov r14, qword [rsp + 0x825a8]
mov rsi, qword [rsp + 0x825c8]
mov r8d, 0x186a0
lea rdx, [rbp + 0x20a10]
lea rcx, [rbp + 0x8370]
call fcn.14003f624
mov r12, qword [rsp + 0x825d8]
mov rdi, qword [rsp + 0x825d0]
nop dword [rax]
movzx eax, byte [rbp + rbx + 0x8370]
test al, al
je 0x140006126
add al, 3
mov byte [rbp + rbx + 0x8370], al
movzx eax, byte [rbp + rbx + 0x8371]
test al, al
je 0x140006126
add al, 3
mov byte [rbp + rbx + 0x8371], al
movzx eax, byte [rbp + rbx + 0x8372]
test al, al
je 0x140006126
add al, 3
mov byte [rbp + rbx + 0x8372], al
movzx eax, byte [rbp + rbx + 0x8373]
test al, al
je 0x140006126
add al, 3
mov byte [rbp + rbx + 0x8373], al
movzx eax, byte [rbp + rbx + 0x8374]
test al, al
je 0x140006126
add al, 3
mov byte [rbp + rbx + 0x8374], al
add rbx, 5
cmp rbx, 0x186a0
jl 0x1400060b0
xor edx, edx
lea rcx, [rbp + 0x51750]
mov r8d, 0x30d40
call fcn.14005dc90
mov rbx, qword [rsp + 0x825c0]
lea rax, [rbp + 0x8370]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x140006150
lea rax, [rbp + 0x51750]
mov dword [rsp + 0x28], 0x186a0
lea r8, [rbp + 0x8370]
mov qword [rsp + 0x20], rax
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0x51750]
call fcn.140005c10
mov rcx, qword [rbp + 0x82490]
xor rcx, rsp
call fcn.140035c80
add rsp, 0x825b0
pop rbp
ret