Function at 0x1400e4b90
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
xor sil, sil
mov byte [rbp - 0x51], sil
xor ebx, ebx
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], rbx
mov ecx, 0x1000
call fcn.140057728
mov qword [rbp - 0x39], rax
xor ecx, ecx
mov byte [rbp - 0x50], cl
movzx r8d, cl
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.140042070
mov r15, qword [rbp - 0x39]
mov qword [rbp - 0x11], r15
mov rdi, qword [rbp - 0x31]
mov qword [rbp - 9], rdi
lea r8, [rbp - 0x4d]
mov edx, 0x1000
mov rcx, r15
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
mov edx, dword [rbp - 0x4d]
shr edx, 2
mov dword [rbp - 0x4d], edx
mov dword [rbp - 0x41], ebx
or r13d, 0xffffffff
test edx, edx
je 0x1400e504f
nop
mov r8d, dword [r15]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x1400e5007
mov byte [rbp - 0x51], 1
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x49], rbx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea r8, [rax + 0x18]
mov qword [rbp - 0x59], r8
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400e4caa
mov edx, 0x104
lea rcx, [rbp - 0x59]
call fcn.14001e8d0
mov r8, qword [rbp - 0x59]
xor edx, edx
mov r9d, 0x104
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov r12d, eax
mov rcx, qword [rbp - 0x59]
movsxd rdx, dword [rcx - 0xc]
call fcn.14005e508
mov rdx, rax
test eax, eax
js 0x1400e503c
mov rax, qword [rbp - 0x59]
cmp edx, dword [rax - 0xc]
jg 0x1400e503c
mov dword [rax - 0x10], edx
movsxd rcx, edx
mov rax, qword [rbp - 0x59]
xor edx, edx
mov word [rax + rcx*2], dx
lea rdi, [0x14011629c]
mov rax, qword [rbp - 0x59]
mov rsi, rax
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1400e4d10
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
sete cl
test cl, cl
je 0x1400e4db3
lea r9, [rbp - 0x21]
mov r8d, 8
lea rdx, [rbp - 0x29]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x1400e4daf
mov r8, qword [rbp - 0x59]
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400e4d64
mov edx, 0x104
lea rcx, [rbp - 0x59]
call fcn.14001e8d0
mov r8, qword [rbp - 0x59]
mov r9d, 0x104
mov rdx, qword [rbp - 0x29]
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov r12d, eax
mov rcx, qword [rbp - 0x59]
movsxd rdx, dword [rcx - 0xc]
call fcn.14005e508
mov rdx, rax
test eax, eax
js 0x1400e5026
mov rax, qword [rbp - 0x59]
cmp edx, dword [rax - 0xc]
jg 0x1400e5026
mov dword [rax - 0x10], edx
movsxd rcx, edx
mov rax, qword [rbp - 0x59]
xor edx, edx
mov word [rax + rcx*2], dx
mov rax, qword [rbp - 0x59]
xor edx, edx
lea rdi, [0x1401162d4]
mov rsi, rax
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1400e4dce
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
sete cl
test cl, cl
je 0x1400e4e4c
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x104
or ecx, edx
jge 0x1400e4dfe
mov edx, 0x104
lea rcx, [rbp - 0x59]
call fcn.14001e8d0
mov rax, qword [rbp - 0x59]
mov r8d, 0x104
mov rdx, rax
mov rcx, r14
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
mov r12d, eax
mov rcx, qword [rbp - 0x59]
movsxd rdx, dword [rcx - 0xc]
call fcn.14005e508
mov rdx, rax
test eax, eax
js 0x1400e5031
mov rax, qword [rbp - 0x59]
cmp edx, dword [rax - 0xc]
jg 0x1400e5031
mov dword [rax - 0x10], edx
movsxd rcx, edx
mov rax, qword [rbp - 0x59]
xor edx, edx
mov word [rax + rcx*2], dx
mov rax, qword [rbp - 0x59]
xor edx, edx
lea rdi, [0x1401164d4]
mov rsi, rax
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1400e4e67
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
setne cl
test cl, cl
je 0x1400e4fcc
test r12d, r12d
js 0x1400e4fcc
mov edx, 0x5c
mov rcx, rax
call fcn.14005f4c4
mov rdx, qword [rbp - 0x59]
test rax, rax
je 0x1400e4f36
sub rax, rdx
sar rax, 1
test eax, eax
jle 0x1400e4f36
mov r8d, dword [rdx - 0x10]
sub r8d, eax
dec r8d
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x59]
call fcn.14001f240
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400e4f15
cmp dword [rbx + 0x10], 0
jl 0x1400e4f07
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400e4f07
call fcn.14001e5d0
mov rdi, rax
mov eax, r13d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e4efd
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x49], rax
jmp 0x1400e4f15
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x49]
call fcn.14001e490
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e4f8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400e4f8a
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400e4f8a
cmp dword [rbx + 0x10], 0
jl 0x1400e4f7d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400e4f7d
call fcn.14001e5d0
mov rdi, rax
mov eax, r13d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e4f73
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x49], rax
jmp 0x1400e4f8a
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x49]
call fcn.14001e490
lea rdx, [rbp - 0x49]
mov rsi, qword [rbp + 0x6f]
mov rcx, rsi
call fcn.14000f990
mov r8, rax
lea rdx, [rbp + 7]
mov rcx, rsi
call fcn.14000ffd0
lea rdx, [rbp - 0x59]
mov rdi, qword [rbp + 0x77]
mov rcx, rdi
call fcn.14000f990
mov r8, rax
lea rdx, [rbp + 0x17]
mov rcx, rdi
call fcn.14000ffd0
mov rax, qword [rbp - 0x59]
lea rdx, [rax - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e4fe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e5007
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x41]
inc eax
mov dword [rbp - 0x41], eax
add r15, 4
cmp eax, dword [rbp - 0x4d]
jae 0x1400e5047
jmp 0x1400e4c30
mov ecx, 0x80070057
call fcn.14001e940
int3
mov ecx, 0x80070057
call fcn.14001e940
int3
mov ecx, 0x80070057
call fcn.14001e940
nop
mov rdi, qword [rbp - 0x31]
movzx esi, byte [rbp - 0x51]
test rdi, rdi
je 0x1400e5077
lock dec dword [rdi + 8]
jne 0x1400e5077
mov rdi, qword [rbp - 0x31]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 8]
lock dec dword [rdi + 0xc]
jne 0x1400e5077
mov rcx, qword [rbp - 0x31]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
movzx eax, sil
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret