Function at 0x14006f7e0
Capabilities:
Enumerate process modules
Get file version info

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d8]
sub rsp, 0x2d8
lea rdx, [0x1401c9770]
mov ecx, 0x1000
call fcn.140183500
mov r14, rax
test rax, rax
je 0x14006fed3
mov ebx, 0x2000
lea r8, [rbp + 0x228]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14006fed3
mov dil, 1
mov ecx, dword [rbp + 0x228]
mov rsi, 0xffffffffffffffff
cmp rcx, rbx
jne 0x14006f8e0
test dil, dil
je 0x14006f8e0
add rbx, rbx
mov rcx, r14
call fcn.140183144
mov eax, 4
mul rbx
cmovo rax, rsi
lea rdx, [0x1401c9770]
mov rcx, rax
call fcn.140183500
mov r14, rax
test rax, rax
jne 0x14006f8b7
xor ecx, ecx
call fcn.140183144
shr rbx, 1
mov eax, 4
mul rbx
cmovo rax, rsi
lea rdx, [0x1401c9770]
mov rcx, rax
call fcn.140183500
mov r14, rax
xor dil, dil
lea r8, [rbp + 0x228]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14006fed3
mov ecx, dword [rbp + 0x228]
cmp rcx, rbx
je 0x14006f855
shr ecx, 2
test ecx, ecx
je 0x14006fec7
mov eax, ecx
mov qword [rbp - 0x48], rax
xor r15d, r15d
mov eax, r15d
mov qword [rsp + 0x58], rax
nop dword [rax]
mov r12d, dword [r14 + rax*4]
mov r8d, r12d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14006feb0
call fcn.140031bd0
test rax, rax
je 0x14006fee9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + SafeArrayPutElement]
lea r8, [rax + 0x18]
mov qword [rsp + 0x20], r8
mov dword [rbp + 0x230], 0x104
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14006f978
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.1400320e0
mov r8, qword [rsp + 0x20]
lea r9, [rbp + 0x230]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
nop
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x14006f99a
mov ecx, r15d
jmp 0x14006f9b6
movsxd rdx, dword [rax - 0xc]
mov rcx, rax
call fcn.140189f5c
mov rcx, rax
test eax, eax
js 0x14006ff20
mov rax, qword [rsp + 0x20]
cmp ecx, dword [rax - 0xc]
jg 0x14006ff20
mov dword [rax - 0x10], ecx
mov ecx, ecx
mov rax, qword [rsp + 0x20]
mov word [rax + rcx*2], r15w
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
call fcn.140031bd0
test rax, rax
je 0x14006ff15
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140031e00
test al, al
jne 0x14006fa3b
test rbx, rbx
jne 0x14006fa17
mov eax, r15d
jmp 0x14006fa2a
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14006fa20
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140032190
nop
call fcn.140031bd0
test rax, rax
je 0x14006ff0a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.140031bd0
test rax, rax
je 0x14006feff
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
jne 0x14006fabd
xor r8d, r8d
lea rdx, [0x1401e3cf8]
lea rcx, [rsp + 0x40]
call fcn.140032190
xor r8d, r8d
lea rdx, [0x1401e3cf8]
lea rcx, [rsp + 0x38]
call fcn.140032190
jmp 0x14006fc00
mov rdx, rdi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x14006fc00
mov r9, rax
mov r8d, edi
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea r9, [rbp - 0x6c]
lea r8, [rbp - 0x40]
lea rdx, [0x1401e3cf4]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
lea r9, [rbp - 0x68]
lea r8, [rsp + 0x48]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14006fbf7
mov rax, qword [rsp + 0x48]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
lea rdx, str.StringFileInfo_04x_04xFileDescription
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [rsp + 0x48]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
lea rdx, str.StringFileInfo_04x_04xProductVersion
lea rcx, [rbp + 0xd0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rbp + 0x238]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14006fba8
mov rdx, qword [rbp - 0x60]
test rdx, rdx
jne 0x14006fb8e
mov eax, r15d
jmp 0x14006fb9b
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14006fb91
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.140032190
lea r9, [rbp + 0x238]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14006fbf7
mov rdx, qword [rbp - 0x58]
test rdx, rdx
jne 0x14006fbd5
mov eax, r15d
jmp 0x14006fbea
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14006fbe0
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140032190
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rsi, qword [rsp + 0x30]
add rsi, 0xffffffffffffffe8
mov rcx, rsi
call fcn.1400318c0
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14006fef4
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14006fc48
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.1400320e0
mov rbx, qword [rsp + 0x28]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1401925bc
lea rcx, [rbx - 0x18]
cmp edi, dword [rcx + 0xc]
jg 0x14006fef4
mov dword [rcx + 8], edi
mov word [rbx + rdi*2], r15w
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.14004e1a0
mov r8d, eax
lea rdx, [0x1401e56d0]
lea rcx, [rsp + 0x28]
call fcn.140025c80
mov r15, qword [rsp + 0x28]
lea rcx, [r15 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], r12d
mov rcx, rsi
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x20]
add rcx, 0xffffffffffffffe8
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x78], rax
mov r13, qword [rsp + 0x38]
lea rcx, [r13 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x80], rax
mov r12, qword [rsp + 0x40]
lea rcx, [r12 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x220]
mov rdi, qword [rax + 8]
mov rbx, qword [rax]
cmp rbx, rdi
je 0x14006fd3a
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14006f750
test al, al
je 0x14006fd3a
add rbx, 0x30
cmp rbx, rdi
jne 0x14006fd20
mov rdi, qword [rbp + 0x220]
mov rax, qword [rdi + 8]
cmp rbx, rax
jne 0x14006fd74
cmp rax, qword [rdi + 0x10]
je 0x14006fd64
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140028320
add qword [rdi + 8], 0x30
jmp 0x14006fd74
lea r8, [rsp + 0x60]
mov rdx, rax
mov rcx, rdi
call fcn.140072190
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006fda3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006fdc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006fdde
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006fdfc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006fe1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebx
lock xadd dword [r15 - 8], eax
sub eax, 1
jg 0x14006fe37
mov rcx, qword [r15 - 0x18]
mov rax, qword [rcx]
lea rdx, [r15 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebx
lock xadd dword [r12 - 8], eax
sub eax, 1
jg 0x14006fe56
mov rcx, qword [r12 - 0x18]
mov rax, qword [rcx]
lea rdx, [r12 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebx
lock xadd dword [r13 - 8], eax
sub eax, 1
jg 0x14006fe72
mov rcx, qword [r13 - 0x18]
mov rax, qword [rcx]
lea rdx, [r13 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebx
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14006fe8b
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006fea9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r15d, r15d
lea rsi, [r15 - 1]
mov rax, qword [rsp + 0x58]
inc rax
mov qword [rsp + 0x58], rax
cmp rax, qword [rbp - 0x48]
jl 0x14006f900
mov rcx, r14
call fcn.140183144
mov al, 1
jmp 0x14006fed5
xor al, al
add rsp, 0x2d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80070057
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80070057
call fcn.140032160
int3