Function at 0x14006d4e8
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3c8]
sub rsp, 0x4a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r13, rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
mov ebx, 4
mov qword [rsp + 0x50], rbx
and qword [rsp + 0x58], 0
lea rcx, vtable.micro::utils::QArray_int_.0
mov qword [rsp + 0x38], rcx
xor r15d, r15d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [method.micro::utils::QArray_void____ptr64_.virtual_8]
mov edi, 0x400
mov eax, ebx
mul rdi
lea rcx, [rbx - 5]
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rsi, rax
and dword [rsp + 0x20], r15d
lea r8, [rsp + 0x20]
mov edx, 0x1000
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_K32EnumProcesses]
test eax, eax
je 0x14006d5ee
mov ecx, dword [rsp + 0x20]
shr ecx, 2
xor edi, edi
mov r14d, ecx
test ecx, ecx
jle 0x14006d5f9
mov ebx, dword [rsi + rdi*4]
lea rcx, [rsp + 0x38]
call fcn.140005788
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov dword [rax + rcx*4], ebx
inc qword [rsp + 0x48]
inc rdi
cmp rdi, r14
jl 0x14006d5c5
jmp 0x14006d5f9
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r15d, eax
jmp 0x14006d5fe
mov edi, 0x400
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
test r15d, r15d
jne 0x14006d77d
xor esi, esi
movsxd r14, dword [rsp + 0x48]
test r14, r14
jle 0x14006d77d
lea rbx, vtable.micro::utils::QString.0
mov rax, qword [rsp + 0x58]
mov r12d, dword [rax + rsi*4]
mov r8d, r12d
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov r15, rax
test rax, rax
je 0x14006d771
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [r13 + 0x60]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
mov qword [rsp + 0x28], rbx
and qword [rsp + 0x30], 0
mov r8d, eax
lea rdx, [0x140111df8]
lea rcx, [rsp + 0x28]
call fcn.1400e7a18
lea r8, [0x14012da68]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
cmovne r8, rcx
lea rbx, [r13 + 0x58]
mov edx, edi
mov rcx, rbx
call fcn.1400442f8
mov r8d, r12d
lea rdx, [0x14011d814]
lea rcx, [rsp + 0x28]
call fcn.1400e7a18
mov r8d, 0x208
lea rdx, [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_K32GetProcessImageFileNameW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rax
or r8d, 0xffffffff
lea rcx, [rsp + 0x60]
call fcn.1400e6fc8
lea r9, [0x14012da68]
mov rax, qword [rsp + 0x30]
test rax, rax
cmovne r9, rax
mov r8d, 1
mov edx, edi
mov rcx, rbx
call fcn.14003adc0
lea r9, [0x14012da68]
mov rax, qword [rsp + 0x68]
test rax, rax
cmovne r9, rax
mov r8d, 2
mov edx, edi
mov rcx, rbx
call fcn.14003adc0
lea r9, [rbp - 0x80]
mov r8d, 3
mov edx, edi
mov rcx, rbx
call fcn.14003adc0
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rbx, vtable.micro::utils::QString.0
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x60]
call fcn.1400e712c
nop
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0x28]
call fcn.1400e712c
mov edi, 0x400
inc rsi
cmp rsi, r14
jl 0x14006d627
lea rax, vtable.micro::utils::QBaseArray.0
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14006d799
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140001010
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret