Function at 0x140001600
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3280
call fcn.1400bb790
sub rsp, rax
mov rax, qword [0x140136100]
xor rax, rsp
mov qword [rsp + 0x3270], rax
mov r13, r8
mov qword [rsp + 0x28], rdx
mov rbp, rdx
lea r8, [rsp + 0x3c]
mov r12, rcx
mov edx, 0x1000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140001912
mov esi, dword [rsp + 0x3c]
xor edi, edi
shr esi, 2
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x20], edi
test esi, esi
je 0x140001912
mov r8d, dword [rsp + rdi*4 + 0x60]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x140001904
lea r9, [rsp + 0x38]
mov r8d, 0x2000
lea rdx, [rsp + 0x1060]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400018fb
xor r15d, r15d
test dword [rsp + 0x38], 0xfffffff8
jbe 0x1400018fb
nop dword [rax + rax]
mov rdx, qword [rsp + r15*8 + 0x1060]
lea r8, [rsp + 0x3060]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1400018e0
xorps xmm0, xmm0
mov qword [rsp + 0x50], 0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x3060]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140001720
lea rdx, [rsp + 0x3060]
lea rcx, [rsp + 0x40]
call fcn.140001b90
cmp qword [r12 + 0x18], 7
mov r11, r12
mov rbx, qword [r12 + 0x10]
jbe 0x140001751
mov r11, qword [r12]
mov r14, qword [rsp + 0x58]
lea rdi, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
cmp r14, 7
mov rax, qword [rsp + 0x50]
cmova rdi, rsi
cmp rbx, rax
ja 0x1400018a4
sub rax, rbx
test rbx, rbx
je 0x14000181d
movzx r10d, word [r11]
lea rbp, [rdi + 2]
lea rbp, [rbp + rax*2]
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
mov rax, rbp
mov edx, 0
sub rax, rcx
sar rax, 1
je 0x1400017cc
cmp word [rcx], r10w
je 0x1400017c9
cmp rax, 1
je 0x1400017cc
add rcx, 2
dec rax
cmp word [rcx], r10w
jne 0x1400017b6
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14000189f
mov r8, rbx
mov rdx, r11
test rbx, rbx
je 0x140001808
mov r9, rcx
sub r9, r11
nop dword [rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140001896
add rdx, 2
sub r8, 1
jne 0x1400017f0
mov rbp, qword [rsp + 0x28]
sub rcx, rdi
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x1400018a4
cmp qword [r13 + 0x18], 7
mov r9, r13
jbe 0x14000182b
mov r9, qword [r13]
cmp qword [rbp + 0x18], 7
mov r8, rbp
jbe 0x140001839
mov r8, qword [rbp]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x1400018a4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14, 7
jbe 0x140001891
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001889
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000193f
mov rcx, rsi
call fcn.1400bad8c
mov rax, rbx
jmp 0x140001914
add rcx, 2
jmp 0x1400017a0
mov rbp, qword [rsp + 0x28]
cmp r14, 7
jbe 0x1400018db
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400018d3
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000193f
mov rcx, rsi
call fcn.1400bad8c
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
inc r15d
shr eax, 3
cmp r15d, eax
jb 0x1400016d0
mov edi, dword [rsp + 0x20]
mov esi, dword [rsp + 0x24]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
mov dword [rsp + 0x20], edi
cmp edi, esi
jb 0x140001673
xor eax, eax
mov rcx, qword [rsp + 0x3270]
xor rcx, rsp
call fcn.1400bad30
mov rbx, qword [rsp + 0x32c0]
add rsp, 0x3280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400c14a8
int3