Function at 0x1400115b0
Capabilities:
Enumerate process modules
Get process image filename
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x236e8]
mov eax, 0x237e8
call fcn.14000e0a0
sub rsp, rax
mov rax, qword [0x14001f088]
xor rax, rsp
mov qword [rbp + 0x236d0], rax
mov r13, qword [rbp + 0x23730]
mov edi, dword [rbp + 0x23738]
mov dword [rsp + 0x30], edi
mov rax, qword [rbp + 0x23740]
mov qword [rsp + 0x38], rax
mov r15d, dword [rbp + 0x23748]
mov r12, qword [rbp + 0x23750]
test r15d, r15d
jne 0x14001193f
xor esi, esi
mov edi, esi
mov dword [rbp - 0x50], esi
lea r8, [rbp - 0x50]
mov edx, 0x1000
lea rcx, [rbp + 0x21c10]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x14001173d
mov edi, dword [rbp - 0x50]
shr edi, 2
xorps xmm0, xmm0
movaps xmmword [rbp + 0x22c10], xmm0
movaps xmmword [rbp + 0x22c20], xmm0
movaps xmmword [rbp + 0x22c30], xmm0
movaps xmmword [rbp + 0x22c40], xmm0
movaps xmmword [rbp + 0x22c50], xmm0
movaps xmmword [rbp + 0x22c60], xmm0
movaps xmmword [rbp + 0x22c70], xmm0
movaps xmmword [rbp + 0x22c80], xmm0
mov r8d, edi
lea rdx, str.Found__i_processes_n
lea rcx, [rbp + 0x22c10]
call fcn.14000e280
lea rcx, [rbp + 0x22c10]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbx, rsi
mov r15d, esi
mov r12d, edi
test edi, edi
je 0x14001192a
mov r14, rsi
nop word [rax + rax]
mov r8d, dword [rbp + r14*4 + 0x21c10]
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
cmove rdi, rsi
test rbx, rbx
je 0x140011701
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rdi
mov qword [rsp + 0x40], rbx
test rdi, rdi
je 0x1400118b7
mov r8d, 0x104
lea rdx, [rbp + 0x22e90]
mov rcx, rbx
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
mov eax, eax
test rax, rax
jne 0x1400117bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400117bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x22c90], xmm0
movaps xmmword [rbp + 0x22ca0], xmm0
movaps xmmword [rbp + 0x22cb0], xmm0
movaps xmmword [rbp + 0x22cc0], xmm0
movaps xmmword [rbp + 0x22cd0], xmm0
movaps xmmword [rbp + 0x22ce0], xmm0
movaps xmmword [rbp + 0x22cf0], xmm0
movaps xmmword [rbp + 0x22d00], xmm0
mov r8d, eax
lea rdx, str.EnumProcesses_failed_with_error_code:0x_08x_n
lea rcx, [rbp + 0x22c90]
call fcn.14000e280
lea rcx, [rbp + 0x22c90]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebx, ebx
jle 0x1400117b2
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x140011b4d
jmp 0x1400116b1
mov eax, esi
test eax, eax
je 0x140011820
xorps xmm0, xmm0
movaps xmmword [rbp + 0x22d10], xmm0
movaps xmmword [rbp + 0x22d20], xmm0
movaps xmmword [rbp + 0x22d30], xmm0
movaps xmmword [rbp + 0x22d40], xmm0
movaps xmmword [rbp + 0x22d50], xmm0
movaps xmmword [rbp + 0x22d60], xmm0
movaps xmmword [rbp + 0x22d70], xmm0
movaps xmmword [rbp + 0x22d80], xmm0
mov r8d, eax
lea rdx, str.GetProcessImageFileName_failed_with_error_code:0x_08x_n
lea rcx, [rbp + 0x22d10]
call fcn.14000e280
lea rcx, [rbp + 0x22d10]
jmp 0x140011915
mov word [rbp + 0x23096], si
mov edx, 0x5c
lea rcx, [rbp + 0x22e90]
call sub.VCRUNTIME140.dll_wcsrchr
mov rdi, rax
test rax, rax
je 0x140011846
add rdi, 2
jmp 0x14001184d
lea rdi, [rbp + 0x22e90]
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14001191b
lea r8, [rbp + 0x232b0]
mov rdx, qword [rsp + 0x38]
mov rcx, rdi
call fcn.140010cd0
mov ecx, r15d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9, rax
mov r8d, dword [rsp + 0x30]
mov edx, dword [rbp + rcx*4 + 0x21c10]
mov rcx, rbx
call fcn.140011560
test eax, eax
js 0x140011b2c
test rbx, rbx
je 0x140011a88
lfence
mov rcx, qword [rsp + 0x40]
jmp 0x140011a82
call qword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x22d90], xmm0
movaps xmmword [rbp + 0x22da0], xmm0
movaps xmmword [rbp + 0x22db0], xmm0
movaps xmmword [rbp + 0x22dc0], xmm0
movaps xmmword [rbp + 0x22dd0], xmm0
movaps xmmword [rbp + 0x22de0], xmm0
movaps xmmword [rbp + 0x22df0], xmm0
movaps xmmword [rbp + 0x22e00], xmm0
mov r8d, eax
lea rdx, str.OpenProcess_failed_with_error_code:0x_08x_n
lea rcx, [rbp + 0x22d90]
call fcn.14000e280
lea rcx, [rbp + 0x22d90]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
inc r15d
inc r14
cmp r14, r12
jl 0x1400116d0
mov rdx, r13
lea rcx, str.Could_not_find_executable:__s_n
call fcn.14000e023
nop
jmp 0x140011a7a
mov r8d, r15d
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor esi, esi
cmp rax, 0xffffffffffffffff
cmove rbx, rsi
mov qword [rsp + 0x48], rbx
mov r8d, 0x104
lea rdx, [rbp + 0x230a0]
mov rcx, rbx
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
mov eax, eax
test rax, rax
jne 0x1400119ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400119ed
xorps xmm0, xmm0
movaps xmmword [rbp + 0x22e10], xmm0
movaps xmmword [rbp + 0x22e20], xmm0
movaps xmmword [rbp + 0x22e30], xmm0
movaps xmmword [rbp + 0x22e40], xmm0
movaps xmmword [rbp + 0x22e50], xmm0
movaps xmmword [rbp + 0x22e60], xmm0
movaps xmmword [rbp + 0x22e70], xmm0
movaps xmmword [rbp + 0x22e80], xmm0
mov r8d, eax
lea rdx, str.GetProcessImageFileName_failed_with_error_code:0x_08x_n
lea rcx, [rbp + 0x22e10]
call fcn.14000e280
lea rcx, [rbp + 0x22e10]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140011a7a
mov word [rbp + 0x232a6], si
mov edx, 0x5c
lea rcx, [rbp + 0x230a0]
call sub.VCRUNTIME140.dll_wcsrchr
mov r14, rax
test rax, rax
je 0x140011a13
add r14, 2
jmp 0x140011a1a
lea r14, [rbp + 0x230a0]
xor edx, edx
mov r8d, 0x11a40
lea rcx, [rbp + 0x101d0]
call sub.VCRUNTIME140.dll_memset
mov edx, r15d
lea rcx, [rbp + 0x101d0]
call fcn.14000e1bd
nop
mov r13, qword [rsp + 0x38]
mov esi, edi
mov r8d, 0xffffffff
mov rdx, rbx
lea rcx, [rbp + 0x101d0]
call fcn.14000e177
test eax, eax
je 0x140011a6d
sub eax, 1
je 0x140011aab
sub eax, 1
je 0x140011aab
cmp eax, 1
je 0x140011a43
lea rcx, [rbp + 0x101d0]
call fcn.14000e064
nop
test rbx, rbx
je 0x140011a88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x236d0]
xor rcx, rsp
call fcn.14000e1b3
add rsp, 0x237e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [rbp + 0x101d0]
call fcn.14000e1b8
mov rdi, rax
mov rdx, r12
lea rcx, [rbp - 0x40]
call fcn.14000e226
mov rdx, r13
test rdi, rdi
je 0x140011ad7
mov rdx, rdi
mov esi, dword [rdi + 0x208]
lea r8, [rbp + 0x234c0]
mov rcx, r14
call fcn.140010cd0
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdi
mov r9, rax
mov r8d, esi
mov edx, r15d
mov rcx, rbx
call fcn.140011560
mov edi, eax
lea rcx, [rbp - 0x40]
call fcn.14000e352
mov rdx, rax
lea rcx, [rbp + 0x101d0]
call fcn.14000e0b4
test edi, edi
js 0x140011b6e
mov edi, dword [rsp + 0x30]
jmp 0x140011a43
lfence
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.14000e096
lea rdx, [0x14001ea48]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lfence
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.14000e096
lea rdx, [0x14001ea48]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lfence
mov edx, edi
lea rcx, [rbp - 0x70]
call fcn.14000e096
lea rdx, [0x14001ea48]
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3