Function at 0x1400019c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3280
call fcn.14004bec0
sub rsp, rax
mov rax, qword [0x140064040]
xor rax, rsp
mov qword [rsp + 0x3270], rax
mov r13, r8
mov qword [rsp + 0x28], rdx
mov rbp, rdx
lea r8, [rsp + 0x3c]
mov r12, rcx
mov edx, 0x1000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140001c92
mov esi, dword [rsp + 0x3c]
xor edi, edi
shr esi, 2
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x20], edi
test esi, esi
je 0x140001c92
mov r8d, dword [rsp + rdi*4 + 0x60]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x140001c84
lea r9, [rsp + 0x38]
mov r8d, 0x2000
lea rdx, [rsp + 0x1060]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140001c7b
xor r15d, r15d
test dword [rsp + 0x38], 0xfffffff8
jbe 0x140001c7b
nop dword [rax + rax]
mov rdx, qword [rsp + r15*8 + 0x1060]
lea r8, [rsp + 0x3060]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x140001c60
lea rdx, [rsp + 0x3060]
lea rcx, [rsp + 0x40]
call fcn.140001ed0
cmp qword [r12 + 0x18], 7
mov r11, r12
mov rbx, qword [r12 + 0x10]
jbe 0x140001add
mov r11, qword [r12]
mov r14, qword [rsp + 0x58]
lea rdi, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
cmp r14, 7
mov rax, qword [rsp + 0x50]
cmova rdi, rsi
cmp rbx, rax
ja 0x140001c24
sub rax, rbx
test rbx, rbx
je 0x140001b9d
movzx r10d, word [r11]
lea rbp, [rdi + 2]
lea rbp, [rbp + rax*2]
mov rcx, rdi
nop
mov rax, rbp
mov edx, 0
sub rax, rcx
sar rax, 1
je 0x140001b4c
cmp word [rcx], r10w
je 0x140001b49
cmp rax, 1
je 0x140001b4c
add rcx, 2
dec rax
cmp word [rcx], r10w
jne 0x140001b36
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140001c1f
mov r8, rbx
mov rdx, r11
test rbx, rbx
je 0x140001b88
mov r9, rcx
sub r9, r11
nop dword [rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140001c16
add rdx, 2
sub r8, 1
jne 0x140001b70
mov rbp, qword [rsp + 0x28]
sub rcx, rdi
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x140001c24
cmp qword [r13 + 0x18], 7
mov r9, r13
jbe 0x140001bab
mov r9, qword [r13]
cmp qword [rbp + 0x18], 7
mov r8, rbp
jbe 0x140001bb9
mov r8, qword [rbp]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x140001c24
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14, 7
jbe 0x140001c11
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001c09
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001cbf
mov rcx, rsi
call fcn.14004ad74
mov rax, rbx
jmp 0x140001c94
add rcx, 2
jmp 0x140001b20
mov rbp, qword [rsp + 0x28]
cmp r14, 7
jbe 0x140001c5b
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001c53
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001cbf
mov rcx, rsi
call fcn.14004ad74
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
inc r15d
shr eax, 3
cmp r15d, eax
jb 0x140001a90
mov edi, dword [rsp + 0x20]
mov esi, dword [rsp + 0x24]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
mov dword [rsp + 0x20], edi
cmp edi, esi
jb 0x140001a33
xor eax, eax
mov rcx, qword [rsp + 0x3270]
xor rcx, rsp
call fcn.14004ad10
mov rbx, qword [rsp + 0x32c0]
add rsp, 0x3280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3