Function at 0x1400010d0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x7a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x790], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov dword [0x140005680], 0xfafafbdb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
lea rcx, str.___ProcessId:_0x_x_n
mov edi, eax
call fcn.140001070
xor edx, edx
lea rcx, [rsp + 0x6c0]
mov r8d, 0xc8
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x480], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000116f
lea rcx, str.___Unable_to_create_a_snapshot_n
call fcn.140001070
jmp 0x1400011ff
lea rdx, [rsp + 0x480]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rcx, rbx
cmp dword [rsp + 0x488], edi
je 0x1400011a9
lea rdx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400011ff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x4ac]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400011c0
add r8, r8
je 0x1400011ff
cmp r8, 0x64
ja 0x1400011ed
lea rdx, [rsp + 0x4ac]
lea rcx, [rsp + 0x6c0]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400011ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
lea rdx, [rsp + 0x6c0]
lea rcx, str.___Process_Name:__s_n
call fcn.140001010
mov edx, edi
mov dword [rsp + 0x30], 0x438
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000123f
lea rcx, str.___Unable_to_create_a_snapshot_n
call fcn.140001070
jmp 0x1400012a3
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000129a
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x6c0]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001284
add rax, 2
test ecx, ecx
jne 0x140001270
mov rcx, rbx
test edx, edx
je 0x1400012d5
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140001260
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___Unable_to_find_the_module_address._n
call fcn.140001070
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x790]
xor rcx, rsp
call fcn.140001380
mov rbx, qword [rsp + 0x7b0]
add rsp, 0x7a0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400012a3
mov rdx, rbx
lea rcx, str.___Process_Module_Address:_0x_p_n
call fcn.140001070
xor edi, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
inc r8d
mov dword [rsp + 0x470], r8d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea r8, [rsp + 0x470]
lea rdx, [rbx + 0x5680]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [0x140005680]
lea rcx, str.___New_MyNum_Value:__d_n
call fcn.140001070
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400012f6