Function at 0x402f60
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x338
movaps xmmword [rsp + 0x320], xmm6
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
movups xmm1, xmmword [rdx]
movups xmmword [rsp + 0xc8], xmm1
mov qword [rsp + 0x40], rdx
movups xmm1, xmmword [rdx]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xa0], rax
mov ecx, 0x18
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x403377
mov r13, rax
lea rsi, [rsp + 0xe0]
mov r8d, 0x238
mov rcx, rsi
mov dl, 0xaa
call fcn.00440060
mov dword [rsp + 0xe0], 0x238
mov rcx, r13
mov rdx, rsi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x403387
mov qword [rsp + 0x48], rdi
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x110]
mov rdi, 0xffffffffffffffff
xorps xmm6, xmm6
xor r14d, r14d
xor esi, esi
mov qword [rsp + 0x38], r13
jmp 0x4030ef
xor r15d, r15d
mov r13, qword [rsp + 0x38]
mov rax, r14
add rax, 0xffffffffffffffff
lea rax, [rax + rax*4]
shl rax, 4
lea rcx, [r12 + rax]
mov rdx, qword [rsp + 0xf8]
mov qword [rcx], rdx
mov ecx, dword [rsp + 0x100]
mov dword [r12 + rax + 0x48], ecx
mov qword [r12 + rax + 8], rbx
mov qword [r12 + rax + 0x10], r15
mov rcx, qword [rsp + 0x108]
mov qword [r12 + rax + 0x18], rcx
movups xmmword [r12 + rax + 0x20], xmm6
movups xmmword [r12 + rax + 0x30], xmm6
mov qword [r12 + rax + 0x40], 0
mov rcx, r13
lea rdx, [rsp + 0xe0]
call sub.KERNEL32.dll_Module32Next
cmp eax, 1
lea rdx, [rsp + 0x110]
jne 0x4033da
mov r13, r14
inc r14
je 0x4034d3
cmp rsi, r14
jae 0x4032ae
mov r15, rsi
nop word [rax + rax]
mov rax, r15
shr rax, 1
add rax, 8
add r15, rax
cmovb r15, rdi
cmp r15, r14
jb 0x403110
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov r10, qword [rax + 8]
test rsi, rsi
je 0x403189
mov rax, rsi
mov r9d, 0x50
mul r9
jo 0x4034d3
mov r8, rax
mov rax, r15
mul r9
mov rbp, rax
seto byte [rsp + 0x58]
seto bl
test bl, bl
jne 0x4031b0
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov rdx, r12
mov r9b, 3
call qword [r10 + 8]
test al, 1
je 0x40319c
mov rsi, r15
jmp 0x4032a6
mov rax, r15
mov edx, 0x50
mul rdx
mov rbp, rax
seto bl
jmp 0x4031b0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov r10, qword [rax + 8]
nop dword [rax + rax]
mov r9, qword [rsp + 0x378]
mov byte [rsp + 0x58], bl
test bl, bl
mov qword [rsp + 0x50], r9
jne 0x40342f
test rbp, rbp
je 0x403203
mov rdx, rbp
mov r8b, 3
call qword [r10]
test rax, rax
je 0x40342f
mov rbx, rax
mov rcx, rax
mov dl, 0xaa
mov r8, rbp
call fcn.00440060
test bl, 7
jne 0x40350f
cmp r13, r15
jbe 0x403213
jmp 0x4034bf
mov rbx, 0xfffffffffffffff8
cmp r13, r15
ja 0x4034bf
mov rax, r13
shl rax, 4
lea r8, [rax + rax*4]
lea rax, [r12 + r8]
cmp rbx, rax
jae 0x403234
lea rax, [rbx + r8]
cmp r12, rax
jb 0x4034fb
mov rcx, rbx
mov rdx, r12
call fcn.0043fd00
mov rax, rsi
shl rax, 4
test rsi, rsi
movabs rcx, 0xaaaaaaaaaaaaaaaa
cmove r12, rcx
lea rbp, [rax + rax*4]
cmove rbp, rsi
test rbp, rbp
je 0x4032a0
mov rax, qword [rsp + 0x40]
mov rsi, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp + 0x68], rax
mov rcx, r12
mov dl, 0xaa
mov r8, rbp
call fcn.00440060
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, r12
mov r8, rbp
mov r9b, 3
mov rax, qword [rsp + 0x68]
call qword [rax + 0x10]
mov rsi, r15
mov r12, rbx
lea rdx, [rsp + 0x110]
cmp r13, rsi
jae 0x4034e7
mov rax, qword [rsp + 0x40]
mov r13, qword [rax]
mov rbp, qword [rax + 8]
mov byte [rsp + 0x20], 0
mov r15d, 0x100
mov r8d, 0x100
lea rcx, [rsp + 0x58]
xor r9d, r9d
call fcn.004196e0
cmp byte [rsp + 0x60], 0
je 0x4032ed
mov r15, qword [rsp + 0x58]
cmp r15, 0x101
jae 0x4034bf
mov ebx, 1
xor eax, eax
test al, al
jne 0x403070
test r15, r15
je 0x40333d
mov r9, qword [rsp + 0x378]
mov rcx, r13
mov rdx, r15
xor r8d, r8d
call qword [rbp]
test rax, rax
je 0x403070
mov rcx, rax
mov dl, 0xaa
mov r8, r15
mov rbx, rax
call fcn.00440060
jmp 0x403344
mov rbx, 0xffffffffffffffff
mov r13, qword [rsp + 0x38]
lea rdx, [rsp + 0x110]
lea rax, [rdx + r15]
cmp rbx, rax
jae 0x403367
lea rax, [rbx + r15]
cmp rax, rdx
ja 0x4034fb
mov rcx, rbx
mov r8, r15
call fcn.0043fd00
jmp 0x403078
call sub.KERNEL32.dll_GetLastError
mov word [rdi + 0x50], 0xf
jmp 0x4034a3
mov rcx, r13
call sub.ntdll.dll_NtClose
test eax, eax
jne 0x4034e7
movups xmm0, xmmword [0x00445180]
movups xmmword [rdi + 0x40], xmm0
movups xmm0, xmmword [0x00445170]
movups xmmword [rdi + 0x30], xmm0
movups xmm0, xmmword [0x00445160]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [0x00445150]
movups xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [0x00445140]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x50], 0x13
jmp 0x4034a3
mov rcx, r13
call sub.ntdll.dll_NtClose
test eax, eax
jne 0x4034e7
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 0x30], rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movups xmmword [rcx + 0x20], xmm2
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx], xmm0
mov qword [rcx + 0x38], r12
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], rsi
mov word [rcx + 0x50], 0
jmp 0x4034a3
mov rcx, qword [rsp + 0x38]
call sub.ntdll.dll_NtClose
test eax, eax
jne 0x4034e7
mov rax, rsi
shl rax, 4
test rsi, rsi
movabs rcx, 0xaaaaaaaaaaaaaaaa
cmove r12, rcx
lea rbx, [rax + rax*4]
cmove rbx, rsi
test rbx, rbx
je 0x403498
mov rax, qword [rsp + 0x40]
mov rsi, qword [rax]
mov rdi, qword [rax + 8]
mov rcx, r12
mov dl, 0xaa
mov r8, rbx
call fcn.00440060
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, r12
mov r8, rbx
mov r9b, 3
call qword [rdi + 0x10]
mov rax, qword [rsp + 0x48]
mov word [rax + 0x50], 0x11
movaps xmm6, xmmword [rsp + 0x320]
add rsp, 0x338
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.index_out_of_bounds
mov edx, 0x13
xor r9d, r9d
call fcn.00402230
lea rcx, str.integer_overflow
mov edx, 0x10
xor r9d, r9d
call fcn.00402230
lea rcx, str.reached_unreachable_code
mov edx, 0x18
xor r9d, r9d
call fcn.00402230
lea rcx, str._memcpy_arguments_alias
mov edx, 0x17
xor r9d, r9d
call fcn.00402230
lea rcx, [0x00444f85]
mov edx, 0x13
xor r9d, r9d
call fcn.00402230
int3