Function at 0x140001600
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov r15, rcx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0x438
mov edx, dword [0x1400066d0]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
xor esi, esi
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x390]
call fcn.140001ed0
nop
lea rcx, [rbp + 0x390]
mov r14, qword [rbp + 0x3a8]
cmp r14, 8
setae dl
mov rbx, qword [rbp + 0x390]
cmovae rcx, rbx
mov rax, qword [rbp + 0x3a0]
lea r12, [rcx + rax*2]
lea rdi, [rbp + 0x390]
test dl, dl
cmovne rdi, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
mov qword [rbp + 0x380], rsi
cmp rdi, r12
jne 0x1400016e7
mov r8d, esi
mov esi, 0xf
mov qword [rbp + 0x388], rsi
mov byte [rbp + 0x370], r8b
jmp 0x140001813
mov rax, r12
sub rax, rdi
sar rax, 1
mov ebx, 0xf
mov qword [rbp + 0x388], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140001a7a
cmp rax, 0x10
jb 0x1400017a0
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000172a
mov rbx, rcx
jmp 0x140001737
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140001781
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a74
mov rcx, rax
call fcn.140002330
mov rcx, rax
test rax, rax
je 0x140001a5f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000178f
test rcx, rcx
je 0x14000178d
call fcn.140002330
jmp 0x14000178f
xor eax, eax
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x388], rbx
nop dword [rax]
lea rcx, [rbp + 0x370]
cmp rbx, 0x10
cmovae rcx, qword [rbp + 0x370]
movzx eax, byte [rdi]
mov byte [rsi + rcx], al
mov rsi, qword [rbp + 0x380]
inc rsi
mov qword [rbp + 0x380], rsi
add rdi, 2
cmp rdi, r12
je 0x1400017dc
mov rbx, qword [rbp + 0x388]
jmp 0x1400017a0
lea rax, [rbp + 0x370]
cmp qword [rbp + 0x388], 0x10
cmovae rax, qword [rbp + 0x370]
mov byte [rsi + rax], 0
mov r14, qword [rbp + 0x3a8]
mov rbx, qword [rbp + 0x390]
mov rsi, qword [rbp + 0x388]
mov r8, qword [rbp + 0x380]
mov rdx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x140001820
mov rdx, qword [r15]
lea rcx, [rbp + 0x370]
cmp rsi, 0x10
setae r12b
mov rdi, qword [rbp + 0x370]
cmovae rcx, rdi
cmp r8, qword [r15 + 0x10]
jne 0x14000184d
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001967
test r12b, r12b
je 0x140001891
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000187b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a5f
mov rcx, rdi
call fcn.14000236c
mov r14, qword [rbp + 0x3a8]
mov rbx, qword [rbp + 0x390]
cmp r14, 8
jb 0x1400018cc
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400018c4
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a66
mov rcx, rbx
call fcn.14000236c
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14000166a
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x140001926
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140001921
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a6d
mov rcx, r8
call fcn.14000236c
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 0xf
mov byte [r15], al
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140002310
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
cmp rsi, 0x10
jb 0x1400019ad
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400019a4
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a5f
mov rcx, rdi
call fcn.14000236c
nop
mov rdx, qword [rbp + 0x3a8]
cmp rdx, 8
jb 0x1400019ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a66
call fcn.14000236c
xor edi, edi
mov qword [rbp + 0x3a0], rdi
mov qword [rbp + 0x3a8], 7
mov word [rbp + 0x390], di
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x140001a40
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140001a3b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a58
mov rcx, r8
call fcn.14000236c
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rax, rbx
jmp 0x140001937
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001100
int3
call fcn.1400011a0
int3