Function at 0x140002a80
Capabilities:
Enumerate process modules
Parse pe header

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x378
mov rax, qword [0x14001ced8]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov r15, r8
mov dword [rsp + 0x60], 0x238
mov rbp, rdx
mov r12, rcx
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x234
mov r13, r9
call fcn.140004950
test r12, r12
je 0x140002d2c
test rbp, rbp
je 0x140002d2c
xor edx, edx
mov qword [rsp + 0x3b0], rbx
lea ecx, [rdx + 8]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rax
call sub.KERNEL32.dll_Module32First
mov ebx, 1
test eax, eax
je 0x140002d20
mov qword [rsp + 0x370], rsi
mov ebx, 0x80000000
mov qword [rsp + 0x368], rdi
mov edi, 0x5a4d
mov qword [rsp + 0x360], r14
nop dword [rax]
mov rsi, qword [rsp + 0x88]
lea rcx, [rsp + 0x2b4]
xor edx, edx
mov r8d, 0x90
call fcn.140004950
lea rcx, [rsp + 0x2b0]
mov dword [rsp + 0x2b0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140002b74
cmp dword [rsp + 0x2c0], 2
je 0x140002b7d
cmp rsi, rbx
jae 0x140002cec
test rsi, rsi
je 0x140002cec
mov edx, 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002cec
cmp word [rsi], di
jne 0x140002cec
movsxd rbx, dword [rsi + 0x3c]
mov edx, pe_nt_image_headers64
add rbx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002ce7
cmp dword [rbx], 0x4550
jne 0x140002ce7
mov eax, dword [rbx + 0x90]
test eax, eax
je 0x140002ce7
lea rbx, [rsi + rax]
mov eax, dword [rsi + rax + 0xc]
test eax, eax
je 0x140002c0c
nop dword [rax + rax]
mov ecx, eax
mov rdx, r12
add rcx, rsi
call fcn.1400070dc
test eax, eax
je 0x140002c0c
mov eax, dword [rbx + 0x20]
add rbx, 0x14
test eax, eax
jne 0x140002bf0
cmp dword [rbx + 0xc], 0
je 0x140002ce7
mov edi, dword [rbx]
mov r14d, dword [rbx + 0x10]
add rdi, rsi
add r14, rsi
mov rax, qword [rdi]
test rax, rax
je 0x140002ce2
js 0x140002c74
lea rbx, [rax + rsi]
mov edx, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140002c74
movzx eax, byte [rbx + 2]
lea rdx, [rbx + 2]
test al, al
je 0x140002c74
xor ebx, ebx
cmp byte [rbp], al
jne 0x140002c70
mov rcx, rbp
call fcn.1400070dc
test eax, eax
jne 0x140002c70
test r15, r15
mov eax, 1
cmovne ebx, eax
test ebx, ebx
jne 0x140002c87
mov rax, qword [rdi + 8]
add rdi, 8
add r14, 8
test rax, rax
jne 0x140002c2e
jmp 0x140002ce2
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rdx, qword [rsp + 0x40]
lea r9, [rsp + 0x4c]
mov rcx, qword [rsp + 0x28]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test r13, r13
je 0x140002cc2
mov rax, qword [r14]
mov qword [r13], rax
mov r8d, dword [rsp + 0x4c]
lea r9, [rsp + 0x2a0]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [r14], r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, 0x5a4d
mov ebx, 0x80000000
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x60]
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x140002b30
mov r14, qword [rsp + 0x360]
mov ebx, 1
mov rdi, qword [rsp + 0x368]
mov rsi, qword [rsp + 0x370]
mov eax, ebx
mov rbx, qword [rsp + 0x3b0]
jmp 0x140002d2e
xor eax, eax
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400032f0
add rsp, 0x378
pop r15
pop r13
pop r12
pop rbp
ret