Function at 0x14021e55f
Capabilities:
Enumerate process modules

Disassembly:
push rax
pushf
mov eax, 0x12dc7565
pushf
not eax
add eax, 0x86b41540
xor eax, 0x87dc4bc5
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xf88d2040
xor eax, 0xbc083e37
rol eax, 0xae
popf
pushf
not eax
add eax, 0xdea58046
xor eax, 0xe599c9d9
rol eax, 0x30
popf
pushf
not eax
add eax, 0x9b0b7532
xor eax, 0xd4ef01d7
rol eax, 0x87
popf
cmp eax, 4
jne 0x14021e5c2
popf
pop rax
jmp 0x14021e94a
cmp eax, 0
jne 0x14021e5d1
popf
pop rax
jmp 0x14021e658
cmp eax, 3
jne 0x14021e5e0
popf
pop rax
jmp 0x14021e8ea
cmp eax, 1
jne 0x14021e5ef
popf
pop rax
jmp 0x14021e797
cmp eax, 0xa
jne 0x14021e5fe
popf
pop rax
jmp 0x14021eb96
cmp eax, 7
jne 0x14021e60d
popf
pop rax
jmp 0x14021ea2b
cmp eax, 6
jne 0x14021e61c
popf
pop rax
jmp 0x14021e9c7
cmp eax, 2
jne 0x14021e62b
popf
pop rax
jmp 0x14021e866
cmp eax, 9
jne 0x14021e63a
popf
pop rax
jmp 0x14021eb24
cmp eax, 8
jne 0x14021e649
popf
pop rax
jmp 0x14021eac1
cmp eax, 5
jne 0x14021e658
popf
pop rax
jmp 0x14021e9ba
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0xbee1c27a
pushf
not eax
add eax, 0xbb714385
xor eax, 0xe6f444a6
rol eax, 0x30
popf
pushf
not eax
add eax, 0x9e27217d
xor eax, 0xcd19d191
rol eax, 0x45
popf
pushf
not eax
add eax, 0x811e65a6
xor eax, 0xd442d3a3
rol eax, 0x16
popf
call fcn.1402c8c14
sub rsp, rax
mov rax, qword [0x14010a0d0]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rdi, rdx
mov qword [rsp + 0x28], rdx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], rcx
mov qword [rdx + 8], rcx
mov qword [rdx + 0x10], rcx
mov dword [rsp + 0x20], 1
jmp 0x14021e6e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0xbeb42233
pushf
not ecx
add ecx, 0x8aec9512
xor ecx, 0xc4670081
rol ecx, 0x8f
popf
pushf
not ecx
add ecx, 0x9f17e1a8
xor ecx, 0xe5e85968
rol ecx, 0x40
popf
jmp 0x14021e723
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x14021e764
push rax
pushf
mov eax, 0xd61efcaf
pushf
not eax
add eax, 0xc8ea2e12
xor eax, 0xa2c58e88
rol eax, 0x35
popf
pushf
not eax
add eax, 0x9d3a4896
xor eax, 0x9df046be
rol eax, 0xe7
popf
jmp 0x14021e5b3
push rax
pushf
mov eax, 0x7f4a8f1a
pushf
not eax
add eax, 0xda588459
xor eax, 0xd01f968e
rol eax, 0x56
popf
pushf
not eax
add eax, 0x8322e77d
xor eax, 0x97002be4
rol eax, 0x98
popf
jmp 0x14021e5b3
lea r9, [rsp + 0x30]
mov r8d, 0xa8097a1a
pushf
not r8d
add r8d, 0xebe69909
xor r8d, 0x942d9b9c
rol r8d, 0xe
popf
pushf
not r8d
add r8d, 0xca90a49c
xor r8d, 0xe5190f2a
rol r8d, 0x35
popf
pushf
not r8d
add r8d, 0xf3c25be9
xor r8d, 0xbd18d68e
rol r8d, 0xcc
popf
lea rdx, [rsp + 0x40]
mov rcx, rax
jmp 0x14021e7f6
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14021e833
push rax
pushf
mov eax, 0x5f0affd2
pushf
not eax
add eax, 0xb79a62f1
xor eax, 0xd1e51344
rol eax, 0xf7
popf
pushf
not eax
add eax, 0xf91ab72e
xor eax, 0xcbd601fd
rol eax, 0xfe
popf
jmp 0x14021e5b3
push rax
pushf
mov eax, 0x3f1b43d5
pushf
not eax
add eax, 0xdaea2722
xor eax, 0xfcc6cef6
rol eax, 0x91
popf
pushf
not eax
add eax, 0xed2e7a63
xor eax, 0x91b9a852
rol eax, 0x79
popf
jmp 0x14021e5b3
mov eax, dword [rsp + 0x30]
shr eax, 3
test eax, eax
je 0x14021e8a4
push rax
pushf
mov eax, 0xa82e3327
pushf
not eax
add eax, 0xced061b2
xor eax, 0xdca72778
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xdedd6258
xor eax, 0xebe35d2e
rol eax, 0x1b
popf
jmp 0x14021e5b3
push rax
pushf
mov eax, 0xa1178627
pushf
not eax
add eax, 0xcf481243
xor eax, 0xf06b27b4
rol eax, 0x64
popf
pushf
not eax
add eax, 0xd36970bb
xor eax, 0xac86000a
rol eax, 0x71
popf
pushf
not eax
add eax, 0xfca2c10d
xor eax, 0x91363ebb
rol eax, 0xf2
popf
jmp 0x14021e5b3
lea rbx, [rsp + 0x40]
mov esi, eax
push rax
pushf
mov eax, 0x744c2fa6
pushf
not eax
add eax, 0x83a9484c
xor eax, 0x9baf72b6
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xdcb7982e
xor eax, 0xb9143ca3
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xfccdf7f7
xor eax, 0x8dba3d5d
rol eax, 0x80
popf
pushf
not eax
add eax, 0xde215434
xor eax, 0xb9866565
rol eax, 0x1e
popf
jmp 0x14021e5b3
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14021e987
push rax
pushf
mov eax, 0x598eba3b
pushf
not eax
add eax, 0xa6d087fb
xor eax, 0xec85aa2f
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xc9c83369
xor eax, 0xb5571984
rol eax, 0x46
popf
jmp 0x14021e5b3
push rax
pushf
mov eax, 0xbfb86c70
pushf
not eax
add eax, 0xebbe208b
xor eax, 0xf3027bda
rol eax, 0x49
popf
pushf
not eax
add eax, 0xe53563dc
xor eax, 0xd395e21d
rol eax, 0x48
popf
jmp 0x14021e5b3
mov rax, qword [rbx]
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x14021ea2b
mov r8, rbx
mov rcx, rdi
call fcn.1403334d8
push rax
pushf
mov eax, 0xb33552a2
pushf
not eax
add eax, 0xe4f0e319
xor eax, 0x9ed23c28
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xc24ba313
xor eax, 0xd36af669
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x8d1b09db
xor eax, 0xf7f0d4c9
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xadb2dd5f
xor eax, 0xe05ac0a5
rol eax, 0x47
popf
jmp 0x14021e5b3
add rbx, 8
sub rsi, 1
jne 0x14021ea68
push rax
pushf
mov eax, 0x29f0edba
pushf
not eax
add eax, 0xd1f13057
xor eax, 0xfb143502
rol eax, 0x38
popf
pushf
not eax
add eax, 0xa8cf08a5
xor eax, 0x8a7bf42d
rol eax, 0x44
popf
jmp 0x14021e5b3
push rax
pushf
mov eax, 0xbf92f173
pushf
not eax
add eax, 0xe015cee4
xor eax, 0xa7b6e23b
rol eax, 0x20
popf
pushf
not eax
add eax, 0xcb60b794
xor eax, 0xd0b00d15
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xec055405
xor eax, 0xd68e6810
rol eax, 0x38
popf
pushf
not eax
add eax, 0xca359681
xor eax, 0x800bb868
rol eax, 0xd6
popf
jmp 0x14021e5b3
mov rcx, rbp
jmp 0x14021eac5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x8416b055
pushf
not eax
add eax, 0x9ab4af8c
xor eax, 0xf783d11b
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xb144a9cb
xor eax, 0xde875900
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xc0e69b89
xor eax, 0xc2ac483c
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xcc56a765
xor eax, 0xf2c90b9e
rol eax, 0xcd
popf
jmp 0x14021e5b3
mov rax, rdi
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.1402ac965
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
int3