Function at 0x14000a030
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2500]
mov eax, 0x2600
call fcn.1400ab010
sub rsp, rax
mov rax, qword [0x1400da180]
xor rax, rsp
mov qword [rbp + 0x24f0], rax
mov qword [rsp + 0x38], r9
mov r13, rdx
mov qword [rsp + 0x28], rdx
xor r12d, r12d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x14000a0d3
mov word [rsp + 0x20], 0x48
mov byte [rsp + 0x21], r12b
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
lea rax, [rsp + 0x21]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x14000a0c0
lea rdx, [rsp + 0x21]
jmp 0x14000a6fe
mov r9d, 0x104
lea r8, [rbp + 0x22e0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
mov rcx, rbx
test eax, eax
jne 0x14000a133
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [rsp + 0x20], 0x1f
mov byte [rsp + 0x21], r12b
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
lea rax, [rsp + 0x21]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], r12b
jne 0x14000a120
lea rdx, [rsp + 0x21]
jmp 0x14000a6fe
lea r9, [rsp + 0x60]
mov r8d, 0x2000
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
mov rsi, 0xffffffffffffffff
test eax, eax
je 0x14000a6bf
mov ecx, r12d
mov dword [rsp + 0x20], ecx
test dword [rsp + 0x60], 0xfffffff8
jbe 0x14000a6bf
movabs rdi, 0x7ffffffffffffffe
movabs r15, 0x7fffffffffffffff
nop dword [rax]
nop word [rax + rax]
mov edx, ecx
mov r9d, 0x104
lea r8, [rbp + 0x20d0]
mov rdx, qword [rbp + rdx*8 + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x14000a6a6
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea rax, [rbp + 0x20d0]
mov rbx, rsi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000a1d3
cmp rbx, rdi
ja 0x14000a83f
cmp rbx, 7
ja 0x14000a21b
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x20d0]
lea rcx, [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x68], r12w
jmp 0x14000a2bc
mov r14, rbx
or r14, 7
cmp r14, rdi
jbe 0x14000a230
mov r14, rdi
lea rcx, [r15 + r15]
jmp 0x14000a256
cmp r14, 0xa
mov eax, 0xa
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, r15
ja 0x14000a839
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000a282
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a839
mov rcx, rax
call fcn.1400aa600
test rax, rax
je 0x14000a832
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000a294
test rcx, rcx
je 0x14000a291
call fcn.1400aa600
mov rdi, rax
jmp 0x14000a294
mov rdi, r12
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x20d0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rbx], r12w
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 7
seta r8b
cmova rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
lea r14, [rdx + rax*2]
lea rdi, [rsp + 0x68]
test r8b, r8b
cmovne rdi, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
cmp rdi, r14
jne 0x14000a310
mov r14, r12
mov ecx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x40], 0
jmp 0x14000a417
sub r14, rdi
sar r14, 1
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
cmp r14, r15
ja 0x14000a851
mov ebx, reloc.WS2_32.dll_ntohs
cmp r14, rbx
jbe 0x14000a3cd
mov rbx, r14
or rbx, 0xf
cmp rbx, r15
jbe 0x14000a355
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000a37c
cmp rbx, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000a3a8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a845
mov rcx, rax
call fcn.1400aa600
mov rcx, rax
test rax, rax
je 0x14000a82b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
jmp 0x14000a3d2
test rcx, rcx
je 0x14000a3be
call fcn.1400aa600
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
jmp 0x14000a3d2
mov rax, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
jmp 0x14000a3d2
mov rax, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, r14
test r14, r14
je 0x14000a403
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x14000a3f0
mov qword [rsp + 0x50], r14
mov byte [r8 + r14], 0
mov rcx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov byte [rsp + 0x24], 0x58
mov al, 4
xor edx, edx
xor al, 0x58
mov byte [rsp + 0x25], al
mov byte [rsp + 0x26], dl
lea rax, [rsp + 0x25]
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], dl
jne 0x14000a432
lea rdi, [rsp + 0x40]
cmp rcx, 0xf
seta r12b
mov r15, qword [rsp + 0x40]
cmova rdi, r15
test rbx, rbx
je 0x14000a4c7
test r14, r14
je 0x14000a4c7
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x25]
lea rdx, [rsp + 0x25]
add rdx, rbx
lea rax, [rsp + 0x25]
cmp rax, rdx
je 0x14000a490
movzx eax, byte [rcx]
mov byte [rbp + rax - 0x30], 1
inc rcx
cmp rcx, rdx
jne 0x14000a480
lea rax, [r14 - 1]
mov rbx, rsi
cmp rax, rsi
cmovb rbx, rax
add rbx, rdi
movzx eax, byte [rbx]
cmp byte [rbp + rax - 0x30], 0
jne 0x14000a4c2
nop dword [rax + rax]
cmp rbx, rdi
je 0x14000a4c7
dec rbx
movzx eax, byte [rbx]
cmp byte [rbp + rax - 0x30], 0
je 0x14000a4b0
sub rbx, rdi
jmp 0x14000a4ca
mov rbx, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov r8, rbx
cmp r14, rbx
cmovb r8, r14
lea rdx, [rsp + 0x40]
test r12b, r12b
cmovne rdx, r15
lea rcx, [rbp - 0x58]
call fcn.140004580
nop
inc rbx
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xor r12d, r12d
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jb 0x14000a84b
sub rax, rbx
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
add rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.140004580
mov r15, qword [rsp + 0x38]
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14000a55a
mov rdx, qword [r15]
lea rcx, [rbp - 0x78]
mov rdi, qword [rbp - 0x60]
cmp rdi, 0xf
seta r14b
mov rbx, qword [rbp - 0x78]
cmova rcx, rbx
mov r8, qword [rbp - 0x68]
cmp r8, qword [r15 + 0x10]
jne 0x14000a589
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000a736
test r14b, r14b
je 0x14000a5c0
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000a5b7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a81d
mov rcx, rbx
call fcn.1400aa63c
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14000a5fc
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a5f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a824
call fcn.1400aa63c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000a639
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a634
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a82b
call fcn.1400aa63c
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x14000a68d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a688
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a832
call fcn.1400aa63c
movabs r15, 0x7fffffffffffffff
movabs rdi, 0x7ffffffffffffffe
mov rbx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
inc ecx
mov dword [rsp + 0x20], ecx
mov eax, dword [rsp + 0x60]
shr eax, 3
cmp ecx, eax
jb 0x14000a190
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [rsp + 0x20], 0x37
mov byte [rsp + 0x21], 0
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
lea rax, [rsp + 0x21]
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14000a6f0
lea rdx, [rsp + 0x21]
mov r8, rsi
mov rcx, r13
call fcn.140004580
mov rax, r13
mov rcx, qword [rbp + 0x24f0]
xor rcx, rsp
call fcn.1400aa5e0
mov rbx, qword [rsp + 0x2640]
add rsp, 0x2600
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [r13], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [r13 + 0x10], xmm1
cmp rdi, 0xf
jbe 0x14000a78b
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000a782
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a81d
mov rcx, rbx
call fcn.1400aa63c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000a7c4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a7bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a82b
call fcn.1400aa63c
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x14000a709
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a813
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a832
call fcn.1400aa63c
jmp 0x14000a709
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001b50
int3
call fcn.140001bf0
nop
call fcn.140001b50
nop
call fcn.140004450
nop
call fcn.140001bf0
int3