Function at 0x1400025f0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400930c0]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rdx
mov qword [rbp + 8], rdx
mov rsi, rcx
mov qword [rbp + 0x38], rcx
xor r15d, r15d
mov dword [rbp + 0x14], r15d
lea r9, [rbp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140002b06
mov ebx, dword [rbp + 0x58]
shr ebx, 3
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov qword [rbp + 0x90], r15
mov edx, ebx
test ebx, ebx
je 0x14000267a
lea rcx, [rbp + 0x80]
call fcn.14000ad80
lea r8d, [rbx*8]
lea r9, [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140002bf4
mov eax, dword [rbp + 0x58]
shr eax, 3
cmp ebx, eax
cmovae ebx, eax
mov r14d, ebx
mov qword [rbp + 0x18], r14
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
mov dword [rbp + 0x14], 1
mov qword [rbp + 0x98], r14
test ebx, ebx
je 0x1400026e2
lea rdx, [rbp + 0x98]
mov rcx, rsi
call fcn.140009570
mov ebx, r15d
mov dword [rbp], ebx
test r14d, r14d
je 0x14000298f
mov r12, r15
nop dword [rax]
nop dword [rax + rax]
mov r9d, 0x104
lea r8, [rbp + 0x100]
mov rdx, qword [rbp + 0x80]
mov rdx, qword [rdx + r12]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x140002a03
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r15
mov r8d, eax
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x60]
call fcn.140009970
nop
mov r9d, Ordinal_26
lea r8, [rbp + 0x40]
mov rdx, qword [rbp + 0x80]
mov rdx, qword [rdx + r12]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002cee
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
lea r14, [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0xf
seta byte [rbp + 0x10]
mov r15, qword [rbp + 0x60]
cmova r14, r15
mov rdi, qword [rbp + 0x70]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140002ce8
cmp rdi, 0xf
ja 0x1400027e1
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0xc0], xmm0
jmp 0x140002885
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140002800
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140002827
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002849
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002ce2
mov rcx, rax
call fcn.140072370
mov rcx, rax
test rax, rax
je 0x140002981
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002857
test rcx, rcx
je 0x140002855
call fcn.140072370
jmp 0x140002857
xor eax, eax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp + 0xc0]
mov ebx, dword [rbp]
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0xe0], rcx
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x1400028ca
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [rdx + 0x10], xmm0
mov qword [rbp + 0xd0], 0
mov eax, reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov qword [rdx + 0x20], rcx
add qword [rsi + 8], 0x28
jmp 0x1400028e0
lea r8, [rbp + 0xc0]
mov rcx, rsi
call fcn.14000aee0
mov rax, qword [rbp + 0xd8]
cmp rax, 0xf
jbe 0x140002917
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002912
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002981
call fcn.1400726c4
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
cmp byte [rbp + 0x10], 0
je 0x140002967
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000295f
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002988
mov rcx, r15
call fcn.1400726c4
inc ebx
mov dword [rbp], ebx
add r12, 8
cmp ebx, dword [rbp + 0x18]
jae 0x14000298f
mov rdi, qword [rbp + 8]
xor r15d, r15d
jmp 0x140002700
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x1400029d6
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400726c4
mov rax, rsi
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140072350
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xa03dfed49c157ea6
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa0], rcx
movabs rax, 0x6f93f47ffd7a7b8b
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa8], rcx
movabs rax, 0xcf45f03d276ab5f6
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xb0], rcx
movabs rcx, 0xdd2f49940d890500
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0xcc489abbd1611be1
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x2f2ba1a8e1b39ee
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0xcf45f03d276ab593
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
vzeroupper
call fcn.140001fa0
lea rdx, [0x14008eee8]
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xaf27e8ebbc1475a4
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
movabs rax, 0x6e87de75c3684a8b
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
movabs rax, 0xcf45f03d276ac6f6
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
movabs rcx, 0xdd2f49940d890500
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xcc489abbd1611be1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x2f2ba1a8e1b39ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xcf45f03d276ab593
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140001fa0
lea rdx, [0x14008eee8]
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xaf27e8ebbc1475a4
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
movabs rax, 0x6e87de75c3684a8b
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
movabs rax, 0xcf45f03d276ac6f6
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
movabs rcx, 0xdd2f49940d890500
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xcc489abbd1611be1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x2f2ba1a8e1b39ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xcf45f03d276ab593
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140001fa0
lea rdx, [0x14008eee8]
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140001a10
int3
call fcn.140001ac0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xa03dfed49c157ea6
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa0], rcx
movabs rax, 0x639fc875e875708b
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa8], rcx
movabs rax, 0xcf45f03d4905dce7
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xb0], rcx
movabs rcx, 0xdd2f49940d890500
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0xcc489abbd1611be1
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x2f2ba1a8e1b39ee
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0xcf45f03d276ab593
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
vzeroupper
call fcn.140001fa0
lea rdx, [0x14008eee8]
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3