Function at 0x140011880
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.140123670
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x10a0], rbx
mov qword [rsp + 0x10b0], rsi
mov qword [rsp + 0x10b8], rdi
mov rax, qword [0x1402f61c0]
xor rax, rsp
mov qword [rbp + 0xf68], rax
mov rdi, rdx
mov dword [rsp + 0x30], 0x360033
mov dword [rsp + 0x34], 0x540030
mov dword [rsp + 0x38], 0x610072
mov dword [rsp + 0x3c], 0x2e0079
mov dword [rsp + 0x40], 0x780065
mov dword [rsp + 0x44], reloc.WS2_32.dll_WSAAsyncSelect
xor esi, esi
mov dword [rbp + 0xf50], 0x360033
mov dword [rbp + 0xf54], 0x730030
mov dword [rbp + 0xf58], 0x2e0064
mov dword [rbp + 0xf5c], 0x780065
mov dword [rbp + 0xf60], reloc.WS2_32.dll_WSAAsyncSelect
lea rcx, [rsp + 0x30]
call fcn.140010170
mov ebx, eax
test eax, eax
je 0x14001197e
lea r8, [rsp + 0x28]
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14001197e
mov edx, dword [rsp + 0x28]
shr edx, 2
mov ecx, esi
test edx, edx
je 0x14001197e
nop
mov eax, ecx
cmp dword [rsp + rax*4 + 0x50], ebx
je 0x1400119d5
inc ecx
cmp ecx, edx
jb 0x140011970
lea rcx, [rbp + 0xf50]
call fcn.140010170
mov ebx, eax
test eax, eax
je 0x140011b00
lea r8, [rsp + 0x28]
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140011b00
mov edx, dword [rsp + 0x28]
shr edx, 2
mov ecx, esi
test edx, edx
je 0x140011b00
mov eax, ecx
cmp dword [rsp + rax*4 + 0x50], ebx
je 0x1400119d5
inc ecx
cmp ecx, edx
jb 0x1400119c2
jmp 0x140011b00
cmp qword [rdi + 0x10], rsi
je 0x140011b00
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.140010800
nop
call fcn.140010930
mov dword [rbp + 0xf50], 0x73006c
mov dword [rbp + 0xf54], 0x730061
mov dword [rbp + 0xf58], 0x2e0073
mov dword [rbp + 0xf5c], 0x780065
mov dword [rbp + 0xf60], reloc.WS2_32.dll_WSAAsyncSelect
lea rdx, [rbp + 0xf50]
call fcn.140010360
test eax, eax
jne 0x140011a9c
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140011b00
mov rax, qword [rsp + 0x40]
sub rax, rcx
cmp rax, 0x1000
jb 0x140011afb
test cl, 0x1f
je 0x140011a72
call fcn.14012e698
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140011a81
call fcn.14012e698
int3
sub rcx, rax
cmp rcx, 8
jae 0x140011a90
call fcn.14012e698
int3
cmp rcx, 0x27
jbe 0x140011af8
call fcn.14012e698
nop
lea r8, [rsp + 0x30]
mov edx, eax
call fcn.140010aa0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140011b00
mov rax, qword [rsp + 0x40]
sub rax, rcx
cmp rax, 0x1000
jb 0x140011afb
test cl, 0x1f
je 0x140011ace
call fcn.14012e698
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140011add
call fcn.14012e698
int3
sub rcx, rax
cmp rcx, 8
jae 0x140011aec
call fcn.14012e698
int3
cmp rcx, 0x27
jbe 0x140011af8
call fcn.14012e698
int3
mov rcx, rax
call fcn.140123330
mov rcx, qword [rbp + 0xf68]
xor rcx, rsp
call fcn.140122ce0
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret