Function at 0x140003460
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x2358
call fcn.140034960
sub rsp, rax
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x22c0], xmm13
movdqa xmmword [rbp + 0x22b0], xmm12
movdqa xmmword [rbp + 0x22a0], xmm11
movdqa xmmword [rbp + 0x2290], xmm10
movdqa xmmword [rbp + 0x2280], xmm9
movdqa xmmword [rbp + 0x2270], xmm8
movdqa xmmword [rbp + 0x2260], xmm7
movdqa xmmword [rbp + 0x2250], xmm6
mov qword [rbp + 0x2248], 0xfffffffffffffffe
mov rsi, rdx
mov r14, rcx
lea rbx, [rbp - 0x50]
mov r8d, 0x2000
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x2244], 0
mov dword [rsp + 0x20], 3
lea r9, [rbp + 0x2244]
mov qword [rbp + 0x2200], rsi
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x2000
call sub.psapi.dll_EnumProcessModulesEx
test eax, eax
je 0x140003a2c
mov eax, dword [rbp + 0x2244]
mov ecx, eax
shr ecx, 3
cmp eax, 0x2008
jae 0x140003b23
lea r12, [rcx*8 - 0x50]
add r12, rbp
movabs rsi, 0x6c642e6c6c64746e
movdqa xmm6, xmmword [0x140037540]
movdqa xmm7, xmmword [0x140037550]
mov qword [rbp + 0x2208], r14
mov qword [rbp + 0x2218], r12
jmp 0x140003574
add rbx, 8
cmp rbx, r12
je 0x140003a77
mov rdi, rsi
mov rsi, qword [rbx]
mov qword [rbp + 0x21e8], 0
mov dword [rbp + 0x21f0], 0
mov qword [rbp + 0x21f8], 0
mov r8d, 0x208
lea r15, [rbp + 0x1fb0]
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r13, qword [rbp + 0x2200]
mov rcx, r13
mov rdx, rsi
mov r8, r15
mov r9d, 0x104
call sub.psapi.dll_GetModuleBaseNameW
mov rcx, r13
mov rdx, rsi
lea r8, [rbp + 0x21e8]
mov r9d, 0x18
call sub.psapi.dll_GetModuleInformation
mov r8d, 0x104
lea rsi, [rbp + 0x2220]
mov rcx, rsi
mov rdx, r15
call fcn.140015920
mov rcx, rsi
call fcn.140025550
mov r8, rdx
lea rcx, [rbp + 0x21b8]
mov rdx, rax
call fcn.140025790
mov rdx, qword [rbp + 0x21c0]
mov r8, qword [rbp + 0x21c8]
lea rcx, [rbp + 0x21d0]
mov qword [rbp + 0x2210], rdx
call fcn.14002eb60
mov rdx, qword [rbp + 0x21b8]
lea rax, [rdx*2]
test rax, rax
mov rsi, rdi
jne 0x140003700
mov rdx, qword [rbp + 0x2220]
test rdx, rdx
je 0x140003679
mov rcx, qword [rbp + 0x2228]
mov r8d, 1
call fcn.14000c040
mov r13, qword [rbp + 0x21d8]
mov r15, qword [rbp + 0x21e0]
cmp r15, 0xa
jb 0x1400036d0
cmp r15, 0x17
ja 0x140003730
mov rax, r13
nop word [rax + rax]
cmp r15, 9
jb 0x1400039a0
mov rcx, qword [rax]
xor rcx, rsi
movzx edx, byte [rax + 8]
xor rdx, 0x6c
inc rax
dec r15
or rdx, rcx
jne 0x1400036a0
jmp 0x1400039f2
cmp r15, 9
jne 0x1400039a0
mov rax, qword [r13]
xor rax, rsi
movzx ecx, byte [r13 + 8]
xor rcx, 0x6c
or rcx, rax
jne 0x1400039a0
jmp 0x1400039f2
mov r8d, 1
mov rcx, qword [rbp + 0x2210]
call fcn.14000c040
mov rdx, qword [rbp + 0x2220]
test rdx, rdx
jne 0x140003667
jmp 0x140003679
mov qword [rbp + 0x2220], r13
mov qword [rbp + 0x2228], r15
lea rax, [0x140037d46]
mov qword [rbp + 0x2230], rax
mov qword [rbp + 0x2238], 8
cmp r15, 0x49
jb 0x1400038e3
xor esi, esi
xor r12d, r12d
nop word cs:[rax + rax]
movdqu xmm0, xmmword [r13 + r12]
movdqu xmm1, xmmword [r13 + r12 + 8]
movdqu xmm12, xmmword [r13 + r12 + 0x10]
movdqu xmm13, xmmword [r13 + r12 + 0x18]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
movdqu xmm10, xmmword [r13 + r12 + 0x20]
movdqu xmm11, xmmword [r13 + r12 + 0x28]
movdqu xmm8, xmmword [r13 + r12 + 0x30]
movdqu xmm9, xmmword [r13 + r12 + 0x38]
test r8d, r8d
jne 0x140003843
pcmpeqb xmm12, xmm6
pcmpeqb xmm13, xmm7
pand xmm13, xmm12
pmovmskb r8d, xmm13
test r8w, r8w
jne 0x140003865
pcmpeqb xmm10, xmm6
pcmpeqb xmm11, xmm7
pand xmm11, xmm10
pmovmskb r8d, xmm11
test r8w, r8w
jne 0x140003889
pcmpeqb xmm8, xmm6
pcmpeqb xmm9, xmm7
pand xmm9, xmm8
pmovmskb r8d, xmm9
test r8w, r8w
jne 0x1400038ad
lea r14, [r12 + 0x40]
add r12, 0x88
cmp r12, r15
jae 0x1400038e8
mov eax, esi
mov r12, r14
and al, 1
je 0x140003770
jmp 0x1400038e8
mov r9d, esi
and r9b, 1
lea rcx, [rbp + 0x2220]
mov rdx, r12
call fcn.140035510
or al, sil
and al, 1
mov esi, eax
jmp 0x1400037c2
lea rdx, [r12 + 0x10]
mov r9d, esi
and r9b, 1
lea rcx, [rbp + 0x2220]
call fcn.140035510
or al, sil
and al, 1
mov esi, eax
jmp 0x1400037e0
lea rdx, [r12 + 0x20]
mov r9d, esi
and r9b, 1
lea rcx, [rbp + 0x2220]
call fcn.140035510
or al, sil
and al, 1
mov esi, eax
jmp 0x1400037fe
lea rdx, [r12 + 0x30]
mov r9d, esi
and r9b, 1
lea rcx, [rbp + 0x2220]
call fcn.140035510
or al, sil
and al, 1
mov esi, eax
lea r14, [r12 + 0x40]
add r12, 0x88
cmp r12, r15
jb 0x140003831
jmp 0x1400038e8
xor r14d, r14d
xor esi, esi
lea rax, [r14 + 0x18]
mov r9d, esi
and r9b, 1
cmp rax, r15
jae 0x140003965
test r9b, r9b
mov r12, qword [rbp + 0x2218]
jne 0x14000396c
nop word cs:[rax + rax]
movdqu xmm0, xmmword [r13 + r14]
movdqu xmm1, xmmword [r13 + r14 + 8]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x14000394f
lea rax, [r14 + 0x28]
mov r9d, esi
and r9b, 1
cmp rax, r15
jae 0x14000396c
add r14, 0x10
test r9b, r9b
je 0x140003910
jmp 0x14000396c
lea rcx, [rbp + 0x2220]
mov rdx, r14
xor r9d, r9d
call fcn.140035510
mov esi, eax
jmp 0x140003934
mov r12, qword [rbp + 0x2218]
movdqu xmm0, xmmword [r13 + r15 - 0x18]
movdqu xmm1, xmmword [r13 + r15 - 0x10]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x1400039c3
test sil, 1
mov r14, qword [rbp + 0x2208]
mov rsi, rdi
jne 0x1400039f2
mov rdx, qword [rbp + 0x21d0]
test rdx, rdx
je 0x140003570
mov r8d, 1
mov rcx, r13
call fcn.14000c040
jmp 0x140003570
add r15, 0xffffffffffffffe8
test r9b, r9b
setne r14b
lea rcx, [rbp + 0x2220]
mov rdx, r15
call fcn.140035510
mov esi, eax
or sil, r14b
test sil, 1
mov r14, qword [rbp + 0x2208]
mov rsi, rdi
je 0x1400039a0
mov eax, dword [rbp + 0x21e8]
mov dword [r14 + 8], eax
movabs rax, 0x8000000000000000
mov qword [r14], rax
mov rdx, qword [rbp + 0x21d0]
test rdx, rdx
je 0x140003ace
mov r8d, 1
mov rcx, r13
call fcn.14000c040
jmp 0x140003ace
movzx eax, byte [0x140063181]
mov ecx, 0x1b
mov edx, 1
call fcn.14000c030
test rax, rax
je 0x140003b34
movups xmm0, xmmword [0x140037cf3]
movups xmmword [rax + 0xb], xmm0
movdqu xmm0, xmmword [str.Failed_to_enumerate_modules]
movdqu xmmword [rax], xmm0
mov qword [r14], 0x1b
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0x1b
jmp 0x140003ace
movzx eax, byte [0x140063181]
mov ecx, 0x25
mov edx, 1
call fcn.14000c030
test rax, rax
je 0x140003b43
movups xmm0, xmmword [0x140037d30]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.ntdll.dll_not_found_in_target_processntdll.dll]
movdqu xmmword [rax], xmm0
movabs rcx, 0x737365636f727020
mov qword [rax + 0x1d], rcx
mov qword [r14], 0x25
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0x25
mov rax, r14
movaps xmm6, xmmword [rbp + 0x2250]
movaps xmm7, xmmword [rbp + 0x2260]
movaps xmm8, xmmword [rbp + 0x2270]
movaps xmm9, xmmword [rbp + 0x2280]
movaps xmm10, xmmword [rbp + 0x2290]
movaps xmm11, xmmword [rbp + 0x22a0]
movaps xmm12, xmmword [rbp + 0x22b0]
movaps xmm13, xmmword [rbp + 0x22c0]
add rsp, 0x2358
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.srcutils.rs
mov edx, 0x400
call fcn.140036710
mov ecx, 1
mov edx, 0x1b
call fcn.1400361a0
mov ecx, 1
mov edx, 0x25
call fcn.1400361a0
int3