Function at 0x140007150
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2e8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x250], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rbp
mov qword [rbp + 0x248], rax
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov qword [rbp - 0x58], rax
test rax, rax
je 0x1400075e1
mov qword [rbp - 0x80], rsp
lea rax, [rsi + 0xf]
and rax, 0xfffffffffffffff0
call fcn.140148570
sub rsp, rax
mov rbx, rsp
test rsi, rsi
je 0x1400071e4
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, rsi
call fcn.14014b870
add rsp, 0x20
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x34], 0
sub rsp, 0x20
lea r9, [rbp - 0x34]
mov rcx, qword [rbp - 0x58]
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_K32EnumProcessModules
add rsp, 0x20
test eax, eax
je 0x1400074b0
mov edx, dword [rbp - 0x34]
test rdx, rdx
je 0x1400074b0
sub rsp, 0x20
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rsp, 0x20
test rax, rax
je 0x1400074b0
mov r14, rax
mov r8d, dword [rbp - 0x34]
sub rsp, 0x20
lea r9, [rbp - 0x34]
mov rcx, qword [rbp - 0x58]
mov rdx, rax
mov qword [rbp - 0x60], r8
call sub.KERNEL32.dll_K32EnumProcessModules
add rsp, 0x20
test eax, eax
je 0x14000749f
cmp dword [rbp - 0x60], 8
jb 0x14000749f
mov rax, qword [rbp - 0x60]
shr eax, 3
mov qword [rbp - 0x60], rax
xor ebx, ebx
movaps xmm6, xmmword [section..rdata]
mov qword [rbp - 0x70], r14
jmp 0x1400072a1
mov r14, qword [rbp - 0x70]
inc rbx
cmp rbx, qword [rbp - 0x60]
je 0x14000749f
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp - 0x40], rax
movaps xmmword [rbp - 0x50], xmm6
mov rdx, qword [r14 + rbx*8]
sub rsp, 0x20
mov rcx, qword [rbp - 0x58]
lea r8, [rbp - 0x50]
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
add rsp, 0x20
test eax, eax
je 0x140007294
sub rsp, 0x20
mov r8d, 0x105
lea rcx, [rbp + 0xd0]
mov dl, 0xaa
call fcn.14014b870
add rsp, 0x20
test rsi, rsi
je 0x140007290
mov r15d, 1
xor r13d, r13d
xor eax, eax
mov qword [rbp - 0x78], rax
jmp 0x140007442
movaps xmmword [rbp + 0xc0], xmm6
movaps xmmword [rbp + 0xb0], xmm6
movaps xmmword [rbp + 0xa0], xmm6
movaps xmmword [rbp + 0x90], xmm6
movaps xmmword [rbp + 0x80], xmm6
movaps xmmword [rbp + 0x70], xmm6
movaps xmmword [rbp + 0x60], xmm6
movaps xmmword [rbp + 0x50], xmm6
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp - 0x20], xmm6
movaps xmmword [rbp - 0x30], xmm6
movaps xmmword [rbp + 0x1f0], xmm6
movaps xmmword [rbp + 0x1e0], xmm6
movaps xmmword [rbp + 0x200], xmm6
movaps xmmword [rbp + 0x210], xmm6
movaps xmmword [rbp + 0x220], xmm6
movaps xmmword [rbp + 0x230], xmm6
mov dword [rbp + 0x1f0], 1
mov qword [rbp + 0x1e0], r13
mov byte [rbp + 0x1e8], 4
mov dword [rbp + 0x208], 1
mov qword [rbp + 0x1f8], r14
sub r14, r12
mov byte [rbp + 0x200], 8
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x210], rax
mov dword [rbp + 0x220], 2
mov dword [rbp + 0x238], 1
mov qword [rbp + 0x228], r14
mov byte [rbp + 0x230], 8
sub rsp, 0x30
mov qword [rsp + 0x20], 4
mov edx, 0x100
lea r14, [rbp - 0x30]
mov rcx, r14
lea r8, str._d_0x_x___s0x_x__n
lea r9, [rbp + 0x1e0]
call fcn.140006660
add rsp, 0x10
xor ecx, ecx
mov rdx, r14
call fcn.140006380
add rsp, 0x20
mov rax, qword [rbp - 0x68]
mov byte [rax + r13], 1
mov r13d, r15d
inc r15d
cmp r13, rsi
jae 0x140007290
mov r12, qword [rbp - 0x50]
mov r14, qword [rdi + r13*8]
cmp r12, r14
ja 0x140007433
mov eax, dword [rbp - 0x48]
add rax, r12
cmp rax, r14
jbe 0x140007433
test byte [rbp - 0x78], 1
jne 0x140007310
mov rax, qword [rbp - 0x70]
mov rdx, qword [rax + rbx*8]
sub rsp, 0x20
mov rcx, qword [rbp - 0x58]
lea r8, [rbp + 0xd0]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleFileNameExA
add rsp, 0x20
mov eax, eax
mov byte [rbp + rax + 0xd0], 0
mov al, 1
mov qword [rbp - 0x78], rax
jmp 0x140007310
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
add rsp, 0x20
test rsi, rsi
mov rax, qword [rbp - 0x68]
je 0x1400075cb
xor ebx, ebx
movaps xmm6, xmmword [section..rdata]
lea r15, str._d_0x_x__unknown__n
lea r12, [rbp + 0xd0]
lea r13, [rbp - 0x30]
jmp 0x1400074ec
inc rbx
cmp rsi, rbx
je 0x1400075cb
cmp byte [rax + rbx], 0
jne 0x1400074e0
movaps xmmword [rbp + 0x1c0], xmm6
movaps xmmword [rbp + 0x1b0], xmm6
movaps xmmword [rbp + 0x1a0], xmm6
movaps xmmword [rbp + 0x190], xmm6
movaps xmmword [rbp + 0x180], xmm6
movaps xmmword [rbp + 0x170], xmm6
movaps xmmword [rbp + 0x160], xmm6
movaps xmmword [rbp + 0x150], xmm6
movaps xmmword [rbp + 0x140], xmm6
movaps xmmword [rbp + 0x130], xmm6
movaps xmmword [rbp + 0x120], xmm6
movaps xmmword [rbp + 0x110], xmm6
movaps xmmword [rbp + 0x100], xmm6
movaps xmmword [rbp + 0xf0], xmm6
movaps xmmword [rbp + 0xe0], xmm6
movaps xmmword [rbp + 0xd0], xmm6
mov rax, qword [rdi + rbx*8]
movaps xmmword [rbp - 0x20], xmm6
movaps xmmword [rbp - 0x30], xmm6
movaps xmmword [rbp - 0x10], xmm6
mov dword [rbp - 0x20], 1
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x28], 8
mov dword [rbp - 8], 1
mov qword [rbp - 0x18], rax
mov byte [rbp - 0x10], 8
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov edx, 0x100
mov rcx, r12
mov r8, r15
mov r9, r13
call fcn.140006660
add rsp, 0x10
xor ecx, ecx
mov rdx, r12
call fcn.140006380
mov rax, qword [rbp - 0x68]
add rsp, 0x20
jmp 0x1400074e0
sub rsp, 0x20
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov rsp, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
sub rsp, 0x20
call fcn.140148650
add rsp, 0x20
movaps xmm6, xmmword [rbp + 0x250]
lea rsp, [rbp + 0x268]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret