Function at 0x1002efcb
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
mov r15d, r9d
mov r12, r8
mov r14, rdx
mov rbx, rcx
mov rcx, rdx
call fcn.1002ed06
test rax, rax
je 0x1002f039
mov rsi, rdx
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x150]
mov rcx, rdx
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
je 0x1002f049
mov qword [rbx + 0xd0], 2
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
jmp 0x1002f390
mov qword [rbx + 0xd0], 2
jmp 0x1002f390
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0xa0]
and qword [rdx], 0
lea r9, [rsp + 0x180]
and dword [r9], 0
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov r8d, 4
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x1002f0d9
mov rdi, qword [rsp + 0xa0]
lea rbp, [rsp + 0x180]
mov r8d, 0x20a
mov rcx, rbp
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rsi
mov rdx, rdi
mov r8, rbp
mov r9d, 0x105
call sub.PSAPI.DLL_GetModuleBaseNameW
lea rcx, [rsp + 0xa8]
lea rdx, [rsp + 0x180]
mov r8d, 0x105
call fcn.10030b68
jmp 0x1002f0f0
mov qword [rsp + 0xa8], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x28]
call fcn.1002ef64
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x110]
call fcn.1002e667
lea rcx, [rsp + 0x130]
call fcn.1008cb70
lea rcx, [rsp + 0x180]
lea rdx, [rsp + 0x28]
call fcn.100301cd
cmp byte [rsp + 0x1c8], 2
jne 0x1002f1b9
mov eax, 8
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
lea rcx, [rsp + 0x70]
call fcn.1002e2a5
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xd0], rax
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0xc0], xmm0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0xd8], xmm0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xe8], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x100], xmm1
jmp 0x1002f1d1
lea rdi, [rsp + 0xc0]
lea rsi, [rsp + 0x180]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0xd8]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x70], xmm0
mov rcx, qword [rsp + 0x28]
mov rdx, r12
call fcn.1002ff67
mov qword [rsp + 0x98], rax
mov r13, rdx
xor r12d, r12d
cmp qword [rsp + 0x68], 0
setne sil
lea rcx, [rsp + 0x28]
mov edx, r15d
call fcn.1002ed55
mov rbp, rax
mov r15, rdx
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rdx
mov rcx, qword [rsp + 0x28]
call fcn.1002e7f7
mov r12b, sil
mov rcx, qword [rsp + 0xb8]
lea rsi, [rsp + 0x180]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0xa8]
movaps xmmword [rsi], xmm0
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x18], xmm0
mov rcx, qword [rsp + 0x40]
mov qword [rsi + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rbx + 0x78], rcx
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x68], xmm0
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x40], xmm1
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movups xmmword [rbx + 0x90], xmm1
movups xmmword [rbx + 0x80], xmm0
movups xmm0, xmmword [rsp + 0x130]
movups xmm1, xmmword [rsp + 0x140]
movups xmmword [rbx + 0xb0], xmm1
movups xmmword [rbx + 0xa0], xmm0
xorps xmm0, xmm0
movups xmmword [rbx + 0xe8], xmm0
movups xmmword [rbx + 0xf8], xmm0
mov ecx, 0xa
mov rdi, rbx
rep movsq qword [rdi], qword [rsi]
mov qword [rbx + 0x50], r14
mov qword [rbx + 0x58], rbp
mov qword [rbx + 0x60], r15
movups xmmword [rbx + 0xc0], xmm0
mov qword [rbx + 0xd0], r12
mov rcx, qword [rsp + 0x68]
mov qword [rbx + 0xd8], rcx
mov qword [rbx + 0xe0], rax
mov rax, qword [rsp + 0x98]
mov qword [rbx + 0x108], rax
mov qword [rbx + 0x110], r13
movups xmmword [rbx + 0x118], xmm0
movups xmmword [rbx + 0x128], xmm0
mov dword [rbx + 0x138], 1
and dword [rbx + 0x140], 0
mov byte [rbx + 0x144], 1
mov rax, rbx
add rsp, 0x398
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret