Function at 0x18000db90
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x21f0]
mov eax, 0x22f0
call fcn.1800e8f90
sub rsp, rax
mov rax, qword [0x1801253c0]
xor rax, rsp
mov qword [rbp + 0x21e0], rax
xor edi, edi
mov r13d, edi
mov dword [rbp - 0x80], edi
mov rax, qword gs:[0x60]
cmp byte [rax + 2], dil
je 0x18000dbed
lea eax, [rdi + 0x17]
jmp 0x18000e18d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rbp - 0x58]
mov r8d, 0x2000
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
jne 0x18000dc2a
lea esi, [rax + 0x14]
mov rdi, qword [rbp - 0x68]
mov rbx, qword [rbp - 0x70]
jmp 0x18000e101
mov r12d, edi
movabs r14, 0x7fffffffffffffff
test dword [rbp - 0x58], 0xfffffff8
jbe 0x18000dffd
nop dword [rax]
nop dword [rax + rax]
mov eax, r12d
mov rbx, qword [rbp + rax*8 - 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rbp + 0x1fd0]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x18000e16d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xffffffff
lea r8, [rbp + 0x1fd0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
xor r8d, r8d
lea rcx, [rbp - 0x50]
call fcn.180033de0
or r13d, 2
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
lea r8, [rbp + 0x1fd0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
mov rsi, qword [0x180149860]
mov r15, qword [0x180149868]
cmp rsi, r15
je 0x18000df74
nop word [rax + rax]
lea rax, [rsp + 0x60]
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor edx, edx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rdx
mov rdi, qword [rsi + 0x10]
mov r14, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x18000dd4e
mov r14, qword [rsi]
movabs rcx, 0x7fffffffffffffff
cmp rdi, rcx
ja 0x18000e1d5
cmp rdi, 0xf
ja 0x18000dd83
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], send
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x60], xmm0
jmp 0x18000de24
mov rbx, rdi
or rbx, 0xf
cmp rbx, rcx
jbe 0x18000dda2
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x18000ddc9
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000ddeb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000e1c3
mov rcx, rax
call fcn.180093cbc
mov rcx, rax
test rax, rax
je 0x18000e158
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000ddfa
test rcx, rcx
je 0x18000ddf7
call fcn.180093cbc
jmp 0x18000ddfa
mov rax, rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
movabs rcx, 0x7fffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
mov rdi, qword [rbp - 0x40]
lea r14, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r14, qword [rbp - 0x50]
cmp rdi, rcx
ja 0x18000e1cf
cmp rdi, 0xf
ja 0x18000de74
mov qword [rsp + 0x50], rdi
mov eax, send
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
jmp 0x18000df13
mov rbx, rdi
or rbx, 0xf
cmp rbx, rcx
jbe 0x18000de93
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x18000deba
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000dedc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000e1c9
mov rcx, rax
call fcn.180093cbc
mov rcx, rax
test rax, rax
je 0x18000e15f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000deeb
test rcx, rcx
je 0x18000dee8
call fcn.180093cbc
jmp 0x18000deeb
mov rax, rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r9, qword [rsp + 0x60]
lea rcx, [rsp + 0x40]
cmp rax, 0xf
cmova rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call fcn.18003e1b0
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.180005610
lea rcx, [rsp + 0x60]
call fcn.180005610
cmp rbx, 0xffffffffffffffff
jne 0x18000df91
add rsi, 0x20
cmp rsi, r15
jne 0x18000dd20
xor edi, edi
mov rax, qword [rbp - 0x68]
cmp rax, qword [rbp - 0x60]
je 0x18000df95
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.18000d920
add qword [rbp - 0x68], 0x20
jmp 0x18000dfa6
xor edi, edi
jmp 0x18000dfa6
lea r8, [rbp - 0x50]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.180044b00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x18000dfe1
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000dfdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e166
call fcn.180093b94
inc r12d
mov eax, dword [rbp - 0x58]
shr eax, 3
cmp r12d, eax
jb 0x18000dc50
movabs r14, 0x7fffffffffffffff
mov rdx, qword [rbp - 0x68]
mov r8, rdx
mov rcx, qword [rbp - 0x70]
sub r8, rcx
sar r8, 5
xor r9d, r9d
call fcn.180048620
mov rbx, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x68]
cmp rbx, rdi
je 0x18000e0f7
nop dword [rax + rax]
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rcx, qword [rbx + 0x10]
mov rax, r14
sub rax, rcx
cmp rax, 6
jb 0x18000e1bd
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18000e058
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.NEWS:
lea rcx, [rbp - 0x50]
call fcn.180033cc0
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
mov rcx, rsi
call fcn.1800431f0
lea rdx, [0x18003afb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x18000e0e2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000e0dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e17c
call fcn.180093b94
add rbx, 0x20
cmp rbx, rdi
jne 0x18000e030
mov rdi, qword [rbp - 0x68]
mov rbx, qword [rbp - 0x70]
mov rsi, rdi
sub rsi, rbx
sar rsi, 5
test rbx, rbx
je 0x18000e18b
cmp rbx, rdi
je 0x18000e125
nop
mov rcx, rbx
call fcn.180005610
add rbx, 0x20
cmp rbx, rdi
jne 0x18000e110
mov rbx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x60]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000e183
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000e183
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov esi, reloc.WS2_32.dll_setsockopt
mov rdi, qword [rbp - 0x68]
mov rbx, qword [rbp - 0x70]
jmp 0x18000e101
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rbx
call fcn.180093b94
mov eax, esi
mov rcx, qword [rbp + 0x21e0]
xor rcx, rsp
call fcn.1800935b0
lea r11, [rsp + 0x22f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180006090
nop
call fcn.180005ff0
nop
call fcn.180005ff0
int3
call fcn.180006090
nop
call fcn.180006090
int3