Function at 0x14000ccd0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x4e0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x4c0], rbx
mov qword [rbp + 0x4c8], rsi
mov qword [rbp + 0x4d0], rdi
mov qword [rbp + 0x4d8], r12
mov rax, qword [0x1400a8e58]
xor rax, rbp
mov qword [rbp + 0x498], rax
xor r15d, r15d
lea rdx, str.client.dll
vpxor xmm0, xmm0, xmm0
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x38], r15
vmovups xmmword [rbp + 0x28], xmm0
lea r8d, [r15 + 0xa]
mov qword [rbp + 0x40], r15
call fcn.140004990
mov edx, dword [0x1400a8010]
lea ecx, [r15 + 8]
mov dword [rbp + 0x50], 0x438
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rbp + 0x50]
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Module32FirstW
mov rsi, qword [rbp + 0x40]
movabs r12, 0xffffffffffffff0
mov r14, qword [rbp + 0x28]
nop
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r15w
jne 0x14000cd80
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14000cdfd
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000cdab
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14006b2c0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14000cdfd
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x80]
mov r9d, 0xffffffff
mov byte [rbx], r15b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r15
jmp 0x14000ce00
mov rbx, r15
cmp rsi, 0x10
lea rdx, [rbp + 0x28]
cmovae rdx, r14
sub rdx, rbx
nop
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x14000ce22
inc rbx
test eax, eax
jne 0x14000ce10
test ecx, ecx
mov rcx, rdi
je 0x14000ce86
lea rdx, [rbp + 0x50]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x14000cd70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x28]
call fcn.140004cd0
xor al, al
mov rcx, qword [rbp + 0x498]
xor rcx, rbp
call fcn.14006b1d0
mov rbx, qword [rbp + 0x4c0]
mov rsi, qword [rbp + 0x4c8]
mov rdi, qword [rbp + 0x4d0]
mov r12, qword [rbp + 0x4d8]
lea rsp, [rbp + 0x4a0]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x78]
lea rcx, [rbp + 0x28]
call fcn.140004cd0
test rbx, rbx
je 0x14000ce4c
lea rdx, [0x1400a87e8]
mov qword [rbp + 0x490], r15
lea rcx, [rbp + 8]
call fcn.14000bd70
mov rdx, rbx
mov rcx, rax
call fcn.14000ca90
mov qword [rbp + 0x490], rax
test rax, rax
je 0x14000ce4c
sub eax, ebx
lea rdx, [0x1400a8808]
lea rcx, [rbp + 8]
mov dword [0x1400a9b14], eax
call fcn.14000bd70
mov rdx, rbx
mov rcx, rax
call fcn.14000ca90
mov qword [rbp + 0x490], rax
test rax, rax
je 0x14000ce4c
sub eax, ebx
lea rdx, [0x1400a87a8]
lea rcx, [rbp + 8]
mov dword [0x1400a9b20], eax
call fcn.14000bd70
mov rdx, rbx
mov rcx, rax
call fcn.14000ca90
mov qword [rbp + 0x490], rax
test rax, rax
je 0x14000ce4c
sub eax, ebx
lea rdx, [0x1400a8788]
lea rcx, [rbp + 8]
mov dword [0x1400a9b18], eax
call fcn.14000bd70
mov rdx, rbx
mov rcx, rax
call fcn.14000ca90
mov qword [rbp + 0x490], rax
test rax, rax
je 0x14000ce4c
sub eax, ebx
lea rdx, [0x1400a87c8]
lea rcx, [rbp + 8]
mov dword [0x1400a9b2c], eax
call fcn.14000bd70
mov rdx, rbx
mov rcx, rax
call fcn.14000ca90
mov qword [rbp + 0x490], rax
test rax, rax
je 0x14000ce4c
mov rcx, qword [0x1400a8008]
test rcx, rcx
je 0x14000ce4c
cmp dword [0x1400a8010], r15d
je 0x14000ce4c
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x490]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000ce4c
mov eax, dword [rbp + 0x490]
lea rdx, [0x1400a8848]
sub eax, ebx
lea rcx, [rbp + 8]
add eax, 0x4510
mov dword [0x1400a9b1c], eax
call fcn.14000bd70
mov rdx, rbx
mov rcx, rax
call fcn.14000ca90
mov qword [rbp + 0x490], rax
test rax, rax
je 0x14000ce4c
sub eax, ebx
lea rdx, [0x1400a8828]
add eax, 0x118
lea rcx, [rbp + 8]
mov dword [0x1400a9b24], eax
call fcn.14000bd70
mov rdx, rbx
mov rcx, rax
call fcn.14000ca90
test rax, rax
je 0x14000ce4c
sub eax, ebx
add eax, 0x30
mov dword [0x1400a9b28], eax
mov al, 1
jmp 0x14000ce4e