Function at 0x1400086b0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x1470]
mov eax, 0x1570
call fcn.14000e740
sub rsp, rax
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rbp + 0x1460], rax
mov ebx, ecx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____________________________
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rcx, rax
call fcn.140002a50
lea rdx, str._____________________________
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rcx, rax
call fcn.140002a50
lea rdx, str._________________________
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rcx, rax
call fcn.140002a50
lea rdx, str.___________________________
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rcx, rax
call fcn.140002a50
lea rdx, str.________________________
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rcx, rax
call fcn.140002a50
lea rdx, str.____________
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rcx, rax
call fcn.140002a50
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
mov r14d, 0xf
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r14w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r14 - 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__________Waiting_for_system_running_______________n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.Option_1:Remote_Thread_Injection__n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.Option_2:Reflect_DLL_Injection_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.Option_3:APC_Dispatch_Injection_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.Option_4:Shellcode_Injection_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.Option_5:APC_Shellcode_Injection_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.Option_6:Context_Shellcode_Injection_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.Option_7:List_The_Injectable_Process_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r14w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp + 0x400], xmm0
mov qword [rbp + 0x418], r14
xor esi, esi
mov qword [rbp + 0x410], rsi
mov byte [rbp + 0x400], sil
mov byte [rbp + 0x420], sil
mov byte [rbp + 0x430], sil
mov qword [rbp + 0x428], rsi
cmp ebx, 2
jne 0x140008997
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r14 + 0x77]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____BackArg_Found_____n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.____USING_BRUTAL_MOD_____n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.___If_the_pid0__injector_will_inject_all_injectable_process____n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.___Maybe_harmful_to_system____n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.___Maybe_harmful_to_system____n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.___Maybe_harmful_to_system____n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r14w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rbp + 0x430], 1
mov dword [rbp - 0x74], esi
lea rdx, str.index:
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, [rbp - 0x74]
lea rcx, [0x140042b60]
call fcn.140008650
lea rdx, str.__index:
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rcx, rax
mov edx, dword [rbp - 0x74]
call fcn.140005330
mov rcx, rax
call fcn.140002a50
mov r8d, 0xffffffff
call fcn.140009150
xorps xmm0, xmm0
movups xmmword [rbp + 0x3e0], xmm0
mov qword [rbp + 0x3f0], rsi
mov qword [rbp + 0x3f8], rsi
xor r8d, r8d
lea rdx, [0x140042700]
lea rcx, [rbp + 0x3e0]
call fcn.140002ae0
nop
mov dword [rbp - 0x78], esi
xorps xmm0, xmm0
movups xmmword [rbp + 0x438], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x448], xmm1
xor r8d, r8d
lea rdx, [0x140042700]
lea rcx, [rbp + 0x438]
call fcn.140002ae0
nop
lea rdi, [0x140000000]
mov eax, dword [rbp - 0x74]
cmp eax, 4
jae 0x140008bbb
lea rdx, str.___DLL_Path:
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rax, qword [0x14004aa30]
movsxd rax, dword [rax + 4]
mov rax, qword [rax + rdi + 0x4aa70]
mov rcx, qword [rax + 8]
mov qword [rbp - 0x68], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp - 0x70]
call fcn.140002660
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx ebx, al
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140008ace
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140008ace
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx r8d, bl
lea rdx, [rbp + 0x3e0]
call fcn.1400094d0
lea rcx, [0x14004a5a0]
cmp qword [rbp + 0x3f0], 0
jne 0x140008b00
lea rdx, str.___DLL_path_is_empty_n
call fcn.1400027a0
jmp case.default.0x140008cbe
lea rdx, str.___DLL_path_received:
call fcn.1400027a0
lea rdx, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova rdx, qword [rbp + 0x3e0]
mov r8, qword [rbp + 0x3f0]
mov rcx, rax
call fcn.140009740
mov rcx, rax
call fcn.140002a50
lea rdx, str.___PID:
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, [rbp - 0x78]
lea rcx, [0x140042b60]
call fcn.140008650
lea rdx, str.___PID_received:
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rcx, rax
mov edx, dword [rbp - 0x78]
call fcn.140005330
mov rcx, rax
call fcn.140002a50
lea rdx, str.______start_injection____n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, [rbp + 0x3e0]
lea rcx, [rsp + 0x68]
call fcn.1400024b0
mov rdx, rax
lea rcx, [rbp + 0x400]
call fcn.140003940
jmp 0x140008caa
cmp eax, 7
jae 0x140008cad
lea rdx, str.___PID:
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, [rbp - 0x78]
lea rcx, [0x140042b60]
call fcn.140008650
lea rdx, str.___PID_received:
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rcx, rax
mov edx, dword [rbp - 0x78]
call fcn.140005330
mov rcx, rax
call fcn.140002a50
mov r8d, 0xffffffff
call fcn.140009150
lea rdx, str.___Shellcode:__n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov rax, qword [0x14004aa30]
movsxd rax, dword [rax + 4]
mov rax, qword [rax + rdi + 0x4aa70]
mov rcx, qword [rax + 8]
mov qword [rbp - 0x68], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp - 0x70]
call fcn.140002660
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx ebx, al
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140008c87
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140008c87
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx r8d, bl
lea rdx, [rbp + 0x438]
call fcn.1400094d0
lea rdx, str.___Shellcode_received_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
mov eax, dword [rbp - 0x74]
dec eax
cmp eax, 6
ja case.default.0x140008cbe
mov ecx, dword [rdi + rax*4 + 0x912c]
add rcx, rdi
jmp rcx
mov edx, dword [rbp - 0x78]
test edx, edx
jne 0x140008e00
lea rdx, str.___PID_is_0._Next__Run_Auto_Injection__n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rax, [fcn.140003b10]
mov qword [rbp + 0x428], rax
lea rcx, [rbp + 0x400]
call fcn.140004270
nop
mov rdx, qword [rbp + 0x450]
cmp rdx, 0xf
jbe 0x140008d3b
inc rdx
mov rcx, qword [rbp + 0x438]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000911e
call fcn.14000e100
nop
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 0xf
jbe 0x140008d7c
inc rdx
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009124
call fcn.14000e100
mov qword [rbp + 0x3f0], rsi
mov qword [rbp + 0x3f8], r14
mov byte [rbp + 0x3e0], 0
mov rdx, qword [rbp + 0x418]
cmp rdx, 0xf
jbe 0x140008dd2
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008dcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009118
call fcn.14000e100
xor eax, eax
mov rcx, qword [rbp + 0x1460]
xor rcx, rsp
call fcn.14000e0e0
lea r11, [rsp + 0x1570]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, [rbp + 0x400]
call fcn.140003b10
mov edi, dword [rbp - 0x78]
test edi, edi
je 0x140008f05
mov dword [rbp - 0x60], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp - 0x5c]
call fcn.140035500
cmp byte [rbp + 0x420], 0
je 0x140008f05
mov edx, edi
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140008f05
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140008efc
nop dword [rax + rax]
lea rax, [rbp + 0x1d0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140008e80
inc r8
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rbp + 0x1d0]
lea rdx, [rbp + 0x460]
xor ecx, ecx
call fcn.140017b34
lea r8, [rbp + 0x400]
cmp qword [rbp + 0x418], 0xf
cmova r8, qword [rbp + 0x400]
lea rax, [rbp + 0x460]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140008ee3
inc rax
test ecx, ecx
jne 0x140008ed0
mov rcx, rbx
test edx, edx
je 0x140008f1d
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140008e70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.___Remote_Injection_Complete_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
jmp case.default.0x140008cbe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x60], 0
je 0x140008f05
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140008f05
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140008efc
lea rdx, [0x1400429d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140008f83
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140008f05
mov qword [rbp - 0x70], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, rbx
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rbp - 0x70]
call fcn.140009e00
mov rcx, qword [rbp - 0x70]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x140008efc
test eax, eax
jne 0x140008efc
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140008f6f
mov edx, dword [rbp - 0x78]
test edx, edx
jne 0x14000900e
lea rdx, str.___PID_is_0._Next__Run_Auto_Injection__n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rax, [fcn.140003d50]
jmp 0x140008ce5
lea rcx, [rbp + 0x400]
call fcn.140003d50
lea rdx, str.___Reflect_Injection_Complete_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
jmp case.default.0x140008cbe
mov edx, dword [rbp - 0x78]
test edx, edx
jne 0x14000906b
lea rdx, str.___PID_is_0._Next__Run_Auto_Injection__n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rdx, str.___THIS_IS_APC_BOOMING__n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
lea rax, [fcn.140004000]
jmp 0x140008ce5
lea rcx, [rbp + 0x400]
call fcn.140004000
lea rdx, str.___APC_Injection_Complete_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
jmp case.default.0x140008cbe
lea rdx, [rbp + 0x438]
lea rcx, [rsp + 0x68]
call fcn.1400024b0
mov r8d, dword [rbp - 0x78]
mov rdx, rax
call fcn.140004580
lea rdx, str.___Shellcode_Injected_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
jmp case.default.0x140008cbe
lea rdx, [rbp + 0x438]
lea rcx, [rsp + 0x68]
call fcn.1400024b0
mov r8d, dword [rbp - 0x78]
mov rdx, rax
call fcn.1400047e0
lea rdx, str.___APC_Shellcode_Injected_n
lea rcx, [0x14004a5a0]
call fcn.1400027a0
jmp case.default.0x140008cbe
lea rdx, [rbp + 0x438]
lea rcx, [rsp + 0x68]
call fcn.1400024b0
mov r8d, dword [rbp - 0x78]
mov rdx, rax
call fcn.140004bb0
jmp 0x1400090e1
call fcn.140014fe0
nop
call fcn.140014fe0
nop
call fcn.140014fe0
int3