Function at 0x1800c0ff0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x678]
sub rsp, 0x778
mov r13, rcx
xor r15d, r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov edi, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x70], r15
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x10], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0xc]
call fcn.18010bdb0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800c113e
nop dword [rax]
mov r9, qword [rsp + 0x68]
cmp r9, rdi
je 0x1800c110e
mov rcx, r9
lea rax, [rbp - 0x10]
mov edx, 4
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800c1090
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
mov qword [rsp + 0x68], r9
jmp 0x1800c1124
lea r8, [rbp - 0x10]
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.1800c4700
mov rdi, qword [rsp + 0x70]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800c1070
mov qword [rsp + 0x58], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
cmp rbx, rsi
je 0x1800c1300
mov r9, rbx
mov r8, rsi
sub r8, 0x238
cmp r9, r8
je 0x1800c1300
mov rax, r9
lea rcx, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800c1180
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r9
mov rax, r8
mov edx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800c1200
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r8
lea rax, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800c1280
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
cmp r9, r8
jne 0x1800c1160
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov dword [rbp + 0x6d0], eax
mov r14, rbx
mov qword [rbp + 0x6d8], rbx
cmp rbx, rsi
je 0x1800c17d3
mov eax, dword [r14 + 8]
cmp eax, ecx
je 0x1800c17b0
mov qword [rsp + 0x50], 0xffffffffffffffff
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x60], 0x30
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x60]
mov edx, 0x1fffff
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov rdi, qword [rsp + 0x50]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800c17aa
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rsp + 0x78]
lea edx, [r9 + 0x12]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jne 0x1800c17aa
cmp qword [rsp + 0x78], 0
je 0x1800c17aa
mov edx, dword [r14 + 8]
lea ecx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1800c17aa
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xor edi, edi
mov r12d, edi
mov qword [rbp - 0x70], rdi
mov dword [rbp + 0x230], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 0x234]
call fcn.18010bdb0
xor r13b, r13b
lea rdx, [rbp + 0x230]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
mov r15, qword [rbp - 0x78]
test eax, eax
je 0x1800c1717
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x460]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800c1450
lea rdx, [rbp + 0x460]
lea rcx, [rsp + 0x30]
call fcn.180008fd0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.1800bd6e0
nop
mov rdx, r15
cmp r15, r12
je 0x1800c151d
lea rax, [rbp + 0x230]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x1800c14a0
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rcx, qword [rax + 0x30]
mov qword [rdx + 0x30], rcx
add r15, 0x438
mov qword [rbp - 0x78], r15
jmp 0x1800c1535
lea r8, [rbp + 0x230]
lea rcx, [rbp - 0x80]
call fcn.1800c4980
mov r12, qword [rbp - 0x70]
mov r15, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
test r13b, r13b
jne 0x1800c16b5
movups xmm0, xmmword [str.EBWA_a_a]
movups xmmword [rsp + 0x30], xmm0
mov ecx, dword [0x180186ee8]
mov dword [rsp + 0x40], ecx
movzx eax, word [0x180186eec]
mov edx, 0x75
mov word [rsp + 0x30], dx
xor word [rsp + 0x32], 0x31
xor word [rsp + 0x34], 0x32
xor word [rsp + 0x36], 0x33
xor word [rsp + 0x38], 0x34
xor word [rsp + 0x3a], 0x35
xor word [rsp + 0x3c], 0x36
xor word [rsp + 0x3e], 0x37
xor cx, 0x38
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x39
xor ax, 0x3a
mov word [rsp + 0x44], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800c15c0
lea rcx, [rbp - 0x60]
cmp rdi, 7
seta r14b
cmova rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call fcn.180015bb0
cmp rax, 0xffffffffffffffff
je 0x1800c16ae
movups xmm0, xmmword [str.CHAD_B]
movups xmmword [rsp + 0x30], xmm0
movzx eax, word [0x180187058]
mov ecx, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x30], cx
xor word [rsp + 0x32], 0x31
xor word [rsp + 0x34], 0x32
xor word [rsp + 0x36], 0x33
xor word [rsp + 0x38], 0x34
xor word [rsp + 0x3a], 0x35
xor word [rsp + 0x3c], 0x36
xor word [rsp + 0x3e], 0x37
xor ax, 0x38
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800c1660
lea rcx, [rbp - 0x60]
test r14b, r14b
cmovne rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
call fcn.180015bb0
mov r14, qword [rbp + 0x6d8]
cmp rax, 0xffffffffffffffff
je 0x1800c16b5
mov r13b, 1
mov rcx, qword [rbp + 0x6c8]
test rcx, rcx
je 0x1800c16b5
mov eax, dword [r14 + 8]
mov dword [rcx], eax
jmp 0x1800c16b5
mov r14, qword [rbp + 0x6d8]
cmp rdi, 7
jbe 0x1800c16f0
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800c16e8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c18d1
mov rcx, rbx
call fcn.1800d9c4c
lea rdx, [rbp + 0x230]
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
mov edi, 0
jne 0x1800c1430
mov rsi, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbp - 0x80]
movabs r9, 0x795ceb240795ceb3
test r13b, r13b
je 0x1800c1757
mov rcx, r15
sub rcx, r8
mov rax, r9
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 5
jae 0x1800c1852
test r8, r8
je 0x1800c17a7
sub r12, r8
mov rax, r9
imul r12
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x438
mov rax, r8
cmp rdx, 0x1000
jb 0x1800c179f
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c18bf
mov rcx, r8
call fcn.1800d9c4c
xor r15d, r15d
mov ecx, dword [rbp + 0x6d0]
add r14, 0x238
mov qword [rbp + 0x6d8], r14
cmp r14, rsi
jne 0x1800c1321
mov rbx, qword [rsp + 0x60]
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r15
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r15
test rbx, rbx
je 0x1800c183b
mov rdx, qword [rsp + 0x58]
sub rdx, rbx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800c1833
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c18cb
mov rcx, rbx
call fcn.1800d9c4c
mov rax, r13
add rsp, 0x778
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r8
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800c183b
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c1836
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c18c5
jmp 0x1800c1836
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
int3
call fcn.1800e5fb0
nop
call fcn.1800e5fb0
int3