Function at 0x10002d90
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012b6b
mov eax, dword fs:[0]
push eax
mov eax, 0x128c
call fcn.10012970
mov eax, dword [0x10085040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x127c], edx
mov dword [ebp - 0x1278], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x124c]
push eax
push 0x1000
lea eax, [ebp - 0x1218]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x100034ab
mov esi, dword [ebp - 0x124c]
xor eax, eax
shr esi, 2
mov dword [ebp - 0x126c], esi
mov dword [ebp - 0x1274], eax
test esi, esi
je 0x100034ab
mov ecx, esi
nop dword [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x1238], 0
movups xmmword [ebp - 0x1248], xmm0
mov dword [ebp - 0x1234], 0xf
mov byte [ebp - 0x1248], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp + eax*4 - 0x1218]
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
test eax, eax
jne 0x10002e6a
mov dword [ebp - 4], 0xffffffff
jmp 0x10003496
add eax, esi
mov dword [ebp - 0x1270], eax
call edi
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x10003449
xorps xmm0, xmm0
mov dword [ebp - 0x1220], 0
lea esi, [ebp - 0x218]
mov dword [ebp - 0x121c], 0
movups xmmword [ebp - 0x1230], xmm0
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10002eb7
sub esi, ecx
sar esi, 1
cmp esi, 0x7ffffffe
ja 0x10003596
cmp esi, 7
ja 0x10002f0f
mov dword [ebp - 0x1220], esi
lea eax, [ebp - 0x218]
add esi, esi
mov dword [ebp - 0x121c], 7
push esi
push eax
lea eax, [ebp - 0x1230]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x1230], ax
jmp 0x10002fb7
mov edi, esi
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x10002f58
mov eax, 0x7fffffff
mov edi, 0x7ffffffe
add eax, eax
cmp eax, 0x1000
jb 0x10002f77
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x1000359b
push ecx
call fcn.100119bc
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10003590
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x10002f80
cmp edi, 0xa
mov eax, 0xa
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x1000359b
add eax, eax
jne 0x10002f28
jmp 0x10002f80
push eax
call fcn.100119bc
add esp, 4
mov dword [ebp - 0x1220], esi
lea ecx, [ebp - 0x218]
add esi, esi
mov dword [ebp - 0x1268], eax
push esi
push ecx
push eax
mov dword [ebp - 0x1230], eax
mov dword [ebp - 0x121c], edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x1268]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x1230]
cmp dword [ebp - 0x121c], 7
lea esi, [ebp - 0x1230]
mov eax, dword [ebp - 0x1220]
xorps xmm0, xmm0
cmova edx, dword [ebp - 0x1230]
cmova esi, dword [ebp - 0x1230]
movups xmmword [ebp - 0x1298], xmm0
lea edx, [edx + eax*2]
cmp esi, edx
jne 0x10003013
mov dword [ebp - 0x1288], 0
mov dword [ebp - 0x1284], 0xf
mov byte [ebp - 0x1298], 0
jmp 0x10003115
sub edx, esi
mov edi, 0xf
sar edx, 1
mov dword [ebp - 0x1268], edx
mov dword [ebp - 0x1284], edi
cmp edx, 0x7fffffff
ja 0x10003596
cmp edx, edi
jbe 0x100030d7
mov edi, edx
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x10003058
mov ecx, 0x80000000
mov edi, 0x7fffffff
add ecx, 0x23
jmp 0x1000308a
cmp edi, 0x16
mov eax, 0x16
cmovb edi, eax
lea eax, [edi + 1]
test eax, eax
jne 0x10003078
mov dword [ebp - 0x1298], eax
mov dword [ebp - 0x1284], edi
jmp 0x100030dd
cmp eax, 0x1000
jb 0x100030ba
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x1000359b
push ecx
call fcn.100119bc
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10003590
mov edx, dword [ebp - 0x1268]
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [ebp - 0x1284], edi
mov dword [ebp - 0x1298], eax
mov dword [eax - 4], ecx
jmp 0x100030dd
push eax
call fcn.100119bc
mov edx, dword [ebp - 0x1268]
add esp, 4
mov dword [ebp - 0x1298], eax
mov dword [ebp - 0x1284], edi
jmp 0x100030dd
mov eax, dword [ebp - 0x1298]
cmp edi, 0xf
lea ecx, [ebp - 0x1298]
mov edi, edx
cmova ecx, eax
mov dword [ebp - 0x1268], ecx
test edx, edx
je 0x10003105
mov al, byte [esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
lea esi, [esi + 2]
sub edi, 1
jne 0x100030f5
mov eax, dword [ebp - 0x1268]
mov dword [ebp - 0x1288], edx
mov byte [eax + edx], 0
mov ecx, dword [ebp - 0x1234]
cmp ecx, 0xf
jbe 0x1000314f
mov edx, dword [ebp - 0x1248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003145
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003590
push ecx
push edx
call fcn.100119f1
add esp, 8
movups xmm1, xmmword [ebp - 0x1298]
lea edx, [ebp - 0x1248]
movq xmm0, qword [ebp - 0x1288]
movq qword [ebp - 0x1238], xmm0
mov edi, dword [ebp - 0x1234]
cmp edi, 0xf
mov ecx, dword [ebp - 0x1238]
movd esi, xmm1
movups xmmword [ebp - 0x1248], xmm1
mov dword [ebp - 0x1268], ecx
cmova edx, esi
cmp ecx, 1
jb 0x100031c6
lea eax, [ecx - 1]
cmp eax, ecx
cmovb ecx, eax
add ecx, edx
nop
cmp byte [ecx], 0x5c
jne 0x100031b9
movzx eax, byte [ecx]
cmp al, 0x5c
jne 0x100031b0
xor eax, eax
jmp 0x100031b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100031c0
cmp ecx, edx
je 0x100031c6
dec ecx
jmp 0x100031a0
sub ecx, edx
je 0x10003211
jmp 0x100031c9
or ecx, 0xffffffff
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x1268]
cmp ecx, eax
lea edx, [ebp - 0x1248]
cmovb eax, ecx
cmp edi, 0xf
cmova edx, esi
sub ecx, eax
mov dword [ebp - 0x1268], ecx
add eax, edx
inc ecx
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x1268]
add esp, 0xc
mov edi, dword [ebp - 0x1234]
mov esi, dword [ebp - 0x1248]
mov dword [ebp - 0x1238], eax
mov eax, dword [ebp - 0x1278]
mov ecx, eax
cmp dword [eax + 0x14], 0xf
jbe 0x10003221
mov ecx, dword [eax]
cmp edi, 0xf
lea eax, [ebp - 0x1248]
cmova eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003250
test dl, dl
je 0x1000324c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003250
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003230
xor eax, eax
jmp 0x10003255
sbb eax, eax
or eax, 1
test eax, eax
je 0x100032cb
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x121c]
cmp eax, 7
jbe 0x100032a9
mov edx, dword [ebp - 0x1230]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10003293
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003590
push ecx
push edx
call fcn.100119f1
mov edi, dword [ebp - 0x1234]
add esp, 8
mov esi, dword [ebp - 0x1248]
xor eax, eax
mov dword [ebp - 0x1220], 0
mov dword [ebp - 0x121c], 7
mov word [ebp - 0x1230], ax
jmp 0x10003455
mov ecx, dword [ebp - 0x1270]
xor eax, eax
mov dword [ebp - 0x1268], eax
cmp dword [ecx + 0x18], eax
jbe 0x10003405
mov edi, ecx
mov ecx, dword [ebp - 0x1274]
xorps xmm0, xmm0
mov edx, dword [edi + 0x1c]
movups xmmword [ebp - 0x1264], xmm0
mov dword [ebp - 0x1254], 0
mov esi, dword [ebp + ecx*4 - 0x1218]
add edx, esi
mov dword [ebp - 0x1250], 0
lea ecx, [esi + eax*4]
mov eax, dword [edi + 0x20]
mov ecx, dword [ecx + eax]
mov eax, dword [edi + 0x24]
mov edi, dword [ebp - 0x1268]
add eax, esi
movzx eax, word [eax + edi*2]
mov eax, dword [edx + eax*4]
lea edx, [esi + ecx]
mov ecx, edx
add eax, esi
mov dword [ebp - 0x1280], eax
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003340
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x1264]
call fcn.100029f0
mov edx, dword [ebp - 0x127c]
lea eax, [ebp - 0x1264]
mov edi, dword [ebp - 0x1250]
mov ecx, edx
mov esi, dword [ebp - 0x1264]
cmp edi, 0xf
cmova eax, esi
cmp dword [edx + 0x14], 0xf
jbe 0x10003380
mov ecx, dword [edx]
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100033a0
test dl, dl
je 0x1000339c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100033a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x10003380
xor eax, eax
jmp 0x100033a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100034c8
cmp edi, 0xf
jbe 0x100033dd
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x100033d3
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003590
push ecx
push esi
call fcn.100119f1
add esp, 8
mov eax, dword [ebp - 0x1268]
mov edi, dword [ebp - 0x1270]
inc eax
mov dword [ebp - 0x1268], eax
cmp eax, dword [edi + 0x18]
jb 0x100032e4
mov edi, dword [ebp - 0x1234]
mov esi, dword [ebp - 0x1248]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x121c]
cmp eax, 7
jbe 0x10003455
mov edx, dword [ebp - 0x1230]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000343f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003590
push ecx
push edx
call fcn.100119f1
add esp, 8
mov esi, dword [ebp - 0x1248]
mov edi, dword [ebp - 0x1234]
mov dword [ebp - 4], 0xffffffff
cmp edi, 0xf
jbe 0x1000348a
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x10003480
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003590
push edi
push esi
call fcn.100119f1
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x126c]
mov eax, dword [ebp - 0x1274]
inc eax
mov dword [ebp - 0x1274], eax
cmp eax, ecx
jl 0x10002e20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100119a9
mov esp, ebp
pop ebp
ret
cmp edi, 0xf
jbe 0x100034f6
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x100034ec
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003590
push edi
push esi
call fcn.100119f1
add esp, 8
mov ecx, dword [ebp - 0x121c]
cmp ecx, 7
jbe 0x10003532
mov edx, dword [ebp - 0x1230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10003528
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003590
push ecx
push edx
call fcn.100119f1
add esp, 8
mov ecx, dword [ebp - 0x1234]
xor eax, eax
mov dword [ebp - 0x1220], 0
mov dword [ebp - 0x121c], 7
mov word [ebp - 0x1230], ax
cmp ecx, 0xf
jbe 0x10003585
mov edx, dword [ebp - 0x1248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000357b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003590
push ecx
push edx
call fcn.100119f1
add esp, 8
mov eax, dword [ebp - 0x1280]
jmp 0x100034ad
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.100011b0
call fcn.10001110
int3