Function at 0x1400023f0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1b0], xmm6
mov qword [rbp + 0x1a8], 0xfffffffffffffffe
mov rsi, rdx
mov qword [rbp + 0x198], rcx
lea r9, [rbp + 0x1a4]
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400028e3
mov ebx, dword [rbp + 0x1a4]
mov edi, ebx
shr edi, 3
xorps xmm0, xmm0
movaps xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], 0
lea rcx, [rbp + 0x130]
lea r8, [rbp - 0x40]
mov rdx, rdi
call fcn.14000c4a0
mov rdx, qword [rbp + 0x130]
and ebx, 0xfffffff8
lea r9, [rbp + 0x1a4]
mov rcx, rsi
mov r8d, ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140002920
mov r15d, dword [rbp + 0x1a4]
shr r15d, 3
cmp edi, r15d
cmovb r15d, edi
xorps xmm6, xmm6
mov rax, qword [rbp + 0x198]
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rbp - 0x40], r15
test r15d, r15d
je 0x1400024da
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp + 0x198]
call fcn.14000c610
xor r14d, r14d
mov rdi, qword [rbp + 0x198]
jmp 0x1400024f8
call fcn.14000e0a4
inc r14d
cmp r14d, r15d
jae 0x1400027dd
mov ebx, r14d
mov rax, qword [rbp + 0x130]
mov rdx, qword [rax + rbx*8]
mov rcx, rsi
lea r8, [rbp - 0x40]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleBaseNameA
test eax, eax
je 0x140002893
mov edi, eax
movaps xmmword [rbp + 0x160], xmm6
movaps xmmword [rbp + 0x150], xmm6
cmp eax, 0xf
ja 0x140002570
mov qword [rbp + 0x160], rdi
mov qword [rbp + 0x168], 0xf
lea rcx, [rbp + 0x150]
lea rdx, [rbp - 0x40]
mov r8, rdi
call fcn.140031bd0
lea r13, [rdi + rbp]
add r13, 0x150
jmp 0x1400025e4
mov r12, rdi
or r12, 0xf
cmp r12, 0x17
mov eax, 0x16
cmovb r12, rax
cmp r12, 0xfff
jb 0x1400025b0
lea rcx, [r12 + 0x28]
call fcn.14000e060
mov r13, rax
add r13, 0x27
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x1400025bd
lea rcx, [r12 + 1]
call fcn.14000e060
mov r13, rax
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x160], rdi
mov qword [rbp + 0x168], r12
mov rcx, r13
lea rdx, [rbp - 0x40]
mov r8, rdi
call fcn.140031bd0
add r13, rdi
mov byte [r13], 0
mov rax, qword [rbp + 0x130]
mov rdx, qword [rax + rbx*8]
mov rcx, rsi
lea r8, [rbp + 0x100]
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x14000283b
movaps xmmword [rbp + 0x180], xmm6
movaps xmmword [rbp + 0x170], xmm6
cmp qword [rbp + 0x168], 0x10
lea r12, [rbp + 0x150]
jb 0x140002637
mov r12, qword [rbp + 0x150]
mov r13, qword [rbp + 0x160]
test r13, r13
js 0x14000288e
cmp r13, 0xf
ja 0x140002670
mov qword [rbp + 0x180], r13
mov qword [rbp + 0x188], 0xf
movups xmm0, xmmword [r12]
movaps xmmword [rbp + 0x170], xmm0
jmp 0x1400026df
mov rdi, r13
or rdi, 0xf
cmp rdi, 0x17
mov eax, 0x16
cmovb rdi, rax
cmp rdi, 0xfff
jb 0x1400026b0
lea rcx, [rdi + 0x28]
call fcn.14000e060
mov rcx, rax
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400026b9
lea rcx, [rdi + 1]
call fcn.14000e060
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x180], r13
mov qword [rbp + 0x188], rdi
inc r13
mov rcx, rax
mov rdx, r12
mov r8, r13
call fcn.140031bd0
mov rax, qword [rbp + 0x100]
mov qword [rbp + 0x190], rax
mov rdi, qword [rbp + 0x198]
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x140002730
movups xmmword [rdx + 0x10], xmm6
movups xmmword [rdx], xmm6
movaps xmm0, xmmword [rbp + 0x170]
movaps xmm1, xmmword [rbp + 0x180]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov rax, qword [rbp + 0x190]
mov qword [rdx + 0x20], rax
add qword [rdi + 8], 0x28
jmp 0x140002790
mov rcx, rdi
lea r8, [rbp + 0x170]
call fcn.14000c820
mov rax, qword [rbp + 0x188]
cmp rax, 0x10
mov rdi, qword [rbp + 0x198]
jb 0x140002790
mov rcx, qword [rbp + 0x170]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140002786
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400028de
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14000e0a4
nop dword [rax + rax]
mov rax, qword [rbp + 0x168]
cmp rax, 0x10
jb 0x1400024f5
mov rcx, qword [rbp + 0x150]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400024f0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400028de
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x1400024f0
mov rcx, qword [rbp + 0x130]
test rcx, rcx
je 0x14000281d
mov rdx, qword [rbp + 0x140]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140002818
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400028de
add rdx, 0x27
mov rcx, rax
call fcn.14000e0a4
mov rax, rdi
movaps xmm6, xmmword [rbp + 0x1b0]
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [str.GetModuleInformaGetModuleBaseNamEnumProcessModulReadProcessMemorWriteProcessMemoclonazepam_patchDownloading_patcTUVW]
movaps xmmword [rbp + 0x170], xmm0
mov dword [rbp + 0x180], 0x6e6f6974
mov byte [rbp + 0x184], 0
lea rcx, [rbp + 0x118]
lea rdx, [rbp + 0x170]
mov r8d, eax
call fcn.140002ab0
lea rdx, [0x140040560]
lea rcx, [rbp + 0x118]
call fcn.1400102f8
jmp 0x140002961
call fcn.140005070
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [0x140033310]
movaps xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x180], 0x65
lea rcx, [rbp + 0xe8]
lea rdx, [rbp + 0x170]
mov r8d, eax
call fcn.140002ab0
lea rdx, [0x140040560]
lea rcx, [rbp + 0xe8]
call fcn.1400102f8
jmp 0x140002961
call fcn.14001722c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [0x140033320]
movaps xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x7365
mov byte [rbp - 0x2e], 0
lea rsi, [rbp - 0x58]
lea rdx, [rbp - 0x40]
mov rcx, rsi
mov r8d, eax
call fcn.140002ab0
lea rdx, [0x140040560]
mov rcx, rsi
call fcn.1400102f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [0x140033320]
movaps xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x7365
mov byte [rbp - 0x2e], 0
lea rcx, [rbp + 0xd0]
lea rdx, [rbp - 0x40]
mov r8d, eax
call fcn.140002ab0
lea rdx, [0x140040560]
lea rcx, [rbp + 0xd0]
call fcn.1400102f8
int3