Function at 0x1800c09d0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x678]
sub rsp, 0x778
mov r13, rcx
xor r15d, r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov edi, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x70], r15
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x10], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0xc]
call fcn.18010b740
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800c0b1e
nop dword [rax]
mov r9, qword [rsp + 0x68]
cmp r9, rdi
je 0x1800c0aee
mov rcx, r9
lea rax, [rbp - 0x10]
mov edx, 4
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800c0a70
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
mov qword [rsp + 0x68], r9
jmp 0x1800c0b04
lea r8, [rbp - 0x10]
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.1800c4090
mov rdi, qword [rsp + 0x70]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800c0a50
mov qword [rsp + 0x58], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
cmp rbx, rsi
je 0x1800c0ce0
mov r9, rbx
mov r8, rsi
sub r8, 0x238
cmp r9, r8
je 0x1800c0ce0
mov rax, r9
lea rcx, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800c0b60
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r9
mov rax, r8
mov edx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800c0be0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r8
lea rax, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800c0c60
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
cmp r9, r8
jne 0x1800c0b40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov dword [rbp + 0x6d0], eax
mov r14, rbx
mov qword [rbp + 0x6d8], rbx
cmp rbx, rsi
je 0x1800c11b3
mov eax, dword [r14 + 8]
cmp eax, ecx
je 0x1800c1190
mov qword [rsp + 0x50], 0xffffffffffffffff
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x60], 0x30
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x60]
mov edx, 0x1fffff
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov rdi, qword [rsp + 0x50]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800c118a
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rsp + 0x78]
lea edx, [r9 + 0x12]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jne 0x1800c118a
cmp qword [rsp + 0x78], 0
je 0x1800c118a
mov edx, dword [r14 + 8]
lea ecx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1800c118a
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xor edi, edi
mov r12d, edi
mov qword [rbp - 0x70], rdi
mov dword [rbp + 0x230], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 0x234]
call fcn.18010b740
xor r13b, r13b
lea rdx, [rbp + 0x230]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
mov r15, qword [rbp - 0x78]
test eax, eax
je 0x1800c10f7
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x460]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800c0e30
lea rdx, [rbp + 0x460]
lea rcx, [rsp + 0x30]
call fcn.180008fd0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.1800bcff0
nop
mov rdx, r15
cmp r15, r12
je 0x1800c0efd
lea rax, [rbp + 0x230]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x1800c0e80
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rcx, qword [rax + 0x30]
mov qword [rdx + 0x30], rcx
add r15, 0x438
mov qword [rbp - 0x78], r15
jmp 0x1800c0f15
lea r8, [rbp + 0x230]
lea rcx, [rbp - 0x80]
call fcn.1800c4310
mov r12, qword [rbp - 0x70]
mov r15, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
test r13b, r13b
jne 0x1800c1095
movups xmm0, xmmword [str.FGPD]
movups xmmword [rsp + 0x30], xmm0
mov ecx, dword [0x180186058]
mov dword [rsp + 0x40], ecx
movzx eax, word [0x18018605c]
mov edx, 0x75
mov word [rsp + 0x30], dx
xor word [rsp + 0x32], 0x34
xor word [rsp + 0x34], 0x35
xor word [rsp + 0x36], 0x36
xor word [rsp + 0x38], 0x37
xor word [rsp + 0x3a], 0x38
xor word [rsp + 0x3c], 0x39
xor word [rsp + 0x3e], 0x3a
xor cx, 0x3b
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x3c
xor ax, 0x3d
mov word [rsp + 0x44], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800c0fa0
lea rcx, [rbp - 0x60]
cmp rdi, 7
seta r14b
cmova rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call fcn.180015b90
cmp rax, 0xffffffffffffffff
je 0x1800c108e
movups xmm0, xmmword [str._MFAXO]
movups xmmword [rsp + 0x30], xmm0
movzx eax, word [0x180185f38]
mov ecx, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x30], cx
xor word [rsp + 0x32], 0x34
xor word [rsp + 0x34], 0x35
xor word [rsp + 0x36], 0x36
xor word [rsp + 0x38], 0x37
xor word [rsp + 0x3a], 0x38
xor word [rsp + 0x3c], 0x39
xor word [rsp + 0x3e], 0x3a
xor ax, 0x3b
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800c1040
lea rcx, [rbp - 0x60]
test r14b, r14b
cmovne rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
call fcn.180015b90
mov r14, qword [rbp + 0x6d8]
cmp rax, 0xffffffffffffffff
je 0x1800c1095
mov r13b, 1
mov rcx, qword [rbp + 0x6c8]
test rcx, rcx
je 0x1800c1095
mov eax, dword [r14 + 8]
mov dword [rcx], eax
jmp 0x1800c1095
mov r14, qword [rbp + 0x6d8]
cmp rdi, 7
jbe 0x1800c10d0
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800c10c8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c12b1
mov rcx, rbx
call fcn.1800d95dc
lea rdx, [rbp + 0x230]
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
mov edi, 0
jne 0x1800c0e10
mov rsi, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbp - 0x80]
movabs r9, 0x795ceb240795ceb3
test r13b, r13b
je 0x1800c1137
mov rcx, r15
sub rcx, r8
mov rax, r9
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 5
jae 0x1800c1232
test r8, r8
je 0x1800c1187
sub r12, r8
mov rax, r9
imul r12
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x438
mov rax, r8
cmp rdx, 0x1000
jb 0x1800c117f
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c129f
mov rcx, r8
call fcn.1800d95dc
xor r15d, r15d
mov ecx, dword [rbp + 0x6d0]
add r14, 0x238
mov qword [rbp + 0x6d8], r14
cmp r14, rsi
jne 0x1800c0d01
mov rbx, qword [rsp + 0x60]
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r15
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r15
test rbx, rbx
je 0x1800c121b
mov rdx, qword [rsp + 0x58]
sub rdx, rbx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800c1213
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c12ab
mov rcx, rbx
call fcn.1800d95dc
mov rax, r13
add rsp, 0x778
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r8
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800c121b
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c1216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c12a5
jmp 0x1800c1216
call fcn.1800e5940
nop
call fcn.1800e5940
int3
call fcn.1800e5940
nop
call fcn.1800e5940
int3