Function at 0x14001a2f0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
sub rsp, 0x520
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x18], r8
mov rax, rdx
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rcx
mov rax, qword [rax]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x40]
call fcn.14001a760
mov r8, qword [rbp - 0x18]
mov rax, qword [r8]
mov qword [rbp + 0x60], rax
mov rax, qword [r8 + 8]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x88], rax
mov rax, qword [0x1403a5e30]
mov qword [rbp + 0x90], rax
mov rax, qword [0x1403a5e38]
mov qword [rbp + 0x98], rax
mov rax, qword [0x1403a5e40]
mov qword [rbp + 0xa0], rax
lea rcx, [rbp - 8]
lea rdx, [rbp + 0x60]
mov r8d, 0x48
call fcn.1403750f0
mov ecx, 0x18
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 0x10], rax
mov qword [rbp + 0xa8], rax
mov rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x14001a465
jmp 0x14001a4c1
lea rcx, [rbp + 0x108]
mov edx, 0xaa
mov r8d, 0x238
call fcn.140375530
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x108]
mov qword [rbp + 0x340], 0x4d430001
mov qword [rbp + 0x348], rax
mov qword [rbp + 0x350], 0x238
mov qword [rbp + 0x358], 0
mov qword [rbp + 0x360], 0
mov qword [rbp + 0x368], 0
lea rax, [rbp + 0x340]
xor edx, edx
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov dword [rbp + 0x108], 0x238
lea rdx, [rbp + 0x108]
call sub.KERNEL32.dll_Module32First
cmp eax, 0
je 0x14001a4d2
jmp 0x14001a518
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x38]
mov dx, ax
mov word [rbp + 0xb6], dx
call fcn.14001a790
mov rdx, qword [rbp - 0x18]
mov word [rbp + 0x100], ax
lea rcx, [rbp - 8]
add rcx, 0x30
call fcn.14001aaa0
mov rcx, qword [rbp - 0x38]
call fcn.140002380
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0xb8]
mov r8d, 0x50
call fcn.1403750f0
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
jmp 0x14001a3c9
mov byte [rbp + 0x377], 1
jmp 0x14001a565
mov rcx, qword [rbp - 0x10]
call fcn.14001a2a0
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
add rcx, 0x30
call fcn.14001aaa0
mov rcx, qword [rbp - 0x38]
call fcn.140002380
mov rcx, qword [rbp - 0x30]
lea rdx, [0x1403a5e48]
mov r8d, 0x50
call fcn.1403750f0
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
jmp 0x14001a4c6
mov rcx, qword [rbp - 0x10]
call fcn.14001a2a0
mov word [rbp + 0x498], 0
lea rcx, [rbp + 0x450]
lea rdx, [rbp - 8]
mov r8d, 0x48
call fcn.1403750f0
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x450]
mov r8d, 0x50
call fcn.1403750f0
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
test byte [rbp + 0x377], 1
jne 0x14001a572
jmp 0x14001a59a
jmp 0x14001a565
mov r9, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x38]
lea r8, [rbp - 8]
add r8, 0x30
lea rcx, [rbp + 0x378]
call fcn.14001ab60
cmp word [rbp + 0x380], 0
jne 0x14001a59f
jmp 0x14001a5fb
jmp 0x14001a51a
mov rcx, qword [rbp - 0x10]
mov ax, word [rbp + 0x380]
mov word [rbp - 0x3a], ax
call fcn.14001a2a0
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
add rcx, 0x30
call fcn.14001aaa0
mov ax, word [rbp - 0x3a]
mov rcx, qword [rbp - 0x38]
mov word [rbp + 0x3d0], ax
call fcn.140002380
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x388]
mov r8d, 0x50
call fcn.1403750f0
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x378]
mov qword [rbp - 0x48], rcx
mov qword [rbp + 0x3d8], rcx
vmovdqu xmm0, xmmword [rax]
vmovdqa xmmword [rbp + 0x3e0], xmm0
vmovdqa xmm0, xmmword [rbp + 0x3e0]
vmovdqa xmmword [rbp + 0x3f0], xmm0
lea rcx, [rbp + 0x138]
call fcn.14001ac60
mov rcx, rdx
mov rdx, qword [rbp - 0x38]
mov qword [rbp + 0x410], rcx
mov qword [rbp + 0x408], rax
mov r9, qword [rbp + 0x408]
mov rax, qword [rbp + 0x410]
lea rcx, [rbp + 0x418]
lea r8, [rbp + 0x3f0]
mov qword [rsp + 0x20], rax
call fcn.140009ec0
cmp word [rbp + 0x428], 0
je 0x14001a702
jmp 0x14001a739
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov qword [rbp + 0x440], rax
mov qword [rbp + 0x448], rdx
mov r8, qword [rbp + 0x120]
mov qword [rcx], r8
mov r8d, dword [rbp + 0x128]
mov dword [rcx + 0x48], r8d
mov qword [rcx + 0x10], rdx
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x130]
mov qword [rcx + 0x18], rax
add rcx, 0x20
lea rdx, [0x1403a5e98]
mov r8d, 0x28
call fcn.1403750f0
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0x108]
call sub.KERNEL32.dll_Module32Next
cmp eax, 1
sete al
and al, 1
mov byte [rbp + 0x377], al
jmp 0x14001a570
mov rax, qword [rbp + 0x418]
mov rcx, qword [rbp + 0x420]
mov qword [rbp + 0x438], rcx
mov qword [rbp + 0x430], rax
mov rcx, qword [rbp + 0x430]
mov rax, qword [rbp + 0x438]
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x58], rax
jmp 0x14001a687
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
mov qword [rax], rcx
mov ecx, 1
xor eax, eax
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x58], rax
jmp 0x14001a687