Function at 0x140007b60
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x2358
call fcn.1400bcec0
sub rsp, rax
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x22c0], xmm13
movdqa xmmword [rbp + 0x22b0], xmm12
movdqa xmmword [rbp + 0x22a0], xmm11
movdqa xmmword [rbp + 0x2290], xmm10
movdqa xmmword [rbp + 0x2280], xmm9
movdqa xmmword [rbp + 0x2270], xmm8
movdqa xmmword [rbp + 0x2260], xmm7
movdqa xmmword [rbp + 0x2250], xmm6
mov qword [rbp + 0x2248], 0xfffffffffffffffe
mov rsi, rdx
mov r14, rcx
lea rbx, [rbp - 0x58]
mov r8d, 0x2000
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x2244], 0
mov dword [rsp + 0x20], 3
lea r9, [rbp + 0x2244]
mov qword [rbp + 0x21f8], rsi
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x2000
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x140008119
mov eax, dword [rbp + 0x2244]
mov ecx, eax
shr ecx, 3
cmp eax, 0x2008
jae 0x140008210
lea r12, [rcx*8 - 0x58]
add r12, rbp
movabs rsi, 0x6c642e6c6c64746e
movdqa xmm6, xmmword [0x1400c1ea0]
movdqa xmm7, xmmword [0x1400c1eb0]
mov qword [rbp + 0x2200], r14
mov qword [rbp + 0x2208], r12
jmp 0x140007c74
add rbx, 8
cmp rbx, r12
je 0x140008164
mov rdi, rsi
mov rsi, qword [rbx]
mov qword [rbp + 0x21e0], 0
mov dword [rbp + 0x21e8], 0
mov qword [rbp + 0x21f0], 0
mov r8d, 0x208
lea r15, [rbp + 0x1fa8]
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r13, qword [rbp + 0x21f8]
mov rcx, r13
mov rdx, rsi
mov r8, r15
mov r9d, 0x104
call sub.PSAPI.DLL_GetModuleBaseNameW
mov rcx, r13
mov rdx, rsi
lea r8, [rbp + 0x21e0]
mov r9d, 0x18
call sub.PSAPI.DLL_GetModuleInformation
mov r8d, 0x104
lea rcx, [rbp + 0x2220]
mov rdx, r15
call fcn.140034870
mov rdx, qword [rbp + 0x2228]
mov r8, qword [rbp + 0x2230]
lea rcx, [rbp + 0x21b0]
mov qword [rbp + 0x2210], rdx
call fcn.14003c690
mov rdx, qword [rbp + 0x21b8]
mov r8, qword [rbp + 0x21c0]
lea rcx, [rbp + 0x21c8]
mov qword [rbp + 0x2218], rdx
call fcn.14004e670
mov rdx, qword [rbp + 0x21b0]
lea rax, [rdx*2]
test rax, rax
mov rsi, rdi
jne 0x140007e00
mov rdx, qword [rbp + 0x2220]
test rdx, rdx
je 0x140007d7d
mov r8d, 1
mov rcx, qword [rbp + 0x2210]
call fcn.140016900
mov r13, qword [rbp + 0x21d0]
mov r15, qword [rbp + 0x21d8]
cmp r15, 0xa
jb 0x140007dd0
cmp r15, 0x17
ja 0x140007e30
mov rax, r13
nop
cmp r15, 9
jb 0x14000809b
mov rcx, qword [rax]
xor rcx, rsi
movzx edx, byte [rax + 8]
xor rdx, 0x6c
inc rax
dec r15
or rdx, rcx
jne 0x140007da0
jmp 0x1400080df
cmp r15, 9
jne 0x14000809b
mov rax, qword [r13]
xor rax, rsi
movzx ecx, byte [r13 + 8]
xor rcx, 0x6c
or rcx, rax
jne 0x14000809b
jmp 0x1400080df
mov r8d, 1
mov rcx, qword [rbp + 0x2218]
call fcn.140016900
mov rdx, qword [rbp + 0x2220]
test rdx, rdx
jne 0x140007d6b
jmp 0x140007d7d
mov qword [rbp + 0x2220], r13
mov qword [rbp + 0x2228], r15
lea rax, [0x1400c26e6]
mov qword [rbp + 0x2230], rax
mov qword [rbp + 0x2238], 8
cmp r15, 0x49
jb 0x140007fde
xor r14d, r14d
xor esi, esi
nop word cs:[rax + rax]
movdqu xmm0, xmmword [r13 + r14]
movdqu xmm1, xmmword [r13 + r14 + 8]
movdqu xmm12, xmmword [r13 + r14 + 0x10]
movdqu xmm13, xmmword [r13 + r14 + 0x18]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
movdqu xmm10, xmmword [r13 + r14 + 0x20]
movdqu xmm11, xmmword [r13 + r14 + 0x28]
movdqu xmm8, xmmword [r13 + r14 + 0x30]
movdqu xmm9, xmmword [r13 + r14 + 0x38]
test r8d, r8d
jne 0x140007f42
pcmpeqb xmm12, xmm6
pcmpeqb xmm13, xmm7
pand xmm13, xmm12
pmovmskb r8d, xmm13
test r8w, r8w
jne 0x140007f64
pcmpeqb xmm10, xmm6
pcmpeqb xmm11, xmm7
pand xmm11, xmm10
pmovmskb r8d, xmm11
test r8w, r8w
jne 0x140007f87
pcmpeqb xmm8, xmm6
pcmpeqb xmm9, xmm7
pand xmm9, xmm8
pmovmskb r8d, xmm9
test r8w, r8w
jne 0x140007faa
lea r12, [r14 + 0x40]
add r14, 0x88
cmp r14, r15
jae 0x140007fe3
mov eax, esi
mov r14, r12
and al, 1
je 0x140007e70
jmp 0x140007fe3
mov r9d, esi
and r9b, 1
lea rcx, [rbp + 0x2220]
mov rdx, r14
call fcn.1400bdca0
or al, sil
and al, 1
mov esi, eax
jmp 0x140007ec2
lea rdx, [r14 + 0x10]
mov r9d, esi
and r9b, 1
lea rcx, [rbp + 0x2220]
call fcn.1400bdca0
or al, sil
and al, 1
mov esi, eax
jmp 0x140007ee0
lea rdx, [r14 + 0x20]
mov r9d, esi
and r9b, 1
lea rcx, [rbp + 0x2220]
call fcn.1400bdca0
or al, sil
and al, 1
mov esi, eax
jmp 0x140007efe
lea rdx, [r14 + 0x30]
mov r9d, esi
and r9b, 1
lea rcx, [rbp + 0x2220]
call fcn.1400bdca0
or al, sil
and al, 1
mov esi, eax
lea r12, [r14 + 0x40]
add r14, 0x88
cmp r14, r15
jb 0x140007f30
jmp 0x140007fe3
xor esi, esi
xor r12d, r12d
lea rax, [r12 + 0x18]
mov r9d, esi
and r9b, 1
cmp rax, r15
jae 0x140008060
nop word cs:[rax + rax]
test r9b, r9b
jne 0x140008060
movdqu xmm0, xmmword [r13 + r12]
movdqu xmm1, xmmword [r13 + r12 + 8]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x140008045
lea rax, [r12 + 0x28]
mov r9d, esi
and r9b, 1
cmp rax, r15
jae 0x140008060
add r12, 0x10
test r9b, r9b
je 0x140008005
jmp 0x140008060
lea rcx, [rbp + 0x2220]
mov rdx, r12
xor r9d, r9d
call fcn.1400bdca0
mov esi, eax
jmp 0x140008029
movdqu xmm0, xmmword [r13 + r15 - 0x18]
movdqu xmm1, xmmword [r13 + r15 - 0x10]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x1400080be
test sil, 1
mov r14, qword [rbp + 0x2200]
mov r12, qword [rbp + 0x2208]
mov rsi, rdi
jne 0x1400080df
mov rdx, qword [rbp + 0x21c8]
test rdx, rdx
je 0x140007c70
mov r8d, 1
mov rcx, r13
call fcn.140016900
jmp 0x140007c70
add r15, 0xffffffffffffffe8
test r9b, r9b
setne r14b
lea rcx, [rbp + 0x2220]
mov rdx, r15
call fcn.1400bdca0
mov esi, eax
or sil, r14b
jmp 0x140008084
mov eax, dword [rbp + 0x21e0]
mov dword [r14 + 8], eax
movabs rax, 0x8000000000000000
mov qword [r14], rax
mov rdx, qword [rbp + 0x21c8]
test rdx, rdx
je 0x1400081bb
mov r8d, 1
mov rcx, r13
call fcn.140016900
jmp 0x1400081bb
movzx eax, byte [0x140108f61]
mov ecx, 0x1b
mov edx, 1
call fcn.1400168f0
test rax, rax
je 0x140008221
movups xmm0, xmmword [0x1400c2693]
movups xmmword [rax + 0xb], xmm0
movdqu xmm0, xmmword [str.Failed_to_enumerate_modules]
movdqu xmmword [rax], xmm0
mov qword [r14], 0x1b
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0x1b
jmp 0x1400081bb
movzx eax, byte [0x140108f61]
mov ecx, 0x25
mov edx, 1
call fcn.1400168f0
test rax, rax
je 0x140008230
movups xmm0, xmmword [0x1400c26d0]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.ntdll.dll_not_found_in_target_processntdll.dll]
movdqu xmmword [rax], xmm0
movabs rcx, 0x737365636f727020
mov qword [rax + 0x1d], rcx
mov qword [r14], 0x25
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0x25
mov rax, r14
movaps xmm6, xmmword [rbp + 0x2250]
movaps xmm7, xmmword [rbp + 0x2260]
movaps xmm8, xmmword [rbp + 0x2270]
movaps xmm9, xmmword [rbp + 0x2280]
movaps xmm10, xmmword [rbp + 0x2290]
movaps xmm11, xmmword [rbp + 0x22a0]
movaps xmm12, xmmword [rbp + 0x22b0]
movaps xmm13, xmmword [rbp + 0x22c0]
add rsp, 0x2358
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.srcutils.rs
mov edx, 0x400
call fcn.1400bfe30
mov ecx, 1
mov edx, 0x1b
call fcn.1400bf820
mov ecx, 1
mov edx, 0x25
call fcn.1400bf820
int3