Function at 0x100011c0
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10011f6b
mov eax, dword fs:[0]
push eax
mov eax, 0x128c
call fcn.10011f10
mov eax, dword [0x100b5040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x127c], edx
mov dword [ebp - 0x1278], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x124c]
push eax
push 0x1000
lea eax, [ebp - 0x1218]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x100018db
mov esi, dword [ebp - 0x124c]
xor eax, eax
shr esi, 2
mov dword [ebp - 0x126c], esi
mov dword [ebp - 0x1274], eax
test esi, esi
je 0x100018db
mov ecx, esi
nop dword [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x1238], 0
movups xmmword [ebp - 0x1248], xmm0
mov dword [ebp - 0x1234], 0xf
mov byte [ebp - 0x1248], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp + eax*4 - 0x1218]
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
test eax, eax
jne 0x1000129a
mov dword [ebp - 4], 0xffffffff
jmp 0x100018c6
add eax, esi
mov dword [ebp - 0x1270], eax
call edi
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x10001879
xorps xmm0, xmm0
mov dword [ebp - 0x1220], 0
lea esi, [ebp - 0x218]
mov dword [ebp - 0x121c], 0
movups xmmword [ebp - 0x1230], xmm0
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100012e7
sub esi, ecx
sar esi, 1
cmp esi, 0x7ffffffe
ja 0x100019c6
cmp esi, 7
ja 0x1000133f
mov dword [ebp - 0x1220], esi
lea eax, [ebp - 0x218]
add esi, esi
mov dword [ebp - 0x121c], 7
push esi
push eax
lea eax, [ebp - 0x1230]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x1230], ax
jmp 0x100013e7
mov edi, esi
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x10001388
mov eax, 0x7fffffff
mov edi, 0x7ffffffe
add eax, eax
cmp eax, 0x1000
jb 0x100013a7
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x100019cb
push ecx
call fcn.10010f5d
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x100019c0
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x100013b0
cmp edi, 0xa
mov eax, 0xa
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x100019cb
add eax, eax
jne 0x10001358
jmp 0x100013b0
push eax
call fcn.10010f5d
add esp, 4
mov dword [ebp - 0x1220], esi
lea ecx, [ebp - 0x218]
add esi, esi
mov dword [ebp - 0x1268], eax
push esi
push ecx
push eax
mov dword [ebp - 0x1230], eax
mov dword [ebp - 0x121c], edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x1268]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x1230]
cmp dword [ebp - 0x121c], 7
lea esi, [ebp - 0x1230]
mov eax, dword [ebp - 0x1220]
xorps xmm0, xmm0
cmova edx, dword [ebp - 0x1230]
cmova esi, dword [ebp - 0x1230]
movups xmmword [ebp - 0x1298], xmm0
lea edx, [edx + eax*2]
cmp esi, edx
jne 0x10001443
mov dword [ebp - 0x1288], 0
mov dword [ebp - 0x1284], 0xf
mov byte [ebp - 0x1298], 0
jmp 0x10001545
sub edx, esi
mov edi, 0xf
sar edx, 1
mov dword [ebp - 0x1268], edx
mov dword [ebp - 0x1284], edi
cmp edx, 0x7fffffff
ja 0x100019c6
cmp edx, edi
jbe 0x10001507
mov edi, edx
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x10001488
mov ecx, 0x80000000
mov edi, 0x7fffffff
add ecx, 0x23
jmp 0x100014ba
cmp edi, 0x16
mov eax, 0x16
cmovb edi, eax
lea eax, [edi + 1]
test eax, eax
jne 0x100014a8
mov dword [ebp - 0x1298], eax
mov dword [ebp - 0x1284], edi
jmp 0x1000150d
cmp eax, 0x1000
jb 0x100014ea
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x100019cb
push ecx
call fcn.10010f5d
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x100019c0
mov edx, dword [ebp - 0x1268]
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [ebp - 0x1284], edi
mov dword [ebp - 0x1298], eax
mov dword [eax - 4], ecx
jmp 0x1000150d
push eax
call fcn.10010f5d
mov edx, dword [ebp - 0x1268]
add esp, 4
mov dword [ebp - 0x1298], eax
mov dword [ebp - 0x1284], edi
jmp 0x1000150d
mov eax, dword [ebp - 0x1298]
cmp edi, 0xf
lea ecx, [ebp - 0x1298]
mov edi, edx
cmova ecx, eax
mov dword [ebp - 0x1268], ecx
test edx, edx
je 0x10001535
mov al, byte [esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
lea esi, [esi + 2]
sub edi, 1
jne 0x10001525
mov eax, dword [ebp - 0x1268]
mov dword [ebp - 0x1288], edx
mov byte [eax + edx], 0
mov ecx, dword [ebp - 0x1234]
cmp ecx, 0xf
jbe 0x1000157f
mov edx, dword [ebp - 0x1248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001575
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100019c0
push ecx
push edx
call fcn.10010f92
add esp, 8
movups xmm1, xmmword [ebp - 0x1298]
lea edx, [ebp - 0x1248]
movq xmm0, qword [ebp - 0x1288]
movq qword [ebp - 0x1238], xmm0
mov edi, dword [ebp - 0x1234]
cmp edi, 0xf
mov ecx, dword [ebp - 0x1238]
movd esi, xmm1
movups xmmword [ebp - 0x1248], xmm1
mov dword [ebp - 0x1268], ecx
cmova edx, esi
cmp ecx, 1
jb 0x100015f6
lea eax, [ecx - 1]
cmp eax, ecx
cmovb ecx, eax
add ecx, edx
nop
cmp byte [ecx], 0x5c
jne 0x100015e9
movzx eax, byte [ecx]
cmp al, 0x5c
jne 0x100015e0
xor eax, eax
jmp 0x100015e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100015f0
cmp ecx, edx
je 0x100015f6
dec ecx
jmp 0x100015d0
sub ecx, edx
je 0x10001641
jmp 0x100015f9
or ecx, 0xffffffff
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x1268]
cmp ecx, eax
lea edx, [ebp - 0x1248]
cmovb eax, ecx
cmp edi, 0xf
cmova edx, esi
sub ecx, eax
mov dword [ebp - 0x1268], ecx
add eax, edx
inc ecx
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x1268]
add esp, 0xc
mov edi, dword [ebp - 0x1234]
mov esi, dword [ebp - 0x1248]
mov dword [ebp - 0x1238], eax
mov eax, dword [ebp - 0x1278]
mov ecx, eax
cmp dword [eax + 0x14], 0xf
jbe 0x10001651
mov ecx, dword [eax]
cmp edi, 0xf
lea eax, [ebp - 0x1248]
cmova eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001680
test dl, dl
je 0x1000167c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001680
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001660
xor eax, eax
jmp 0x10001685
sbb eax, eax
or eax, 1
test eax, eax
je 0x100016fb
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x121c]
cmp eax, 7
jbe 0x100016d9
mov edx, dword [ebp - 0x1230]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100016c3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100019c0
push ecx
push edx
call fcn.10010f92
mov edi, dword [ebp - 0x1234]
add esp, 8
mov esi, dword [ebp - 0x1248]
xor eax, eax
mov dword [ebp - 0x1220], 0
mov dword [ebp - 0x121c], 7
mov word [ebp - 0x1230], ax
jmp 0x10001885
mov ecx, dword [ebp - 0x1270]
xor eax, eax
mov dword [ebp - 0x1268], eax
cmp dword [ecx + 0x18], eax
jbe 0x10001835
mov edi, ecx
mov ecx, dword [ebp - 0x1274]
xorps xmm0, xmm0
mov edx, dword [edi + 0x1c]
movups xmmword [ebp - 0x1264], xmm0
mov dword [ebp - 0x1254], 0
mov esi, dword [ebp + ecx*4 - 0x1218]
add edx, esi
mov dword [ebp - 0x1250], 0
lea ecx, [esi + eax*4]
mov eax, dword [edi + 0x20]
mov ecx, dword [ecx + eax]
mov eax, dword [edi + 0x24]
mov edi, dword [ebp - 0x1268]
add eax, esi
movzx eax, word [eax + edi*2]
mov eax, dword [edx + eax*4]
lea edx, [esi + ecx]
mov ecx, edx
add eax, esi
mov dword [ebp - 0x1280], eax
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001770
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x1264]
call fcn.10001f90
mov edx, dword [ebp - 0x127c]
lea eax, [ebp - 0x1264]
mov edi, dword [ebp - 0x1250]
mov ecx, edx
mov esi, dword [ebp - 0x1264]
cmp edi, 0xf
cmova eax, esi
cmp dword [edx + 0x14], 0xf
jbe 0x100017b0
mov ecx, dword [edx]
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100017d0
test dl, dl
je 0x100017cc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100017d0
add ecx, 2
add eax, 2
test dl, dl
jne 0x100017b0
xor eax, eax
jmp 0x100017d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100018f8
cmp edi, 0xf
jbe 0x1000180d
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x10001803
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100019c0
push ecx
push esi
call fcn.10010f92
add esp, 8
mov eax, dword [ebp - 0x1268]
mov edi, dword [ebp - 0x1270]
inc eax
mov dword [ebp - 0x1268], eax
cmp eax, dword [edi + 0x18]
jb 0x10001714
mov edi, dword [ebp - 0x1234]
mov esi, dword [ebp - 0x1248]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x121c]
cmp eax, 7
jbe 0x10001885
mov edx, dword [ebp - 0x1230]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000186f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100019c0
push ecx
push edx
call fcn.10010f92
add esp, 8
mov esi, dword [ebp - 0x1248]
mov edi, dword [ebp - 0x1234]
mov dword [ebp - 4], 0xffffffff
cmp edi, 0xf
jbe 0x100018ba
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x100018b0
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100019c0
push edi
push esi
call fcn.10010f92
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x126c]
mov eax, dword [ebp - 0x1274]
inc eax
mov dword [ebp - 0x1274], eax
cmp eax, ecx
jl 0x10001250
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10010f4a
mov esp, ebp
pop ebp
ret
cmp edi, 0xf
jbe 0x10001926
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x1000191c
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100019c0
push edi
push esi
call fcn.10010f92
add esp, 8
mov ecx, dword [ebp - 0x121c]
cmp ecx, 7
jbe 0x10001962
mov edx, dword [ebp - 0x1230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10001958
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100019c0
push ecx
push edx
call fcn.10010f92
add esp, 8
mov ecx, dword [ebp - 0x1234]
xor eax, eax
mov dword [ebp - 0x1220], 0
mov dword [ebp - 0x121c], 7
mov word [ebp - 0x1230], ax
cmp ecx, 0xf
jbe 0x100019b5
mov edx, dword [ebp - 0x1248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100019ab
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100019c0
push ecx
push edx
call fcn.10010f92
add esp, 8
mov eax, dword [ebp - 0x1280]
jmp 0x100018dd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.100011b0
call fcn.10001110
int3