Function at 0x140009d70
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov eax, 0x104d0
call fcn.140076cc0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x80], r9
mov qword [rbp + 0x88], r8
mov qword [rbp + 0x90], rdx
mov qword [rbp + 0x98], rcx
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xb0], r8
mov qword [rbp + 0xb8], r9
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xc0], rax
lea rcx, [rbp + 0xc8]
mov edx, 0xaa
mov r8d, 8
call fcn.14008be80
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd0], 0x4d430001
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], 8
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
lea rax, [rbp + 0xd0]
xor ecx, ecx
mov edx, ecx
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
lea rcx, [rbp + 0x100]
mov edx, 0xaa
mov r8d, 4
call fcn.14008be80
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x100]
mov qword [rbp + 0xd0], 0x4d430001
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], 4
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
lea rax, [rbp + 0xd0]
xor edx, edx
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
lea rdx, [rbp + 0xc8]
xor r8d, r8d
lea r9, [rbp + 0x100]
call sub.KERNEL32.dll_K32EnumProcessModules
cmp eax, 0
jne 0x140009f16
mov rcx, qword [rbp + 0x90]
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [0x1400c1f10]
mov qword [rcx], rdx
mov rdx, qword [0x1400c1f18]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
jmp 0x140009f18
mov rdx, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rbp + 0x100]
shr eax, 3
mov dword [rbp + 0x7c], eax
mov dword [rbp + 0x104], eax
mov qword [rbp + 0x118], rcx
mov r8, qword [rbp + 0x118]
mov eax, eax
mov r9d, eax
lea rcx, [rbp + 0x120]
call fcn.1400266e0
cmp word [rbp + 0x130], 0
je 0x140009fa7
mov rcx, qword [rbp + 0x90]
mov ax, word [rbp + 0x130]
mov word [rbp + 0x140], ax
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x138]
mov qword [rcx], rdx
mov rdx, qword [rbp + 0x140]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
mov rax, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x128]
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x110]
mov ecx, 8
mul rcx
mov qword [rbp + 0x148], rax
seto byte [rbp + 0x150]
mov al, byte [rbp + 0x150]
test al, al
jne 0x140009ff9
jmp 0x140009ff7
jmp 0x14000a016
lea rcx, [0x1400c1f20]
mov edx, 0x10
xor eax, eax
mov r8d, eax
lea r9, [0x1400c1f30]
call fcn.140001260
mov rdx, qword [rbp + 0x148]
lea rcx, [rbp + 0x158]
call fcn.140026780
cmp byte [rbp + 0x15c], 0
je 0x14000a03d
mov eax, dword [rbp + 0x158]
mov dword [rbp + 0x6c], eax
jmp 0x14000a09d
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x160], rax
mov rcx, qword [rbp + 0x160]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov rcx, qword [rbp + 0x90]
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [0x1400c1f40]
mov qword [rcx], rdx
mov rdx, qword [0x1400c1f48]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
mov rdx, qword [rbp + 0x70]
mov rcx, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0x6c]
lea r9, [rbp + 0x100]
call sub.KERNEL32.dll_K32EnumProcessModules
cmp eax, 0
jne 0x14000a11d
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x168], rax
mov rcx, qword [rbp + 0x168]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov rcx, qword [rbp + 0x90]
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [0x1400c1f50]
mov qword [rcx], rdx
mov rdx, qword [0x1400c1f58]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
jmp 0x14000a11f
mov ecx, dword [rbp + 0x7c]
mov edx, dword [rbp + 0x100]
shr edx, 3
mov dword [rbp + 0x170], edx
call fcn.1400269c0
mov ecx, eax
mov eax, ecx
mov dword [rbp + 0x174], ecx
mov rcx, qword [rbp + 0x108]
mov qword [rbp + 0x50], rcx
mov rcx, qword [rbp + 0x110]
mov qword [rbp + 0x58], rcx
mov eax, eax
mov qword [rbp + 0x60], rax
cmp rax, rcx
ja 0x14000a163
jmp 0x14000a170
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x60]
call fcn.140001140
mov rcx, qword [rbp + 0x60]
xor eax, eax
cmp rax, rcx
ja 0x14000a17d
jmp 0x14000a18a
mov rdx, qword [rbp + 0x60]
xor eax, eax
mov ecx, eax
call fcn.140001140
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x60]
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x178], 0
mov rcx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x38], rax
cmp rax, rcx
jae 0x14000a1c8
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
cmp rax, rcx
jb 0x14000a1cd
jmp 0x14000a1cf
jmp 0x14000aa8e
jmp 0x14000a1dc
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x38]
call fcn.140001140
mov rax, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rax + rcx*8]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x180], rax
lea rcx, [rbp + 0x188]
mov edx, 0xaa
mov r8d, 0x18
call fcn.14008be80
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x188]
mov qword [rbp + 0xd0], 0x4d430001
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], 0x18
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
lea rax, [rbp + 0xd0]
xor edx, edx
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov rdx, qword [rbp + 0x30]
lea r8, [rbp + 0x188]
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
cmp eax, 0
jne 0x14000a2ed
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x1a0], rax
mov rcx, qword [rbp + 0x1a0]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov rcx, qword [rbp + 0x90]
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [0x1400c1f60]
mov qword [rcx], rdx
mov rdx, qword [0x1400c1f68]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
jmp 0x14000a2ef
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x1a8], rax
mov ecx, dword [rbp + 0x190]
add rax, rcx
mov qword [rbp + 0x1b0], rax
setb byte [rbp + 0x1b8]
mov al, byte [rbp + 0x1b8]
test al, al
jne 0x14000a326
jmp 0x14000a324
jmp 0x14000a343
lea rcx, [0x1400c1f70]
mov edx, 0x10
xor eax, eax
mov r8d, eax
lea r9, [0x1400c1f80]
call fcn.140001260
mov rax, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x1b0]
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x1c0], rdx
cmp rax, rcx
jb 0x14000a37b
mov rax, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x20]
cmp rax, rcx
setb al
mov byte [rbp + 0x1f], al
jmp 0x14000a382
xor eax, eax
mov byte [rbp + 0x1f], al
jmp 0x14000a382
mov al, byte [rbp + 0x1f]
test al, 1
jne 0x14000a38b
jmp 0x14000a3b9
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x1c8], rax
mov rcx, qword [rbp + 0x1c8]
add rcx, 0x10
call fcn.1400269f0
mov qword [rbp + 0x10], rax
cmp rax, 0
jne 0x14000a3be
jmp 0x14000a42d
jmp 0x14000aa36
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x10]
mov qword [rbp + 0x1d0], rcx
mov word [rbp + 0x1e0], 0
mov qword [rbp + 0x1d8], rcx
mov qword [rbp + 0x1e8], rax
mov rcx, qword [rbp + 0x1e8]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x1d8]
mov qword [rcx], rdx
mov rdx, qword [rbp + 0x1e0]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
jmp 0x14000a42f
lea rcx, [rbp + 0x1f4]
mov qword [rbp], rcx
mov dl, 0xaa
mov r8d, 0x10008
call fcn.14008be80
mov rcx, qword [rbp]
mov qword [rbp + 0xd0], 0x4d430001
mov qword [rbp + 0xd8], rcx
mov qword [rbp + 0xe0], 0x10008
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
xor eax, eax
mov edx, eax
lea rax, [rbp + 0xd0]
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov edx, 4
lea r8, str.___
mov r9d, 4
call fcn.1400089c0
mov rcx, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0x30]
lea r8, [rbp + 0x1f4]
add r8, 8
mov r9d, 0x7fff
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov dword [rbp + 0xc], eax
mov dword [rbp + 0x101fc], eax
cmp eax, 0
seta cl
call fcn.140004370
mov rax, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x90]
mov qword [rbp + 0x10200], rax
mov r8, qword [rbp + 0x10200]
lea rcx, [rbp + 0x10208]
call fcn.140026a40
cmp word [rbp + 0x10210], 0
je 0x14000a59b
mov rax, qword [rbp + 0x88]
mov cx, word [rbp + 0x10210]
mov word [rbp - 2], cx
mov qword [rbp + 0x10218], rax
mov rcx, qword [rbp + 0x10218]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov ax, word [rbp - 2]
mov rcx, qword [rbp + 0x90]
mov word [rbp + 0x10228], ax
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x10220]
mov qword [rcx], rdx
mov rdx, qword [rbp + 0x10228]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
mov eax, dword [rbp + 0xc]
mov rcx, qword [rbp + 0x10208]
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0x10230], rcx
mov qword [rbp + 0x10238], rcx
add eax, 4
mov dword [rbp + 0x10240], eax
setb byte [rbp + 0x10244]
mov al, byte [rbp + 0x10244]
test al, al
jne 0x14000a5d5
jmp 0x14000a5d3
jmp 0x14000a5f2
lea rcx, [0x1400c1f98]
mov edx, 0x10
xor eax, eax
mov r8d, eax
lea r9, [0x1400c1fa8]
call fcn.140001260
mov eax, dword [rbp + 0x10240]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x1f4]
mov qword [rbp - 0x18], rcx
inc rax
mov qword [rbp + 0x10248], rax
mov byte [rbp + 0x10250], 0
mov al, byte [rbp + 0x10250]
test al, al
jne 0x14000a626
jmp 0x14000a624
jmp 0x14000a643
lea rcx, [0x1400c1fb8]
mov edx, 0x10
xor eax, eax
mov r8d, eax
lea r9, [0x1400c1fc8]
call fcn.140001260
mov rax, qword [rbp + 0x10248]
mov qword [rbp - 0x28], rax
cmp rax, 0x8004
ja 0x14000a658
jmp 0x14000a666
mov rcx, qword [rbp - 0x28]
mov edx, 0x8004
call fcn.140001140
mov rcx, qword [rbp - 0x20]
xor eax, eax
cmp rax, rcx
ja 0x14000a673
jmp 0x14000a680
mov rdx, qword [rbp - 0x20]
xor eax, eax
mov ecx, eax
call fcn.140001140
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov rdx, rcx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], rax
mov cx, word [rax + rcx*2]
mov word [rbp - 0x2a], cx
xor eax, eax
cmp ax, cx
jne 0x14000a6a4
jmp 0x14000a6af
mov dx, word [rbp - 0x2a]
xor ecx, ecx
call fcn.140026b40
mov rdx, qword [rbp + 0x90]
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
mov qword [rbp + 0x10258], rcx
mov qword [rbp + 0x10260], rax
mov r8, qword [rbp + 0x10258]
mov r9, qword [rbp + 0x10260]
lea rcx, [rbp + 0x10268]
lea rax, [0x1400c1fd8]
mov qword [rsp + 0x20], rax
call fcn.140026b80
cmp word [rbp + 0x10270], 0
jne 0x14000a70c
lea rax, [rbp + 0x10268]
mov qword [rbp - 0x48], rax
jmp 0x14000a82a
mov ax, word [rbp + 0x10270]
mov word [rbp - 0x4a], ax
sub ax, 6
je 0x14000a7ac
jmp 0x14000a723
mov rax, qword [rbp + 0x88]
mov rdx, qword [rbp - 0x10]
mov cx, word [rbp - 0x4a]
mov word [rbp + 0x10290], cx
mov qword [rbp + 0x10298], rax
mov rcx, qword [rbp + 0x10298]
call fcn.140026c40
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x102a0], rax
mov rcx, qword [rbp + 0x102a0]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov rcx, qword [rbp + 0x90]
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x10288]
mov qword [rcx], rdx
mov rdx, qword [rbp + 0x10290]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
mov rax, qword [rbp + 0x88]
mov rdx, qword [rbp - 0x10]
mov qword [rbp + 0x10278], rax
mov rcx, qword [rbp + 0x10278]
call fcn.140026c40
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x10280], rax
mov rcx, qword [rbp + 0x10280]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov rcx, qword [rbp + 0x90]
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [0x1400c1fe0]
mov qword [rcx], rdx
mov rdx, qword [0x1400c1fe8]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
mov r8, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x90]
mov r9, qword [rbp - 0x48]
lea rcx, [rbp + 0x102a8]
call fcn.140024200
cmp word [rbp + 0x103d0], 0
je 0x14000a8ea
mov rax, qword [rbp + 0x88]
mov rdx, qword [rbp - 0x10]
mov cx, word [rbp + 0x103d0]
mov word [rbp - 0x4c], cx
mov qword [rbp + 0x103d8], rax
mov rcx, qword [rbp + 0x103d8]
call fcn.140026c40
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x103e0], rax
mov rcx, qword [rbp + 0x103e0]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov ax, word [rbp - 0x4c]
mov rcx, qword [rbp + 0x90]
mov word [rbp + 0x103f0], ax
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x103e8]
mov qword [rcx], rdx
mov rdx, qword [rbp + 0x103f0]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0x102a8]
mov r8d, 0x128
call fcn.14008bb90
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x90]
mov r8, qword [rbp + 0x28]
mov r9, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x10230]
mov qword [rdx], r8
mov qword [rbp + 0x103f8], rax
mov rdx, qword [rbp + 0x103f8]
add rdx, 0x10
call fcn.140026d00
mov word [rbp - 0x4e], ax
cmp ax, 0
je 0x14000a9ce
mov rax, qword [rbp + 0x88]
mov rdx, qword [rbp - 0x10]
mov qword [rbp + 0x10400], rax
mov rcx, qword [rbp + 0x10400]
call fcn.140026c40
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x10408], rax
mov rcx, qword [rbp + 0x10408]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov ax, word [rbp - 0x4e]
mov rcx, qword [rbp + 0x90]
mov word [rbp + 0x10418], ax
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x10410]
mov qword [rcx], rdx
mov rdx, qword [rbp + 0x10418]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp - 0x10]
mov word [rbp + 0x10428], 0
mov qword [rbp + 0x10420], rcx
mov qword [rbp + 0x10430], rax
mov rcx, qword [rbp + 0x10430]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x10420]
mov qword [rcx], rdx
mov rdx, qword [rbp + 0x10428]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret
jmp 0x14000aa38
mov rax, qword [rbp + 0x178]
inc rax
mov qword [rbp + 0x10438], rax
sete byte [rbp + 0x10440]
mov al, byte [rbp + 0x10440]
test al, al
jne 0x14000aa5e
jmp 0x14000aa5c
jmp 0x14000aa7b
lea rcx, [0x1400c1ff0]
mov edx, 0x10
xor eax, eax
mov r8d, eax
lea r9, [0x1400c2000]
call fcn.140001260
mov rax, qword [rbp + 0x10438]
mov qword [rbp + 0x178], rax
jmp 0x14000a1a5
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x10448], rax
mov rcx, qword [rbp + 0x10448]
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x110]
call fcn.140026820
mov rcx, qword [rbp + 0x90]
call fcn.140001e50
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [0x1400c2010]
mov qword [rcx], rdx
mov rdx, qword [0x1400c2018]
mov qword [rcx + 8], rdx
add rsp, 0x104d0
pop rbp
ret