Function at 0x140003490
Capabilities:
Enumerate process modules

Disassembly:
push rbp
sub rsp, 0x4e0
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], r8
mov rax, rdx
mov rdx, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rcx
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov rax, qword [rdx]
mov qword [rbp], rax
mov rax, qword [rdx + 8]
mov qword [rbp + 8], rax
lea rcx, [rbp + 0x48]
call fcn.1400038d0
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x28], rax
mov rax, qword [0x14007a548]
mov qword [rbp + 0x30], rax
mov rax, qword [0x14007a550]
mov qword [rbp + 0x38], rax
mov rax, qword [0x14007a558]
mov qword [rbp + 0x40], rax
mov ecx, 0x18
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 8], rax
mov qword [rbp + 0x68], rax
mov rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x1400035dc
jmp 0x140003631
lea rcx, [rbp + 0xc8]
mov edx, 0xaa
mov r8d, 0x238
call fcn.140076a90
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0xc8]
mov qword [rbp + 0x300], 0x4d430001
mov qword [rbp + 0x308], rax
mov qword [rbp + 0x310], 0x238
mov qword [rbp + 0x318], 0
mov qword [rbp + 0x320], 0
mov qword [rbp + 0x328], 0
lea rax, [rbp + 0x300]
xor edx, edx
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov dword [rbp + 0xc8], 0x238
lea rdx, [rbp + 0xc8]
call sub.KERNEL32.dll_Module32First
cmp eax, 0
je 0x140003642
jmp 0x140003687
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x28]
mov dx, ax
mov word [rbp + 0x76], dx
call fcn.140003900
mov rdx, qword [rbp - 0x30]
mov word [rbp + 0xc0], ax
mov rcx, rbp
add rcx, 0x30
call fcn.140003c00
mov rcx, qword [rbp - 0x28]
call fcn.1400012e0
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x78]
mov r8d, 0x50
call fcn.140076780
mov rax, qword [rbp - 0x18]
add rsp, 0x4e0
pop rbp
ret
jmp 0x140003540
mov byte [rbp + 0x337], 1
jmp 0x1400036d3
mov rcx, qword [rbp - 8]
call fcn.140003cc0
mov rdx, qword [rbp - 0x30]
mov rcx, rbp
add rcx, 0x30
call fcn.140003c00
mov rcx, qword [rbp - 0x28]
call fcn.1400012e0
mov rcx, qword [rbp - 0x20]
lea rdx, [0x14007a560]
mov r8d, 0x50
call fcn.140076780
mov rax, qword [rbp - 0x18]
add rsp, 0x4e0
pop rbp
ret
jmp 0x140003636
mov rcx, qword [rbp - 8]
call fcn.140003cc0
mov word [rbp + 0x458], 0
lea rcx, [rbp + 0x410]
mov rdx, rbp
mov r8d, 0x48
call fcn.140076780
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x410]
mov r8d, 0x50
call fcn.140076780
mov rax, qword [rbp - 0x18]
add rsp, 0x4e0
pop rbp
ret
test byte [rbp + 0x337], 1
jne 0x1400036e0
jmp 0x140003707
jmp 0x1400036d3
mov r9, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov r8, rbp
add r8, 0x30
lea rcx, [rbp + 0x338]
call fcn.140003cf0
cmp word [rbp + 0x340], 0
jne 0x140003709
jmp 0x140003764
jmp 0x140003689
mov rcx, qword [rbp - 8]
mov ax, word [rbp + 0x340]
mov word [rbp - 0x32], ax
call fcn.140003cc0
mov rdx, qword [rbp - 0x30]
mov rcx, rbp
add rcx, 0x30
call fcn.140003c00
mov ax, word [rbp - 0x32]
mov rcx, qword [rbp - 0x28]
mov word [rbp + 0x390], ax
call fcn.1400012e0
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x348]
mov r8d, 0x50
call fcn.140076780
mov rax, qword [rbp - 0x18]
add rsp, 0x4e0
pop rbp
ret
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp + 0x338]
mov qword [rbp - 0x40], rcx
mov qword [rbp + 0x398], rcx
vmovdqu xmm0, xmmword [rax]
vmovdqa xmmword [rbp + 0x3a0], xmm0
vmovdqa xmm0, xmmword [rbp + 0x3a0]
vmovdqa xmmword [rbp + 0x3b0], xmm0
lea rcx, [rbp + 0xf8]
call fcn.140003df0
mov rcx, rdx
mov rdx, qword [rbp - 0x28]
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3c8], rax
mov r9, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
lea rcx, [rbp + 0x3d8]
lea r8, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
call fcn.140003190
cmp word [rbp + 0x3e8], 0
je 0x14000386b
jmp 0x1400038a2
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], rdx
mov r8, qword [rbp + 0xe0]
mov qword [rcx], r8
mov r8d, dword [rbp + 0xe8]
mov dword [rcx + 0x48], r8d
mov qword [rcx + 0x10], rdx
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0xf0]
mov qword [rcx + 0x18], rax
add rcx, 0x20
lea rdx, [0x14007a5b0]
mov r8d, 0x28
call fcn.140076780
mov rcx, qword [rbp - 8]
lea rdx, [rbp + 0xc8]
call sub.KERNEL32.dll_Module32Next
cmp eax, 1
sete al
and al, 1
mov byte [rbp + 0x337], al
jmp 0x1400036de
mov rax, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x3e0]
mov qword [rbp + 0x3f8], rcx
mov qword [rbp + 0x3f0], rax
mov rcx, qword [rbp + 0x3f0]
mov rax, qword [rbp + 0x3f8]
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x50], rax
jmp 0x1400037f0
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x10]
mov qword [rax], rcx
mov ecx, 1
xor eax, eax
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x50], rax
jmp 0x1400037f0