Function at 0x1400a04e0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x318
movaps xmmword [rsp + 0x300], xmm7
movaps xmmword [rsp + 0x2f0], xmm6
mov rdi, rdx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x2e8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xb0], rax
movaps xmm6, xmmword [0x140299a90]
movaps xmmword [rsp + 0xa0], xmm6
cmp byte [rcx + 0x17], 0
mov qword [rsp + 0x28], rcx
js 0x1400a0573
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0xb0], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0xa0], xmm0
movsx rsi, byte [rsp + 0xb7]
test rsi, rsi
js 0x1400a0589
lea rbx, [rsp + 0xa0]
jmp 0x1400a0599
mov rdx, qword [rcx]
mov r8, qword [rcx + 8]
lea rcx, [rsp + 0xa0]
call fcn.14015b370
jmp 0x1400a055b
mov rbx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
test rsi, rsi
je 0x1400a05bc
add rsi, rsi
xor r14d, r14d
movzx ecx, word [rbx + r14]
call fcn.1401c75ec
mov word [rbx + r14], ax
add r14, 2
cmp rsi, r14
jne 0x1400a05a4
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
movaps xmmword [rsp + 0x80], xmm6
cmp byte [rdi + 0x17], 0
js 0x1400a060b
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x80], xmm0
movsx rsi, byte [rsp + 0x97]
test rsi, rsi
js 0x1400a0621
lea rdi, [rsp + 0x80]
jmp 0x1400a0631
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
lea rcx, [rsp + 0x80]
call fcn.14015b370
jmp 0x1400a05f3
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
test rsi, rsi
je 0x1400a0651
add rsi, rsi
xor ebx, ebx
movzx ecx, word [rdi + rbx]
call fcn.1401c75ec
mov word [rdi + rbx], ax
add rbx, 2
cmp rsi, rbx
jne 0x1400a063b
lea r8, [rsp + 0x7c]
mov dword [r8], 0xaaaaaaaa
lea rcx, [0x1402ecb10]
mov edx, 0x40000
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x1400a06ae
mov ecx, dword [rsp + 0x7c]
cmp rcx, 4
jb 0x1400a06ae
shr ecx, 2
lea rbx, [rsp + 0xe0]
lea r12, [rsp + 0x60]
xorps xmm7, xmm7
xor edi, edi
mov qword [rsp + 0x38], rcx
jmp 0x1400a095f
test al, al
jns 0x1400a06a9
mov rcx, qword [rsp + 0x60]
call fcn.1401a9dc4
mov dil, 1
jmp 0x1400a06b0
xor edi, edi
mov rsi, qword [rsp + 0x28]
cmp byte [rsp + 0x97], 0
jns 0x1400a06cc
mov rcx, qword [rsp + 0x80]
call fcn.1401a9dc4
cmp byte [rsp + 0xb7], 0
jns 0x1400a06e3
mov rcx, qword [rsp + 0xa0]
call fcn.1401a9dc4
cmp byte [rsi + 0x17], 0
jns 0x1400a06f1
mov rcx, qword [rsi]
call fcn.1401a9dc4
mov rcx, qword [rsp + 0x2e8]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x1400a070b
call fcn.1401ac870
int3
mov eax, edi
movaps xmm6, xmmword [rsp + 0x2f0]
movaps xmm7, xmmword [rsp + 0x300]
add rsp, 0x318
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [rsp + 0x30]
sub r13, rbp
add rbp, r15
add rbp, 2
sub r13, r15
sar r13, 1
cmp r13, r9
mov r12, rsi
jge 0x1400a08e6
jmp 0x1400a090f
mov r13, rbp
add r13, r15
je 0x1400a090f
xor r14d, r14d
movzx r12d, word [r13 + r14*2]
cmp r12w, word [r10 + r14*2]
jne 0x1400a0731
inc r14
cmp r9, r14
jne 0x1400a0766
mov r9, r13
mov r12, rsi
jmp 0x1400a0915
mov rcx, r14
mov rdx, rbp
mov r8, r13
call fcn.14015b370
mov al, byte [rsp + 0x57]
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400a082c
xor r13d, r13d
jmp 0x1400a0929
xor ebp, ebp
mov dword [rsp + 0xdb], ebp
mov dword [rsp + 0xd8], ebp
xor r13d, r13d
xor r12d, r12d
lea r14, [rsp + 0x40]
cmp byte [rsp + 0xd7], 0
jns 0x1400a07e6
mov rcx, qword [rsp + 0xc0]
call fcn.1401a9dc4
lea r14, [rsp + 0x40]
movaps xmmword [rsp + 0x40], xmm6
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
test r12b, r12b
js 0x1400a0786
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], r13
mov eax, dword [rsp + 0xd8]
mov ecx, dword [rsp + 0xdb]
lea rdx, [rsp + 0x50]
mov dword [rdx + 3], ecx
mov dword [rdx], eax
mov byte [rsp + 0x57], r12b
mov r15, rbp
mov eax, r12d
test al, al
cmovns r15, r14
movzx r14d, al
cmovs r14, r13
test r14, r14
je 0x1400a085d
add r14, r14
xor r13d, r13d
movzx ecx, word [r15 + r13]
call fcn.1401c75ec
mov word [r15 + r13], ax
add r13, 2
cmp r14, r13
jne 0x1400a0845
test r12b, r12b
jns 0x1400a086a
mov rcx, rbp
call fcn.1401a9dc4
movsx r9, byte [rsp + 0x97]
test r9, r9
cmovs r9, qword [rsp + 0x88]
mov r10, qword [rsp + 0x80]
lea rax, [rsp + 0x80]
cmovns r10, rax
movsx rax, byte [rsp + 0x57]
test rax, rax
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
cmovs rdx, rcx
test r9, r9
mov r12, rsi
je 0x1400a07a7
mov r13, rax
test al, al
jns 0x1400a08c2
mov r13, qword [rsp + 0x48]
lea r8, [rdx + r13*2]
cmp r13, r9
jl 0x1400a090f
lea r14, [r13*2]
movzx r11d, word [r10]
add r14, rdx
add r14, 0xfffffffffffffffe
mov qword [rsp + 0x30], r14
mov rbp, rdx
mov r14, r13
sub r14, r9
inc r14
je 0x1400a090f
inc r13
xor r15d, r15d
cmp word [rbp + r15], r11w
je 0x1400a0757
add r15, 2
dec r13
cmp r9, r13
jne 0x1400a08f7
mov r13, r8
mov r9, r8
sub r13, rdx
sar r13, 1
cmp r9, r8
mov rdx, 0xffffffffffffffff
cmove r13, rdx
test al, al
jns 0x1400a0932
call fcn.1401a9dc4
mov al, byte [rsp + 0x77]
cmp r13, 0xffffffffffffffff
jne 0x1400a069b
test al, al
jns 0x1400a094e
mov rcx, qword [rsp + 0x60]
call fcn.1401a9dc4
mov rcx, qword [rsp + 0x38]
inc rdi
cmp rdi, rcx
je 0x1400a06ae
lea rax, [0x1402ecb10]
mov ebp, dword [rax + rdi*4]
test ebp, ebp
je 0x1400a0953
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm6
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1401e5d50
mov ecx, 0x410
xor edx, edx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x1400a09f8
mov r13, rax
mov esi, 0x104
mov dword [rsp + 0xc0], esi
mov rcx, rax
xor edx, edx
mov r8, rbx
lea r9, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
setne cl
mov eax, dword [rsp + 0xc0]
cmp eax, esi
setb dl
and dl, cl
cmp dl, 1
jne 0x1400a09ef
mov eax, eax
mov word [rsp + rax*2 + 0xe0], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1401aa1e8
mov r13, rax
movabs rax, 0x7ffffffffffffff7
cmp r13, rax
ja 0x1400a0e7d
cmp r13, 0xa
jbe 0x1400a0bd7
mov rax, r13
or rax, 3
lea r14, [rax + 1]
cmp rax, 0xb
mov eax, Ordinal_14
cmove r14, rax
test r14, r14
js 0x1400a0e78
lea rcx, [r14 + r14]
call fcn.1401a9d88
mov rcx, rax
mov qword [rsp + 0xc0], rax
movabs rax, 0x7ffffffffffffff7
add rax, r14
add rax, 9
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], r13
lea r14, [rcx + r13*2]
cmp rbx, rcx
setb al
cmp rbx, r14
setae dl
or dl, al
je 0x1400a0e76
test r13, r13
je 0x1400a0aa1
add r13, r13
mov rdx, rbx
mov r8, r13
call fcn.1401e56b0
mov word [r14], 0
movaps xmmword [rsp + 0x60], xmm6
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
cmp byte [rsp + 0xd7], 0
js 0x1400a0bec
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x60], xmm0
movsx r15, byte [rsp + 0x77]
mov rsi, r12
test r15, r15
jns 0x1400a0afb
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
test r15, r15
je 0x1400a0b1e
add r15, r15
xor r14d, r14d
movzx ecx, word [r12 + r14]
call fcn.1401c75ec
mov word [r12 + r14], ax
add r14, 2
cmp r15, r14
jne 0x1400a0b06
cmp byte [rsp + 0xd7], 0
jns 0x1400a0b35
mov rcx, qword [rsp + 0xc0]
call fcn.1401a9dc4
movsx rcx, byte [rsp + 0xb7]
test rcx, rcx
cmovs rcx, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
lea rax, [rsp + 0xa0]
cmovns r8, rax
movsx rax, byte [rsp + 0x77]
mov r12, rsi
mov rdx, rsi
test rax, rax
jns 0x1400a0b74
mov rdx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400a0c5e
mov r13, rax
test al, al
jns 0x1400a0b89
mov r13, qword [rsp + 0x68]
cmp r13, rcx
jl 0x1400a0940
lea r11, [r13*2]
lea r9, [rdx + r13*2]
movzx r10d, word [r8]
add r11, rdx
add r11, 0xfffffffffffffffe
mov r12, rdx
mov r14, r13
sub r14, rcx
inc r14
je 0x1400a0bcf
inc r13
xor ebp, ebp
cmp word [r12 + rbp], r10w
je 0x1400a0c2a
add rbp, 2
dec r13
cmp rcx, r13
jne 0x1400a0bbc
mov r12, rsi
jmp 0x1400a0940
mov byte [rsp + 0xd7], r13b
lea rcx, [rsp + 0xc0]
jmp 0x1400a0a76
mov rdx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xc8]
mov rcx, r12
call fcn.14015b370
jmp 0x1400a0ae3
mov r13, r11
sub r13, r12
add r12, rbp
add r12, 2
sub r13, rbp
sar r13, 1
cmp r13, rcx
jge 0x1400a0bac
jmp 0x1400a0bcf
xor edx, edx
jmp 0x1400a0d53
mov r14, r12
add r14, rbp
je 0x1400a0bcf
xor r15d, r15d
movzx r13d, word [r14 + r15*2]
cmp r13w, word [r8 + r15*2]
jne 0x1400a0c09
inc r15
cmp rcx, r15
jne 0x1400a0c35
cmp r14, r9
je 0x1400a0bcf
sub rdx, r12
add rdx, 0xfffffffffffffffe
cmp rdx, rbp
je 0x1400a0bcf
movsx rcx, byte [rsp + 0x97]
test rcx, rcx
jns 0x1400a0c74
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400a069b
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmmword [rsp + 0x40], xmm6
lea rax, [0x1402ecb10]
mov r8d, dword [rax + rdi*4]
movaps xmmword [rsp + 0xc0], xmm7
mov qword [rsp + 0xd0], 0
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x1400a07af
mov rbp, rax
cmp byte [0x1402ec8a7], 0
lea rcx, [0x1402ec890]
jns 0x1400a0ce0
mov rcx, qword [0x1402ec890]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov r14, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
je 0x1400a0c23
cmp byte [0x1402ec8bf], 0
lea rdx, [0x1402ec8a8]
jns 0x1400a0d0d
mov rdx, qword [0x1402ec8a8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movaps xmmword [rsp + 0x100], xmm7
movaps xmmword [rsp + 0xf0], xmm7
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0x20], 0
mov rcx, rbp
xor edx, edx
mov r8, rbx
mov r9d, 0x30
call qword [0x1402cbd20]
mov rdx, qword [rsp + 0xe8]
xor eax, eax
mov qword [rsp + 0xb8], rax
add rdx, 0x20
mov qword [rsp + 0x20], rax
mov r9d, 8
mov rcx, rbp
lea r8, [rsp + 0xb8]
call r14
test eax, eax
je 0x1400a07af
movaps xmmword [rsp + 0xe0], xmm6
mov rdx, qword [rsp + 0xb8]
add rdx, 0x70
mov qword [rsp + 0x20], 0
mov r9d, 0x10
mov rcx, rbp
mov r8, rbx
call r14
test eax, eax
je 0x1400a07af
movzx r12d, word [rsp + 0xe0]
lea rcx, [r12*2 + 0x20]
call fcn.1401aa168
mov r13, rax
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x20], 0
mov rcx, rbp
mov r8, rax
mov r9, r12
call r14
test eax, eax
je 0x1400a07af
movzx eax, word [rsp + 0xe0]
mov word [r13 + rax*2], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x1400a0e76
lea rcx, [rsp + 0xc0]
mov rdx, r13
call fcn.14002e7a0
mov rcx, r13
call fcn.1401aa100
mov rbp, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xc8]
lea rcx, [rsp + 0xd0]
mov eax, dword [rcx]
mov ecx, dword [rcx + 3]
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xdb], ecx
mov r12b, byte [rsp + 0xd7]
movaps xmmword [rsp + 0xc0], xmm7
mov qword [rsp + 0xd0], 0
jmp 0x1400a07c5
ud2
call fcn.1401e9820
lea rcx, [rsp + 0xc0]
call fcn.1401e97e0
int3