Function at 0x1400027f0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r13, r8
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x38], rdx
test r8, r8
jne 0x140002894
mov rdx, qword [rdx + 0x18]
cmp rdx, 0x10
jb 0x140002862
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000285d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002c0e
mov rcx, r8
call fcn.1400071e8
xor r14d, r14d
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r14b
xor al, al
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140006dc0
add rsp, 0x180
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov ecx, 0x2027
call fcn.140006f5c
test rax, rax
je 0x140002c15
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x40], rcx
lea rbx, [rcx + 0x2000]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x2000
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x40]
sub rbx, rcx
sar rbx, 3
lea r8, [rbx*8]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x58], r14d
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
sub rax, rdx
sar rax, 3
lea r8d, [rax*8]
lea r9, [rsp + 0x58]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
jne 0x1400029da
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000298c
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002979
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c15
call fcn.1400071e8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1400029c6
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x1400029c1
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002c0e
mov rcx, r8
call fcn.1400071e8
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
jmp 0x140002874
mov r8d, dword [rsp + 0x58]
shr r8, 3
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
sub rcx, rbx
sar rcx, 3
cmp r8, rcx
jae 0x140002a07
lea rsi, [rbx + r8*8]
mov qword [rsp + 0x48], rsi
jmp 0x140002a54
jbe 0x140002a54
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 3
cmp r8, rax
jbe 0x140002a2e
mov rdx, r8
lea rcx, [rsp + 0x40]
call fcn.1400068e0
mov rsi, qword [rsp + 0x48]
jmp 0x140002a4f
sub r8, rcx
lea r8, [r8*8]
lea rbx, [rsi + r8]
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov rsi, rbx
mov qword [rsp + 0x48], rbx
mov rbx, qword [rsp + 0x40]
cmp rbx, rsi
je 0x140002b07
nop dword [rax]
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x104
lea r8, [rsp + 0x60]
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x140002af5
lea rcx, [rsp + 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140002aa0
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140002aba
mov rcx, qword [rdi]
cmp r8, rax
jne 0x140002af5
lea rdx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140002af5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea r9d, [rax + 0x18]
lea r8, [rsp + 0x20]
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
jne 0x140002b51
add rbx, 8
cmp rbx, rsi
jne 0x140002a60
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14000298c
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140002b49
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c15
mov rcx, rbx
jmp 0x140002979
mov rax, qword [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov eax, dword [rsp + 0x28]
mov dword [r13 + 0x20], eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002bbb
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ba8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ba8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400071e8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140002bf1
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140002bec
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002c07
mov rcx, r8
call fcn.1400071e8
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov al, 1
jmp 0x140002876
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3