Function at 0x18000c220
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d0
mov rax, qword [0x1800a2de8]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov qword [rsp + 0x40], rsp
mov rdi, r8
mov r13, rdx
mov r15d, ecx
mov qword [rsp + 0x48], 0xffffffffffffffff
xor r12d, r12d
mov dword [rsp + 0x70], r12d
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x74]
call fcn.180056c20
mov qword [rsp + 0x38], r12
mov edx, r15d
lea ecx, [r12 + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x18000c3f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12d, [rax + 0x1e]
mov dword [rsp + 0x30], r12d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14d, [rax + 0x1e]
mov qword [rsp + 0x50], 0
mov ecx, 0x1000a
call fcn.180053ad4
mov rsi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rsi, rsi
je 0x18000c3a1
test rax, rax
je 0x18000c3a1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
mov r9d, r15d
lea r8, str.Cannot_enumerate_loaded_modules_Pid:__d_Process_Name:__s_Address:_0x_08X
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18000c389
xor eax, eax
mov word [rbx + 0x1fffe], ax
lea rdx, [rax - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.180054798
test eax, eax
je 0x18000c35f
mov r8d, r14d
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
lea r9, str.MbaeLogProcessModules
mov edx, 0x451
mov r8d, 1
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000c3ba
mov edx, r14d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000c3b4
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rsi, rsi
je 0x18000c3c7
mov rcx, rsi
call fcn.180053a94
test rbx, rbx
je 0x18000c3d4
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x58], r12d
lea rdx, [0x18000c3ed]
mov rcx, qword [rsp + 0x40]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x30]
jmp 0x18000c902
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x18000c583
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x18000c583
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12d, [rax + 0x1e]
mov dword [rsp + 0x30], r12d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14d, [rax + 0x1e]
xor eax, eax
mov qword [rsp + 0x60], rax
mov ecx, 0x1000a
call fcn.180053ad4
mov rsi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rsi, rsi
je 0x18000c52e
test rax, rax
je 0x18000c52e
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
mov r9d, r15d
lea r8, str.Cannot_enumerate_the_first_loaded_modules_Pid:__d_Process_Name:__s_Address:_0x_08X
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18000c516
xor eax, eax
mov word [rbx + 0x1fffe], ax
lea rdx, [rax - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.180054798
test eax, eax
je 0x18000c4ec
mov r8d, r14d
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
lea r9, str.MbaeLogProcessModules
mov edx, 0x45c
mov r8d, 1
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000c547
mov edx, r14d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000c541
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rsi, rsi
je 0x18000c554
mov rcx, rsi
call fcn.180053a94
test rbx, rbx
je 0x18000c561
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x6c], r12d
lea rdx, [0x18000c57a]
mov rcx, qword [rsp + 0x40]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x30]
jmp 0x18000c902
mov ecx, 0x1964a
call fcn.180053ad4
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000c663
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18000c5cb
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18000c63d
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18000c617
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
lea r9, str.MbaeLogProcessModules
mov edx, 0x462
mov r8d, 1
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000c635
mov edx, 5
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x68], 5
lea rdx, [0x18000c659]
mov rcx, qword [rsp + 0x40]
call fcn.180057580
nop
nop
nop
mov eax, 5
jmp 0x18000c902
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
mov r9d, dword [rsp + 0x78]
lea r8, str._tProcess_Info:_Pid:__d_Process_Name:__s_Address:_0x_08X_r_n
mov edx, 0x104
mov rcx, rax
call fcn.180053a4c
nop word [rax + rax]
mov ecx, dword [rsp + 0x88]
mov edx, dword [rsp + 0x90]
add edx, ecx
cmp rdi, rcx
jb 0x18000c6f1
mov eax, edx
cmp rdi, rax
ja 0x18000c6f1
mov dword [rsp + 0x28], edx
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
mov r8d, r15d
lea rdx, str._t_tPid:__d___t__LoadedModule:__s__tAddress:_0x_08X:0x_08X_r_n
lea rcx, [rsp + 0x4b0]
call fcn.180003d50
lea r8, [rsp + 0x4b0]
mov edx, 0xcb1f
mov rcx, rbx
call fcn.18005384c
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x18000c690
or rax, 0xffffffffffffffff
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x18000c710
mov word [rbx + rax*2 - 4], r12w
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15d, [rax + 0x1e]
mov qword [rsp + 0x30], r12
mov ecx, 0x1000a
call fcn.180053ad4
mov r14, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rdi, rax
test r14, r14
je 0x18000c80c
test rax, rax
je 0x18000c80c
mov r9, rbx
lea r8, [0x18008890c]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18000c7f4
mov word [rdi + 0x1fffe], r12w
mov rdx, 0xfffffffffffffffe
mov rcx, rdi
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rdi
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.180054798
test eax, eax
je 0x18000c7ca
mov r8d, r15d
mov rdx, rdi
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
lea r9, str.MbaeLogProcessModules
mov edx, 0x47e
mov r8d, 3
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000c825
mov edx, r15d
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000c81f
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r14, r14
je 0x18000c832
mov rcx, r14
call fcn.180053a94
test rdi, rdi
je 0x18000c840
mov rcx, rdi
call fcn.180053a94
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.180053a94
mov qword [rsp + 0x38], r12
xor eax, eax
jmp 0x18000c902
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.180052be0
add rsp, 0x6d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret