Function at 0x180064730
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x878
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x182
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x898]
mov rax, qword [0x18010e1a8]
xor rax, rbp
mov qword [rbp + 0x830], rax
lea rcx, [0x1801210f9]
call fcn.180042508
cmp qword [rbp + 0x860], 0
jne 0x1800647c8
mov eax, dword [0x18010d04c]
inc eax
lea rcx, [0x1800d4878]
mov qword [rsp + 0x28], rcx
lea rcx, [0x1800cbf40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1800d4890]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll__CrtDbgReportW]
cmp eax, 1
jne 0x1800647c8
int3
cmp qword [rbp + 0x868], 0
jne 0x180064813
mov eax, dword [0x18010d04c]
add eax, 2
lea rcx, str.lpModuleName
mov qword [rsp + 0x28], rcx
lea rcx, [0x1800cbf40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1800d4890]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll__CrtDbgReportW]
cmp eax, 1
jne 0x180064813
int3
cmp qword [rbp + 0x860], 0
je 0x180064827
cmp qword [rbp + 0x868], 0
jne 0x18006482e
xor eax, eax
jmp 0x180064a54
mov rcx, qword [rbp + 0x860]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbp + 4], eax
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0xffffffffffffffff
lea rax, [rbp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x438
rep stosb byte [rdi], al
mov dword [rbp + 0x4c4], 0
jmp 0x180064878
mov eax, dword [rbp + 0x4c4]
inc eax
mov dword [rbp + 0x4c4], eax
cmp dword [rbp + 0x4c4], 0xa
jge 0x1800648fe
mov edx, dword [rbp + 4]
mov ecx, 0x18
call fcn.180041130
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x1800648f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x4e4], eax
mov eax, dword [0x18010d04c]
add eax, 0x1f
mov r8d, eax
lea rdx, str.D:code_rdp.allwow64extwow64extimport.h
lea rcx, [rbp + 0x7a8]
call fcn.180040d57
mov r9d, dword [rbp + 0x4e4]
mov r8d, dword [rbp + 4]
lea rdx, str.CreateToolhelp32Snapshot__u_____0x_08x_r_n
mov rcx, rax
call fcn.180040708
cmp dword [rbp + 0x4e4], 0x18
jne 0x1800648f7
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18006486a
jmp 0x1800648fe
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x18006493e
mov eax, dword [0x18010d04c]
add eax, 0x2f
mov r8d, eax
lea rdx, str.D:code_rdp.allwow64extwow64extimport.h
lea rcx, [rbp + 0x7d8]
call fcn.180040d57
mov r8d, dword [rbp + 4]
lea rdx, str.Couldnt_create_toolhelp_dump_of_modules_in_process__u_r_n
mov rcx, rax
call fcn.180040708
xor eax, eax
jmp 0x180064a54
mov dword [rbp + 0x70], 0x438
mov rcx, qword [rbp + 0x868]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x180064962
mov dword [rbp + 0x824], 1
jmp 0x18006496c
mov dword [rbp + 0x824], 0
mov eax, dword [rbp + 0x824]
mov dword [rbp + 0x504], eax
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
call fcn.1800416cb
test eax, eax
je 0x1800649f6
cmp dword [rbp + 0x504], 0
je 0x1800649a2
lea rax, [rbp + 0x2a0]
mov qword [rbp + 0x828], rax
jmp 0x1800649b0
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x828], rax
mov rax, qword [rbp + 0x828]
mov qword [rbp + 0x528], rax
mov rdx, qword [rbp + 0x868]
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1800649e3
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x28], rax
jmp 0x1800649f4
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
call fcn.180040532
test eax, eax
jne 0x180064989
jmp 0x180064a37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x544], eax
mov eax, dword [0x18010d04c]
add eax, 0x4c
mov r8d, eax
lea rdx, str.D:code_rdp.allwow64extwow64extimport.h
lea rcx, [rbp + 0x808]
call fcn.180040d57
mov r8d, dword [rbp + 0x544]
lea rdx, str.Module32First_failed._Error:__d_r_n
mov rcx, rax
call fcn.180040708
cmp qword [rbp + 0x48], 0
je 0x180064a50
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x48], 0
mov rax, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1800d3140]
call fcn.180041edc
mov rax, rdi
mov rcx, qword [rbp + 0x830]
xor rcx, rbp
call fcn.18004118a
lea rsp, [rbp + 0x848]
pop rdi
pop rbp
ret