Function at 0x4152c0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
sub rsp, 0x550
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], r8
mov rax, rdx
mov rdx, qword [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rcx
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
lea rcx, [rbp + 0x50]
call fcn.00415720
mov r8, qword [rbp - 0x10]
mov rax, qword [r8]
mov qword [rbp + 0x78], rax
mov rax, qword [r8 + 8]
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x78]
add rcx, 0x10
lea rdx, [rbp + 0x50]
mov r8d, 0x28
call fcn.004adbd0
mov rax, qword [0x004b2f60]
mov qword [rbp + 0xb0], rax
mov rax, qword [0x004b2f68]
mov qword [rbp + 0xb8], rax
mov rax, qword [0x004b2f70]
mov qword [rbp + 0xc0], rax
mov rcx, rbp
lea rdx, [rbp + 0x78]
mov r8d, 0x50
call fcn.004adbd0
mov ecx, 0x18
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 8], rax
mov qword [rbp + 0xc8], rax
mov rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x415469
jmp 0x4154cc
mov word [rbp + 0x4c8], 0
lea rcx, [rbp + 0x478]
mov rdx, rbp
mov r8d, 0x50
call fcn.004adbd0
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0x478]
mov r8d, 0x58
call fcn.004adbd0
mov rax, qword [rbp - 0x20]
add rsp, 0x550
pop rbp
ret
lea rcx, [rbp + 0x130]
mov edx, 0xaa
mov r8d, 0x238
call fcn.004adff0
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x130]
mov qword [rbp + 0x368], 0x4d430001
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x378], 0x238
mov qword [rbp + 0x380], 0
mov qword [rbp + 0x388], 0
mov qword [rbp + 0x390], 0
lea rax, [rbp + 0x368]
xor edx, edx
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov dword [rbp + 0x130], 0x238
lea rdx, [rbp + 0x130]
call sub.KERNEL32.dll_Module32First
cmp eax, 0
je 0x4154da
jmp 0x41551f
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x30]
mov dx, ax
mov word [rbp + 0xd6], dx
call fcn.00415760
mov rdx, qword [rbp - 0x10]
mov word [rbp - 0x32], ax
mov rcx, rbp
add rcx, 0x38
call fcn.00415950
mov ax, word [rbp - 0x32]
mov rcx, qword [rbp - 0x30]
mov word [rbp + 0x128], ax
call fcn.00402580
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0xd8]
mov r8d, 0x58
call fcn.004adbd0
mov rax, qword [rbp - 0x20]
add rsp, 0x550
pop rbp
ret
jmp 0x4153cd
mov byte [rbp + 0x39f], 1
jmp 0x41552f
mov rcx, qword [rbp - 8]
call fcn.0040e830
mov rdx, qword [rbp - 0x10]
mov rcx, rbp
add rcx, 0x38
call fcn.00415950
mov rcx, qword [rbp - 0x30]
call fcn.00402580
mov rcx, qword [rbp - 0x28]
lea rdx, [0x004b2f78]
mov r8d, 0x58
call fcn.004adbd0
mov rax, qword [rbp - 0x20]
add rsp, 0x550
pop rbp
ret
jmp 0x4154d1
mov rcx, qword [rbp - 8]
call fcn.0040e830
jmp 0x41538c
test byte [rbp + 0x39f], 1
jne 0x41553c
jmp 0x415563
jmp 0x41552f
mov r9, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x30]
mov r8, rbp
add r8, 0x38
lea rcx, [rbp + 0x3a0]
call fcn.00415a10
cmp word [rbp + 0x3a8], 0
jne 0x415567
jmp 0x4155c2
jmp 0x415521
jmp 0x41553a
mov rcx, qword [rbp - 8]
mov ax, word [rbp + 0x3a8]
mov word [rbp - 0x34], ax
call fcn.0040e830
mov rdx, qword [rbp - 0x10]
mov rcx, rbp
add rcx, 0x38
call fcn.00415950
mov ax, word [rbp - 0x34]
mov rcx, qword [rbp - 0x30]
mov word [rbp + 0x400], ax
call fcn.00402580
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0x3b0]
mov r8d, 0x58
call fcn.004adbd0
mov rax, qword [rbp - 0x20]
add rsp, 0x550
pop rbp
ret
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x3a0]
mov qword [rbp - 0x40], rcx
mov qword [rbp + 0x408], rcx
vmovdqu xmm0, xmmword [rax]
vmovdqa xmmword [rbp + 0x410], xmm0
vmovdqa xmm0, xmmword [rbp + 0x410]
vmovdqa xmmword [rbp + 0x420], xmm0
lea rcx, [rbp + 0x160]
call fcn.00415b10
mov rcx, rdx
mov rdx, qword [rbp - 0x30]
mov qword [rbp + 0x438], rcx
mov qword [rbp + 0x430], rax
mov r9, qword [rbp + 0x430]
mov rax, qword [rbp + 0x438]
lea rcx, [rbp + 0x440]
lea r8, [rbp + 0x420]
mov qword [rsp + 0x20], rax
call fcn.00403f00
cmp word [rbp + 0x450], 0
je 0x4156c9
jmp 0x415700
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
mov qword [rbp + 0x468], rax
mov qword [rbp + 0x470], rdx
mov r8, qword [rbp + 0x148]
mov qword [rcx], r8
mov r8d, dword [rbp + 0x150]
mov dword [rcx + 0x48], r8d
mov qword [rcx + 0x10], rdx
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x158]
mov qword [rcx + 0x18], rax
add rcx, 0x20
lea rdx, [0x004b2fd0]
mov r8d, 0x28
call fcn.004adbd0
mov rcx, qword [rbp - 8]
lea rdx, [rbp + 0x130]
call sub.KERNEL32.dll_Module32Next
cmp eax, 1
sete al
and al, 1
mov byte [rbp + 0x39f], al
jmp 0x415565
mov rax, qword [rbp + 0x440]
mov rcx, qword [rbp + 0x448]
mov qword [rbp + 0x460], rcx
mov qword [rbp + 0x458], rax
mov rcx, qword [rbp + 0x458]
mov rax, qword [rbp + 0x460]
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x50], rax
jmp 0x41564e
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x18]
mov qword [rax], rcx
mov ecx, 1
xor eax, eax
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x50], rax
jmp 0x41564e