Function at 0x402a20
Capabilities:
Enumerate process modules

Disassembly:
push rbp
sub rsp, 0x520
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x18], r8
mov rax, rdx
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rcx
mov rax, qword [rax]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x40]
call fcn.00402ea0
mov r8, qword [rbp - 0x18]
mov rax, qword [r8]
mov qword [rbp + 0x60], rax
mov rax, qword [r8 + 8]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x88], rax
mov rax, qword [0x0047fc68]
mov qword [rbp + 0x90], rax
mov rax, qword [0x0047fc70]
mov qword [rbp + 0x98], rax
mov rax, qword [0x0047fc78]
mov qword [rbp + 0xa0], rax
lea rcx, [rbp - 8]
lea rdx, [rbp + 0x60]
mov r8d, 0x48
call fcn.0047b930
mov ecx, 0x18
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 0x10], rax
mov qword [rbp + 0xa8], rax
mov rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x402bd7
jmp 0x402c3b
mov word [rbp + 0x498], 0
lea rcx, [rbp + 0x450]
lea rdx, [rbp - 8]
mov r8d, 0x48
call fcn.0047b930
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x450]
mov r8d, 0x50
call fcn.0047b930
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
lea rcx, [rbp + 0x108]
mov edx, 0xaa
mov r8d, 0x238
call fcn.0047bd70
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x108]
mov qword [rbp + 0x340], 0x4d430001
mov qword [rbp + 0x348], rax
mov qword [rbp + 0x350], 0x238
mov qword [rbp + 0x358], 0
mov qword [rbp + 0x360], 0
mov qword [rbp + 0x368], 0
lea rax, [rbp + 0x340]
xor edx, edx
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov dword [rbp + 0x108], 0x238
lea rdx, [rbp + 0x108]
call sub.KERNEL32.dll_Module32First
cmp eax, 0
je 0x402c49
jmp 0x402c8f
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x38]
mov dx, ax
mov word [rbp + 0xb6], dx
call fcn.00402ed0
mov rdx, qword [rbp - 0x18]
mov word [rbp - 0x3a], ax
lea rcx, [rbp - 8]
add rcx, 0x30
call fcn.004030c0
mov ax, word [rbp - 0x3a]
mov rcx, qword [rbp - 0x38]
mov word [rbp + 0x100], ax
call fcn.00402780
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0xb8]
mov r8d, 0x50
call fcn.0047b930
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
jmp 0x402b3b
mov byte [rbp + 0x377], 1
jmp 0x402c9f
mov rcx, qword [rbp - 0x10]
call fcn.00403180
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
add rcx, 0x30
call fcn.004030c0
mov rcx, qword [rbp - 0x38]
call fcn.00402780
mov rcx, qword [rbp - 0x30]
lea rdx, [0x0047fc80]
mov r8d, 0x50
call fcn.0047b930
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
jmp 0x402c40
mov rcx, qword [rbp - 0x10]
call fcn.00403180
jmp 0x402af9
test byte [rbp + 0x377], 1
jne 0x402cac
jmp 0x402cd4
jmp 0x402c9f
mov r9, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x38]
lea r8, [rbp - 8]
add r8, 0x30
lea rcx, [rbp + 0x378]
call fcn.004031b0
cmp word [rbp + 0x380], 0
jne 0x402cd8
jmp 0x402d34
jmp 0x402c91
jmp 0x402caa
mov rcx, qword [rbp - 0x10]
mov ax, word [rbp + 0x380]
mov word [rbp - 0x3c], ax
call fcn.00403180
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
add rcx, 0x30
call fcn.004030c0
mov ax, word [rbp - 0x3c]
mov rcx, qword [rbp - 0x38]
mov word [rbp + 0x3d0], ax
call fcn.00402780
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x388]
mov r8d, 0x50
call fcn.0047b930
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x378]
mov qword [rbp - 0x48], rcx
mov qword [rbp + 0x3d8], rcx
vmovdqu xmm0, xmmword [rax]
vmovdqa xmmword [rbp + 0x3e0], xmm0
vmovdqa xmm0, xmmword [rbp + 0x3e0]
vmovdqa xmmword [rbp + 0x3f0], xmm0
lea rcx, [rbp + 0x138]
call fcn.004032b0
mov rcx, rdx
mov rdx, qword [rbp - 0x38]
mov qword [rbp + 0x410], rcx
mov qword [rbp + 0x408], rax
mov r9, qword [rbp + 0x408]
mov rax, qword [rbp + 0x410]
lea rcx, [rbp + 0x418]
lea r8, [rbp + 0x3f0]
mov qword [rsp + 0x20], rax
call fcn.00403350
cmp word [rbp + 0x428], 0
je 0x402e3b
jmp 0x402e72
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov qword [rbp + 0x440], rax
mov qword [rbp + 0x448], rdx
mov r8, qword [rbp + 0x120]
mov qword [rcx], r8
mov r8d, dword [rbp + 0x128]
mov dword [rcx + 0x48], r8d
mov qword [rcx + 0x10], rdx
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x130]
mov qword [rcx + 0x18], rax
add rcx, 0x20
lea rdx, [0x0047fcd0]
mov r8d, 0x28
call fcn.0047b930
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0x108]
call sub.KERNEL32.dll_Module32Next
cmp eax, 1
sete al
and al, 1
mov byte [rbp + 0x377], al
jmp 0x402cd6
mov rax, qword [rbp + 0x418]
mov rcx, qword [rbp + 0x420]
mov qword [rbp + 0x438], rcx
mov qword [rbp + 0x430], rax
mov rcx, qword [rbp + 0x430]
mov rax, qword [rbp + 0x438]
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x58], rax
jmp 0x402dc0
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
mov qword [rax], rcx
mov ecx, 1
xor eax, eax
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x58], rax
jmp 0x402dc0