Function at 0x180063690
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x878
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x182
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x898]
mov rax, qword [0x1801091a8]
xor rax, rbp
mov qword [rbp + 0x830], rax
lea rcx, [0x18011c0f9]
call fcn.1800414cc
cmp qword [rbp + 0x860], 0
jne 0x180063728
mov eax, dword [0x18010804c]
inc eax
lea rcx, [0x1800d1878]
mov qword [rsp + 0x28], rcx
lea rcx, [0x1800c8f40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1800d1890]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll__CrtDbgReportW]
cmp eax, 1
jne 0x180063728
int3
cmp qword [rbp + 0x868], 0
jne 0x180063773
mov eax, dword [0x18010804c]
add eax, 2
lea rcx, str.lpModuleName
mov qword [rsp + 0x28], rcx
lea rcx, [0x1800c8f40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1800d1890]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll__CrtDbgReportW]
cmp eax, 1
jne 0x180063773
int3
cmp qword [rbp + 0x860], 0
je 0x180063787
cmp qword [rbp + 0x868], 0
jne 0x18006378e
xor eax, eax
jmp 0x1800639b4
mov rcx, qword [rbp + 0x860]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbp + 4], eax
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0xffffffffffffffff
lea rax, [rbp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x438
rep stosb byte [rdi], al
mov dword [rbp + 0x4c4], 0
jmp 0x1800637d8
mov eax, dword [rbp + 0x4c4]
inc eax
mov dword [rbp + 0x4c4], eax
cmp dword [rbp + 0x4c4], 0xa
jge 0x18006385e
mov edx, dword [rbp + 4]
mov ecx, 0x18
call fcn.180040112
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x180063857
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x4e4], eax
mov eax, dword [0x18010804c]
add eax, 0x1f
mov r8d, eax
lea rdx, str.D:code_rdp.allwow64extwow64extimport.h
lea rcx, [rbp + 0x7a8]
call fcn.18003fd4d
mov r9d, dword [rbp + 0x4e4]
mov r8d, dword [rbp + 4]
lea rdx, [0x1800d1950]
mov rcx, rax
call fcn.18003f708
cmp dword [rbp + 0x4e4], 0x18
jne 0x180063857
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800637ca
jmp 0x18006385e
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x18006389e
mov eax, dword [0x18010804c]
add eax, 0x2f
mov r8d, eax
lea rdx, str.D:code_rdp.allwow64extwow64extimport.h
lea rcx, [rbp + 0x7d8]
call fcn.18003fd4d
mov r8d, dword [rbp + 4]
lea rdx, [0x1800d19c0]
mov rcx, rax
call fcn.18003f708
xor eax, eax
jmp 0x1800639b4
mov dword [rbp + 0x70], 0x438
mov rcx, qword [rbp + 0x868]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x1800638c2
mov dword [rbp + 0x824], 1
jmp 0x1800638cc
mov dword [rbp + 0x824], 0
mov eax, dword [rbp + 0x824]
mov dword [rbp + 0x504], eax
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
call fcn.1800406a3
test eax, eax
je 0x180063956
cmp dword [rbp + 0x504], 0
je 0x180063902
lea rax, [rbp + 0x2a0]
mov qword [rbp + 0x828], rax
jmp 0x180063910
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x828], rax
mov rax, qword [rbp + 0x828]
mov qword [rbp + 0x528], rax
mov rdx, qword [rbp + 0x868]
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x180063943
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x28], rax
jmp 0x180063954
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
call fcn.18003f532
test eax, eax
jne 0x1800638e9
jmp 0x180063997
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x544], eax
mov eax, dword [0x18010804c]
add eax, 0x4c
mov r8d, eax
lea rdx, str.D:code_rdp.allwow64extwow64extimport.h
lea rcx, [rbp + 0x808]
call fcn.18003fd4d
mov r8d, dword [rbp + 0x544]
lea rdx, str.Module32First_failed._Error:__d_r_n
mov rcx, rax
call fcn.18003f708
cmp qword [rbp + 0x48], 0
je 0x1800639b0
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x48], 0
mov rax, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1800d0140]
call fcn.180040eaa
mov rax, rdi
mov rcx, qword [rbp + 0x830]
xor rcx, rbp
call fcn.18004016c
lea rsp, [rbp + 0x848]
pop rdi
pop rbp
ret