Function at 0x1800a3160
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x678]
sub rsp, 0x778
mov r13, rcx
xor r15d, r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov edi, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x70], r15
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x10], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0xc]
call fcn.1800c0800
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800a32ae
nop dword [rax]
mov r9, qword [rsp + 0x68]
cmp r9, rdi
je 0x1800a327e
mov rcx, r9
lea rax, [rbp - 0x10]
mov edx, 4
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800a3200
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
mov qword [rsp + 0x68], r9
jmp 0x1800a3294
lea r8, [rbp - 0x10]
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.1800a8700
mov rdi, qword [rsp + 0x70]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800a31e0
mov qword [rsp + 0x58], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
cmp rbx, rsi
je 0x1800a3470
mov r9, rbx
mov r8, rsi
sub r8, 0x238
cmp r9, r8
je 0x1800a3470
mov rax, r9
lea rcx, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800a32f0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r9
mov rax, r8
mov edx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800a3370
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r8
lea rax, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1800a33f0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
cmp r9, r8
jne 0x1800a32d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov dword [rbp + 0x6d0], eax
mov r14, rbx
mov qword [rbp + 0x6d8], rbx
cmp rbx, rsi
je 0x1800a3943
mov eax, dword [r14 + 8]
cmp eax, ecx
je 0x1800a3920
mov qword [rsp + 0x50], 0xffffffffffffffff
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x60], 0x30
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x60]
mov edx, 0x1fffff
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov rdi, qword [rsp + 0x50]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800a391a
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rsp + 0x78]
lea edx, [r9 + 0x12]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jne 0x1800a391a
cmp qword [rsp + 0x78], 0
je 0x1800a391a
mov edx, dword [r14 + 8]
lea ecx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1800a391a
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xor edi, edi
mov r12d, edi
mov qword [rbp - 0x70], rdi
mov dword [rbp + 0x230], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 0x234]
call fcn.1800c0800
xor r13b, r13b
lea rdx, [rbp + 0x230]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
mov r15, qword [rbp - 0x78]
test eax, eax
je 0x1800a3887
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x460]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800a35c0
lea rdx, [rbp + 0x460]
lea rcx, [rsp + 0x30]
call fcn.180008da0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.1800a16d0
nop
mov rdx, r15
cmp r15, r12
je 0x1800a368d
lea rax, [rbp + 0x230]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x1800a3610
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rcx, qword [rax + 0x30]
mov qword [rdx + 0x30], rcx
add r15, 0x438
mov qword [rbp - 0x78], r15
jmp 0x1800a36a5
lea r8, [rbp + 0x230]
lea rcx, [rbp - 0x80]
call fcn.1800a8990
mov r12, qword [rbp - 0x70]
mov r15, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
test r13b, r13b
jne 0x1800a3825
movups xmm0, xmmword [str._ERJ_n_b]
movups xmmword [rsp + 0x30], xmm0
mov ecx, dword [0x18015f590]
mov dword [rsp + 0x40], ecx
movzx eax, word [0x18015f594]
mov edx, 0x75
mov word [rsp + 0x30], dx
xor word [rsp + 0x32], 0x36
xor word [rsp + 0x34], 0x37
xor word [rsp + 0x36], 0x38
xor word [rsp + 0x38], 0x39
xor word [rsp + 0x3a], 0x3a
xor word [rsp + 0x3c], 0x3b
xor word [rsp + 0x3e], 0x3c
xor cx, 0x3d
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x3e
xor ax, 0x3f
mov word [rsp + 0x44], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800a3730
lea rcx, [rbp - 0x60]
cmp rdi, 8
setae r14b
cmovae rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call fcn.180015730
cmp rax, 0xffffffffffffffff
je 0x1800a381e
movups xmm0, xmmword [str.FODOVM_r_b]
movups xmmword [rsp + 0x30], xmm0
movzx eax, word [0x18015fac8]
mov ecx, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x30], cx
xor word [rsp + 0x32], 0x36
xor word [rsp + 0x34], 0x37
xor word [rsp + 0x36], 0x38
xor word [rsp + 0x38], 0x39
xor word [rsp + 0x3a], 0x3a
xor word [rsp + 0x3c], 0x3b
xor word [rsp + 0x3e], 0x3c
xor ax, 0x3d
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800a37d0
lea rcx, [rbp - 0x60]
test r14b, r14b
cmovne rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
call fcn.180015730
mov r14, qword [rbp + 0x6d8]
cmp rax, 0xffffffffffffffff
je 0x1800a3825
mov r13b, 1
mov rcx, qword [rbp + 0x6c8]
test rcx, rcx
je 0x1800a3825
mov eax, dword [r14 + 8]
mov dword [rcx], eax
jmp 0x1800a3825
mov r14, qword [rbp + 0x6d8]
cmp rdi, 8
jb 0x1800a3860
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800a3858
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a3a41
mov rcx, rbx
call fcn.1800bdc0c
lea rdx, [rbp + 0x230]
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
mov edi, 0
jne 0x1800a35a0
mov rsi, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbp - 0x80]
movabs r9, 0x795ceb240795ceb3
test r13b, r13b
je 0x1800a38c7
mov rcx, r15
sub rcx, r8
mov rax, r9
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 5
jae 0x1800a39c2
test r8, r8
je 0x1800a3917
sub r12, r8
mov rax, r9
imul r12
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x438
mov rax, r8
cmp rdx, 0x1000
jb 0x1800a390f
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a3a2f
mov rcx, r8
call fcn.1800bdc0c
xor r15d, r15d
mov ecx, dword [rbp + 0x6d0]
add r14, 0x238
mov qword [rbp + 0x6d8], r14
cmp r14, rsi
jne 0x1800a3491
mov rbx, qword [rsp + 0x60]
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r15
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r15
test rbx, rbx
je 0x1800a39ab
mov rdx, qword [rsp + 0x58]
sub rdx, rbx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800a39a3
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a3a3b
mov rcx, rbx
call fcn.1800bdc0c
mov rax, r13
add rsp, 0x778
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r8
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800a39ab
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a39a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a3a35
jmp 0x1800a39a6
call fcn.1800c9ad0
nop
call fcn.1800c9ad0
int3
call fcn.1800c9ad0
nop
call fcn.1800c9ad0
int3