Function at 0x18002cfe0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1400]
mov eax, 0x1500
call fcn.18004b100
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1530], rbx
mov qword [rsp + 0x1540], rsi
mov qword [rsp + 0x1548], rdi
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x13f0], rax
mov rdi, rdx
xor r12d, r12d
mov dword [rsp + 0x60], r12d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov ebx, r12d
mov qword [rbp - 0x78], rbx
lea r8, [rsp + 0x70]
mov edx, 0x1000
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x18002d074
mov qword [rdi], r12
mov qword [rdi + 8], r12
mov qword [rdi + 0x10], r12
jmp 0x18002d42a
mov r15d, dword [rsp + 0x70]
shr r15d, 2
mov esi, r12d
test r15d, r15d
je 0x18002d416
lea r14, [rbp - 0x30]
movabs r13, 0x7fffffffffffffff
nop word [rax + rax]
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18002d396
mov r9d, 0x104
lea r8, [rbp + 0xfd0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x18002d38d
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x60], r12
mov byte [rbp - 0x70], 0
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x40], r12
mov byte [rbp - 0x50], 0
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
cmp word [rbp + 0xfd0], 0
jne 0x18002d11f
mov r8, r12
jmp 0x18002d13b
lea rax, [rbp + 0xfd0]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18002d130
lea rdx, [rbp + 0xfd0]
lea rcx, [rsp + 0x20]
call fcn.180005ff0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180033090
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1800091e0
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x18002d1b8
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, 0x1000
jb 0x18002d1b3
test cl, 0x1f
jne 0x18002d3b8
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002d3b2
sub rcx, rax
cmp rcx, 8
jb 0x18002d3ac
cmp rcx, 0x27
ja 0x18002d3a6
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x40], 0
mov rax, qword [rsp + 0x38]
cmp rax, 8
jb 0x18002d227
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, r13
ja 0x18002d3d6
add rax, rax
cmp rax, 0x1000
jb 0x18002d222
test cl, 0x1f
jne 0x18002d3d0
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002d3ca
sub rcx, rax
cmp rcx, 8
jb 0x18002d3c4
cmp rcx, 0x27
ja 0x18002d3be
mov rcx, rax
call fcn.180033ed0
mov r9d, 0x104
lea r8, [rbp + 0x11e0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x18002d36c
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
cmp word [rbp + 0x11e0], 0
jne 0x18002d26a
mov r8, r12
jmp 0x18002d280
lea rax, [rbp + 0x11e0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18002d275
lea rdx, [rbp + 0x11e0]
lea rcx, [rsp + 0x20]
call fcn.180005ff0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180033090
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1800091e0
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x18002d2fd
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, 0x1000
jb 0x18002d2f8
test cl, 0x1f
jne 0x18002d3ee
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002d3e8
sub rcx, rax
cmp rcx, 8
jb 0x18002d3e2
cmp rcx, 0x27
ja 0x18002d3dc
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x40], 0
mov rax, qword [rsp + 0x38]
cmp rax, 8
jb 0x18002d36c
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, r13
ja 0x18002d40c
add rax, rax
cmp rax, 0x1000
jb 0x18002d367
test cl, 0x1f
jne 0x18002d406
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002d400
sub rcx, rax
cmp rcx, 8
jb 0x18002d3fa
cmp rcx, 0x27
ja 0x18002d3f4
mov rcx, rax
call fcn.180033ed0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x78]
call fcn.18002d460
nop
lea rcx, [rbp - 0x50]
call fcn.180001e50
lea rcx, [rbp - 0x70]
call fcn.180001e50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
add r14, 4
cmp esi, r15d
jae 0x18002d412
jmp 0x18002d0a0
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
mov rbx, qword [rbp - 0x78]
mov rax, qword [rsp + 0x78]
mov qword [rdi], rax
mov rax, qword [rbp - 0x80]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rbx
mov rax, rdi
mov rcx, qword [rbp + 0x13f0]
xor rcx, rsp
call fcn.180033e70
lea r11, [rsp + 0x1500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret