Function at 0x18000c930
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x6d0
mov rax, qword [0x1800a2de8]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov qword [rsp + 0x50], rsp
mov r14d, ecx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x48], 0xffffffffffffffff
xor r15d, r15d
mov dword [rsp + 0x70], r15d
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x74]
call fcn.180056c20
nop
mov edx, r14d
lea ecx, [r15 + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x18000caea
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov qword [rsp + 0x60], r15
mov ecx, 0x1000a
call fcn.180053ad4
mov rdi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18000ca97
test rax, rax
je 0x18000ca97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov dword [rsp + 0x20], r14d
lea r8, str.Error_0x_X___Cannot_enumerate_loaded_modules_Pid:__d
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18000ca80
mov word [rbx + 0x1fffe], r15w
lea rdx, [r15 - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.180054798
test eax, eax
je 0x18000ca57
mov r8d, esi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, str.IsMbaeInjectedInProcess
mov edx, 0x4bf
mov r8d, 3
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000cab0
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000caaa
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18000cabd
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18000caca
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x68], r15d
lea rdx, [0x18000cae3]
mov rcx, qword [rsp + 0x50]
call fcn.180057580
nop
nop
nop
xor eax, eax
jmp 0x18000d077
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x18000cc64
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x18000cc64
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov qword [rsp + 0x40], r15
mov ecx, 0x1000a
call fcn.180053ad4
mov rdi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18000cc11
test rax, rax
je 0x18000cc11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov dword [rsp + 0x20], r14d
lea r8, str.Error_0x_X___Cannot_enumerate_the_first_loaded_modules_Pid:__d.
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18000cbfa
mov word [rbx + 0x1fffe], r15w
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180054798
test eax, eax
je 0x18000cbd1
mov r8d, esi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, str.IsMbaeInjectedInProcess
mov edx, 0x4cb
mov r8d, 3
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000cc2a
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000cc24
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18000cc37
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18000cc44
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x58], r15d
lea rdx, [0x18000cc5d]
mov rcx, qword [rsp + 0x50]
call fcn.180057580
nop
nop
nop
xor eax, eax
jmp 0x18000d077
lea r8, [rsp + 0x2a0]
mov edx, 0x104
lea rcx, [rsp + 0x4b0]
call fcn.180054b48
nop
lea rdx, str.mbae.dll
lea rcx, [rsp + 0xa0]
call fcn.180052ca8
test eax, eax
je 0x18000cdfa
lea rdx, str.mbae64.dll
lea rcx, [rsp + 0xa0]
call fcn.180052ca8
test eax, eax
je 0x18000cdfa
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x18000cc80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov qword [rsp + 0x40], r15
mov ecx, 0x1000a
call fcn.180053ad4
mov rdi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18000cdbc
test rax, rax
je 0x18000cdbc
mov r9d, r14d
lea r8, str.Process_not_injected:__d
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18000cda5
mov word [rbx + 0x1fffe], r15w
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180054798
test eax, eax
je 0x18000cd7c
mov r8d, esi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, str.IsMbaeInjectedInProcess
mov edx, 0x4e7
mov r8d, 3
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000cdd5
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000cdcf
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18000cde2
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18000cae3
mov rcx, rbx
call fcn.180053a94
xor eax, eax
jmp 0x18000d077
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov qword [rsp + 0x38], r15
mov ecx, 0x1000a
call fcn.180053ad4
mov rdi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x18000cefc
test rax, rax
je 0x18000cefc
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, str.Process_injected:__d____s____s
mov edx, 0xffff
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x18000cee5
mov word [rbx + 0x1fffe], r15w
mov rdx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.180054798
test eax, eax
je 0x18000cebc
mov r8d, esi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, str.IsMbaeInjectedInProcess
mov edx, 0x4d5
mov r8d, 3
lea rcx, str...ApiAuxNA.cpp
call fcn.180001b40
jmp 0x18000cf15
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x18000cf0f
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x18000cf22
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x18000cf2f
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x5c], 1
lea rdx, [0x18000cf4b]
mov rcx, qword [rsp + 0x50]
call fcn.180057580
nop
nop
nop
mov eax, 1
jmp 0x18000d077
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.180052be0
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret