Function at 0x1400025d0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400930c0]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rdx
mov qword [rbp + 8], rdx
mov rsi, rcx
mov qword [rbp + 0x38], rcx
xor r15d, r15d
mov dword [rbp + 0x14], r15d
lea r9, [rbp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140002ae6
mov ebx, dword [rbp + 0x58]
shr ebx, 3
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov qword [rbp + 0x90], r15
mov edx, ebx
test ebx, ebx
je 0x14000265a
lea rcx, [rbp + 0x80]
call fcn.14000af50
lea r8d, [rbx*8]
lea r9, [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140002bd4
mov eax, dword [rbp + 0x58]
shr eax, 3
cmp ebx, eax
cmovae ebx, eax
mov r14d, ebx
mov qword [rbp + 0x18], r14
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
mov dword [rbp + 0x14], 1
mov qword [rbp + 0x98], r14
test ebx, ebx
je 0x1400026c2
lea rdx, [rbp + 0x98]
mov rcx, rsi
call fcn.140009740
mov ebx, r15d
mov dword [rbp], ebx
test r14d, r14d
je 0x14000296f
mov r12, r15
nop dword [rax]
nop dword [rax + rax]
mov r9d, 0x104
lea r8, [rbp + 0x100]
mov rdx, qword [rbp + 0x80]
mov rdx, qword [rdx + r12]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x1400029e3
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r15
mov r8d, eax
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x60]
call fcn.140009b40
nop
mov r9d, Ordinal_26
lea r8, [rbp + 0x40]
mov rdx, qword [rbp + 0x80]
mov rdx, qword [rdx + r12]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002cce
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
lea r14, [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0xf
seta byte [rbp + 0x10]
mov r15, qword [rbp + 0x60]
cmova r14, r15
mov rdi, qword [rbp + 0x70]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140002cc8
cmp rdi, 0xf
ja 0x1400027c1
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0xc0], xmm0
jmp 0x140002865
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x1400027e0
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140002807
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002829
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002cc2
mov rcx, rax
call fcn.140072540
mov rcx, rax
test rax, rax
je 0x140002961
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002837
test rcx, rcx
je 0x140002835
call fcn.140072540
jmp 0x140002837
xor eax, eax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp + 0xc0]
mov ebx, dword [rbp]
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0xe0], rcx
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x1400028aa
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [rdx + 0x10], xmm0
mov qword [rbp + 0xd0], 0
mov eax, reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov qword [rdx + 0x20], rcx
add qword [rsi + 8], 0x28
jmp 0x1400028c0
lea r8, [rbp + 0xc0]
mov rcx, rsi
call fcn.14000b0b0
mov rax, qword [rbp + 0xd8]
cmp rax, 0xf
jbe 0x1400028f7
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002961
call fcn.140072894
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
cmp byte [rbp + 0x10], 0
je 0x140002947
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000293f
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002968
mov rcx, r15
call fcn.140072894
inc ebx
mov dword [rbp], ebx
add r12, 8
cmp ebx, dword [rbp + 0x18]
jae 0x14000296f
mov rdi, qword [rbp + 8]
xor r15d, r15d
jmp 0x1400026e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x1400029b6
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072894
mov rax, rsi
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140072520
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0x61d95faaed0b5082
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa0], rcx
movabs rax, 0x2a26a851061f7eb3
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa8], rcx
movabs rax, 0xbd1f4eab20f6478a
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xb0], rcx
movabs rcx, 0x310dc12a92eff018
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0xdac3bc5a07f35c5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x4747e634757e3cd6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0xbd1f4eab20f647ef
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
vzeroupper
call fcn.140001f80
lea rdx, [0x14008ef18]
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0x6ec34995cd0a5b80
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
movabs rax, 0x2b32825b380d4fb3
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
movabs rax, 0xbd1f4eab20f6348a
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
movabs rcx, 0x310dc12a92eff018
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xdac3bc5a07f35c5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x4747e634757e3cd6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xbd1f4eab20f647ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140001f80
lea rdx, [0x14008ef18]
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0x6ec34995cd0a5b80
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
movabs rax, 0x2b32825b380d4fb3
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
movabs rax, 0xbd1f4eab20f6348a
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
movabs rcx, 0x310dc12a92eff018
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xdac3bc5a07f35c5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x4747e634757e3cd6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xbd1f4eab20f647ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140001f80
lea rdx, [0x14008ef18]
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.1400019f0
int3
call fcn.140001aa0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0x61d95faaed0b5082
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa0], rcx
movabs rax, 0x262a945b131075b3
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa8], rcx
movabs rax, 0xbd1f4eab4e992e9b
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xb0], rcx
movabs rcx, 0x310dc12a92eff018
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0xdac3bc5a07f35c5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x4747e634757e3cd6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0xbd1f4eab20f647ef
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
vzeroupper
call fcn.140001f80
lea rdx, [0x14008ef18]
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3