Function at 0x18009ec00
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x678]
sub rsp, 0x778
mov r13, rcx
xor r15d, r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov edi, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x70], r15
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x10], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0xc]
call fcn.1800bc4e0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18009ed4e
nop dword [rax]
mov r9, qword [rsp + 0x68]
cmp r9, rdi
je 0x18009ed1e
mov rcx, r9
lea rax, [rbp - 0x10]
mov edx, 4
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18009eca0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
mov qword [rsp + 0x68], r9
jmp 0x18009ed34
lea r8, [rbp - 0x10]
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.1800a41a0
mov rdi, qword [rsp + 0x70]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18009ec80
mov qword [rsp + 0x58], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
cmp rbx, rsi
je 0x18009ef10
mov r9, rbx
mov r8, rsi
sub r8, 0x238
cmp r9, r8
je 0x18009ef10
mov rax, r9
lea rcx, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18009ed90
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r9
mov rax, r8
mov edx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18009ee10
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r8
lea rax, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18009ee90
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
cmp r9, r8
jne 0x18009ed70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov dword [rbp + 0x6d0], eax
mov r14, rbx
mov qword [rbp + 0x6d8], rbx
cmp rbx, rsi
je 0x18009f3e3
mov eax, dword [r14 + 8]
cmp eax, ecx
je 0x18009f3c0
mov qword [rsp + 0x50], 0xffffffffffffffff
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x60], 0x30
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x60]
mov edx, 0x1fffff
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov rdi, qword [rsp + 0x50]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18009f3ba
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rsp + 0x78]
lea edx, [r9 + 0x12]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jne 0x18009f3ba
cmp qword [rsp + 0x78], 0
je 0x18009f3ba
mov edx, dword [r14 + 8]
lea ecx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x18009f3ba
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xor edi, edi
mov r12d, edi
mov qword [rbp - 0x70], rdi
mov dword [rbp + 0x230], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 0x234]
call fcn.1800bc4e0
xor r13b, r13b
lea rdx, [rbp + 0x230]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
mov r15, qword [rbp - 0x78]
test eax, eax
je 0x18009f327
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x460]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18009f060
lea rdx, [rbp + 0x460]
lea rcx, [rsp + 0x30]
call fcn.180006af0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.18009d170
nop
mov rdx, r15
cmp r15, r12
je 0x18009f12d
lea rax, [rbp + 0x230]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x18009f0b0
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rcx, qword [rax + 0x30]
mov qword [rdx + 0x30], rcx
add r15, 0x438
mov qword [rbp - 0x78], r15
jmp 0x18009f145
lea r8, [rbp + 0x230]
lea rcx, [rbp - 0x80]
call fcn.1800a4430
mov r12, qword [rbp - 0x70]
mov r15, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
test r13b, r13b
jne 0x18009f2c5
movups xmm0, xmmword [str.AFSE_v_v]
movups xmmword [rsp + 0x30], xmm0
mov ecx, dword [0x18015b560]
mov dword [rsp + 0x40], ecx
movzx eax, word [0x18015b564]
mov edx, 0x75
mov word [rsp + 0x30], dx
xor word [rsp + 0x32], 0x35
xor word [rsp + 0x34], 0x36
xor word [rsp + 0x36], 0x37
xor word [rsp + 0x38], 0x38
xor word [rsp + 0x3a], 0x39
xor word [rsp + 0x3c], 0x3a
xor word [rsp + 0x3e], 0x3b
xor cx, 0x3c
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x3d
xor ax, 0x3e
mov word [rsp + 0x44], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18009f1d0
lea rcx, [rbp - 0x60]
cmp rdi, 8
setae r14b
cmovae rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call fcn.180013290
cmp rax, 0xffffffffffffffff
je 0x18009f2be
movups xmm0, xmmword [str.GLE_WN_f]
movups xmmword [rsp + 0x30], xmm0
movzx eax, word [0x18015b380]
mov ecx, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x30], cx
xor word [rsp + 0x32], 0x35
xor word [rsp + 0x34], 0x36
xor word [rsp + 0x36], 0x37
xor word [rsp + 0x38], 0x38
xor word [rsp + 0x3a], 0x39
xor word [rsp + 0x3c], 0x3a
xor word [rsp + 0x3e], 0x3b
xor ax, 0x3c
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18009f270
lea rcx, [rbp - 0x60]
test r14b, r14b
cmovne rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
call fcn.180013290
mov r14, qword [rbp + 0x6d8]
cmp rax, 0xffffffffffffffff
je 0x18009f2c5
mov r13b, 1
mov rcx, qword [rbp + 0x6c8]
test rcx, rcx
je 0x18009f2c5
mov eax, dword [r14 + 8]
mov dword [rcx], eax
jmp 0x18009f2c5
mov r14, qword [rbp + 0x6d8]
cmp rdi, 8
jb 0x18009f300
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18009f2f8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f4e1
mov rcx, rbx
call fcn.1800b98ec
lea rdx, [rbp + 0x230]
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
mov edi, 0
jne 0x18009f040
mov rsi, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbp - 0x80]
movabs r9, 0x795ceb240795ceb3
test r13b, r13b
je 0x18009f367
mov rcx, r15
sub rcx, r8
mov rax, r9
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 5
jae 0x18009f462
test r8, r8
je 0x18009f3b7
sub r12, r8
mov rax, r9
imul r12
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x438
mov rax, r8
cmp rdx, 0x1000
jb 0x18009f3af
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f4cf
mov rcx, r8
call fcn.1800b98ec
xor r15d, r15d
mov ecx, dword [rbp + 0x6d0]
add r14, 0x238
mov qword [rbp + 0x6d8], r14
cmp r14, rsi
jne 0x18009ef31
mov rbx, qword [rsp + 0x60]
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r15
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r15
test rbx, rbx
je 0x18009f44b
mov rdx, qword [rsp + 0x58]
sub rdx, rbx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rbx
cmp rdx, 0x1000
jb 0x18009f443
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f4db
mov rcx, rbx
call fcn.1800b98ec
mov rax, r13
add rsp, 0x778
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r8
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18009f44b
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009f446
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009f4d5
jmp 0x18009f446
call fcn.1800c5784
nop
call fcn.1800c5784
int3
call fcn.1800c5784
nop
call fcn.1800c5784
int3