Function at 0x14008ade0
Capabilities:
Enumerate process modules

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
jmp 0x14008b12b
lea rdx, [rbp - 0x40]
mov dword [rsp - 0x10], ebx
lea rcx, [rsp + 0x48]
call fcn.140018fe0
jmp 0x14008ae07
nop
mov dword [rsp - 0x18], esp
lea rdi, [rsp + 0x48]
mov r15, qword [rsp + 0x48]
xchg r13, rcx
mov rcx, qword [rsp + 0x60]
xchg rcx, r13
jmp 0x14008ae26
cmp r13, 0x10
cmovae rdi, r15
lea rcx, [rsp + 0x48]
jmp 0x14008af22
xchg r14, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14008ae3b
jmp 0x14008adf0
mov dword [rsp - 0x44], edi
xchg r10, r12
movups xmm0, xmmword [r10]
xchg r10, r12
xchg rsp, r14
movups xmmword [r14 + 0x68], xmm0
jmp 0x14008afa3
xor ecx, 0x46cf19b7
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp - 0x10], ecx
xchg rbx, rax
jmp 0x14008b118
xchg r14, rax
mov qword [rbp + 0x1d0], r14
xchg r14, rax
mov r12, r8
jmp 0x14008b080
cmovae rbx, r15
xchg rcx, rcx
cmp rbx, rsi
je 0x14008b044
sub rdi, rbx
jmp 0x14008afc8
xchg rbp, rdi
xchg r10, rdi
mov qword [rsp + 0x58], r10
xchg rdi, r10
mov qword [rsp + 0x60], 0x7acb5bf3
sub qword [rsp + 0x60], 0x53209eca
sub qword [rsp + 0x60], 0x759464c
jmp 0x14008b0b9
mov qword [rsp + 0x28], rax
cmp rsi, rax
je 0x14008b580
nop word [rax + rax]
mov dword [rsp - 0x34], ecx
mov qword [rbp - 0x80], 0x1a759592
add qword [rbp - 0x80], 0x3ae57bf9
jmp 0x14008af76
sub qword [rsp + 0x60], 0x406ee891
mov byte [rsp + 0x48], 0x3d
add byte [rsp + 0x48], 0x11
add byte [rsp + 0x48], 0x1b
jmp 0x14008b152
mov r9, r9
cmovae rcx, r15
mov rsi, qword [rsp + 0x58]
add rsi, rcx
mov r12, r12
lea rbx, [rsp + 0x48]
cmp r13, 0x10
jmp 0x14008ae92
mov byte [rbx + rdi], al
inc rbx
mov dword [rsp - 0x2c], 0x4dbde3e7
jmp 0x14008b240
cmp qword [rsi + 0x18], 0x10
mov dword [rsp - 0x18], ecx
jb 0x14008af67
mov r12, qword [rsi]
cmp r14, 0x10
jae 0x14008b2a3
jmp 0x14008ae4e
add qword [rbp - 0x80], 0x1d28e98b
add qword [rbp - 0x80], 0x3188a1
sub qword [rbp - 0x80], 0x2dfceb74
add qword [rbp - 0x80], 0x382130af
xor qword [rbp - 0x80], 0x247bdccc
jmp 0x14008b173
xchg rsp, r14
mov edi, 0x511ea9e6
sub edi, 0x25cb4e5f
sub edi, 0x1a1beb1e
add edi, 0x30afc4b9
sub edi, 0x23a1a28b
jmp 0x14008b04c
movsx ecx, byte [rbx]
mov r15, r15
call fcn.1400af3a0
jmp 0x14008af42
movabs r8, 0xffffffff605525cb
add r8, 0x1208f97a
sub r8, 0x6e4b6487
xor r8, 0x4879f1d0
jmp 0x14008b226
xor ecx, 0x158955c
xor ecx, 0x247ee0d
add ecx, 0xee380c4
xor ecx, 0x10027530
jmp 0x14008ae69
xor r8, 0x4aac9e54
add r8, 0x7fffffff
add r8, 0x4984bc70
nop word [rax + rax]
jmp 0x14008ae38
mov r10, qword [rsp + 0x48]
xchg r15, r10
xchg rsi, r11
jmp 0x14008b0a0
xor edi, 0x57037e37
xor edi, 0xc2e0e7c
xor edi, 0x29c1953a
sub edi, 0x6ca977d7
jmp 0x14008b1f8
push r12
mov dword [rsp - 0x30], 0x7441561f
push r13
nop
mov qword [rsp - 8], r14
jmp 0x14008b25c
xchg rdx, r8
mov qword [rsp + 0x30], rdx
xchg r8, rdx
mov qword [rsp + 0x40], r8
mov ecx, 0x491ed97d
sub ecx, 0x42848e3
jmp 0x14008affc
mov r11, qword [r12]
xchg r11, rsi
mov rax, qword [r12 + 8]
mov dword [rsp - 0x38], 0x56df35f7
jmp 0x14008aed8
sub qword [rsp + 0x60], 0x1850b952
add qword [rsp + 0x60], 0x4add79b
xor qword [rsp + 0x60], 0x7e864860
sub qword [rsp + 0x60], 0x1de36352
xor qword [rsp + 0x60], 0x142b9154
jmp 0x14008af05
add r8d, 0x2ca66527
sub r8d, 0x9681aa7
xor r8d, 0x25c63f52
xor r8d, 0x57d4d417
lea rcx, [rbp - 0x6c]
mov dword [rsp - 0x18], 0x35a7338e
jmp 0x14008b207
mov rax, rbx
xchg rbx, rax
xchg r11, rax
mov qword [rsp + 0x38], r11
xchg r11, rax
jmp 0x14008b198
push rbp
nop
push 0x55c9a0b5
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
jmp 0x14008b069
xor edi, edi
mov dword [rsp - 0x30], esi
mov r14d, edi
jmp 0x14008b288
sub byte [rsp + 0x48], 0x36
xor byte [rsp + 0x48], 0x50
xor byte [rsp + 0x48], 0x65
xor byte [rsp + 0x48], 6
lea rax, [rbp - 0x40]
mov r11, r11
nop
jmp 0x14008afd8
sub qword [rbp - 0x80], 0x430c212d
xor qword [rbp - 0x80], 0x1595f311
mov r14, qword [rsi + 0x10]
xchg r8, r8
xchg r11, rsi
mov r12, r11
xchg r11, rsi
jmp 0x14008af55
xor edx, edx
mov r8d, 0x6873f0f9
sub r8d, 0x4be142d
xor r8d, 0x2d61423d
jmp 0x14008b0eb
test eax, eax
mov dword [rsp - 0x30], 0x19a2a40f
je 0x14008b5cc
xchg rdi, rbp
mov qword [rsp + 0x48], rbp
jmp 0x14008aeaa
add dword [rbp - 0x70], 0x192aea3b
xor dword [rbp - 0x70], 0x1b2dc814
xor dword [rbp - 0x70], 0x2121b987
xor dword [rbp - 0x70], 0x115d489
sub dword [rbp - 0x70], 0xe65b419
jmp 0x14008b144
lea rdx, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
jmp 0x14008b3d9
call fcn.1400e50d0
mov dword [rbp - 0x70], 0x230d1d10
sub dword [rbp - 0x70], 0x20631a48
add dword [rbp - 0x70], 0x19a72648
jmp 0x14008b1d0
add r8, 0x50f0f4d
add r8, 0x20c9be6b
xor r8, 0xe93c4e2
jmp 0x14008b019
cmp rbx, rsi
jne 0x14008afc8
xchg r13, rdi
mov rdi, qword [rsp + 0x60]
xchg r13, rdi
xchg r15, r10
jmp 0x14008b03c
sub rsp, 8
push r15
lea rbp, [rsp - 0x1e0]
mov dword [rsp - 0x40], 0x3dbac357
add rsp, 0xfffffffffffffd20
mov rax, qword [0x14024e2e0]
xor rax, rsp
jmp 0x14008ae7f
mov dword [rsp + 0x20], edi
lea rdx, [rbp - 0x70]
xchg rdx, rbx
mov rcx, rdx
xchg rbx, rdx
call sub.KERNEL32.dll_Module32First
jmp 0x14008b1b3
xchg r8, r14
mov rdi, r8
xchg r14, r8
or rdi, 0xf
mov r14, r14
movabs rax, 0x7fffffff6ce709de
jmp 0x14008b320
je 0x14008b67b
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
xchg r13, r13
mov qword [rbx - 8], rax
jmp 0x14008b388
lea rax, [rcx + 0x27]
mov rbp, rbp
cmp rax, rcx
jbe 0x14008b675
jmp 0x14008b2f1
xchg r12, rax
mov rcx, r12
xchg r12, rax
call fcn.1400e282c
xchg r8, r8
test rax, rax
jmp 0x14008b2c2
add rax, 0x7fffffff
xor rax, 0x7269cca5
cmp rdi, rax
cmova rdi, rax
jmp 0x14008b349
xor rax, 0xc00d3df
sub rax, 0x5831d2c8
xor rax, 0x49de7ac
add rax, 0x10aab93e
xor rax, 0x258e6271
sub rax, 0x2bc2c847
jmp 0x14008b308
mov rsp, rsp
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14008b362
jmp 0x14008b2dc
test rcx, rcx
je 0x14008b386
mov rdx, rdx
call fcn.1400e282c
jmp 0x14008b378
xchg rbx, r9
mov r9, rax
xchg r9, rbx
jmp 0x14008b388
xor ebx, ebx
xchg r15, rbx
mov qword [rsp + 0x68], r15
xchg r15, rbx
jmp 0x14008b44e
add cl, 0x1a
xor cl, 0x5d
sub cl, 0x20
jmp 0x14008b468
mov dword [rsp - 0x14], edx
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x48]
cmp r13, 0x10
mov dword [rsp - 0x2c], 0x2a55ce86
cmovae rcx, r15
jmp 0x14008b40a
mov r13, qword [rsp + 0x60]
xchg r10, r15
mov r10, qword [rsp + 0x48]
xchg r15, r10
mov qword [rbp - 0x80], rdi
jmp 0x14008b3a6
cmp rdi, 0x10
cmovae rdx, rbx
mov r9, r9
jmp 0x14008b3c9
mov rbx, rcx
xchg rbx, rcx
call fcn.1400e4a20
mov r9, r9
lea rdx, [rsp + 0x68]
jmp 0x14008b3e2
xchg rdx, r8
mov rdx, qword [rsp + 0x58]
xchg r8, rdx
cmp r8, r14
jne 0x14008b466
jmp 0x14008b431
sub cl, 0x6a
add cl, 0xa
xor cl, 0x74
jmp 0x14008b398
mov rbp, rbp
call fcn.1400e5620
test eax, eax
jne 0x14008b466
mov cl, 0x75
xor cl, 0xf
sub cl, 4
jmp 0x14008b423
lea r8, [r14 + 1]
mov r9, r9
xchg r12, rdx
mov r12, rdx
xchg rdx, r12
xchg rcx, rbx
jmp 0x14008b3f2
xor cl, cl
mov r14d, dword [rsp + 0x20]
mov dword [rsp - 0x18], 0x27bd4010
lea eax, [r14 + 1]
test cl, cl
cmove eax, r14d
jmp 0x14008b518
mov rax, r15
cmp rdx, 0x1000
jb 0x14008b554
mov dword [rsp - 0x14], 0x36fb6191
jmp 0x14008b5b5
mov rax, rbx
cmp rdx, 0x1000
jb 0x14008b4e7
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
mov rbx, qword [rbx - 8]
jmp 0x14008b4c4
sub rax, rbx
nop
sub rax, 0xffffffffdad4b29c
add rax, 0xffffffffdad4b294
cmp rax, 0x1f
jmp 0x14008b4dd
ja 0x14008b67b
mov dword [rsp - 0x3c], edx
mov rcx, rbx
call fcn.1400e2868
mov r13, qword [rsp + 0x60]
xchg rdx, r15
jmp 0x14008b4fc
mov rdx, qword [rsp + 0x48]
xchg rdx, r15
neg rsi
add rsi, 0xffffffffffffffe0
neg rsi
cmp rsi, qword [rsp + 0x28]
jmp 0x14008b568
mov r14d, eax
mov dword [rsp - 0x2c], esp
mov dword [rsp + 0x20], eax
cmp rdi, 0x10
jb 0x14008b504
lea rdx, [rdi + 1]
mov dword [rsp - 0x18], ebp
jmp 0x14008b4a1
xchg r8, rbx
mov r8, qword [rsp + 0x38]
xchg r8, rbx
jmp 0x14008b596
cmp rax, 0x1f
ja 0x14008b667
mov rcx, r15
xchg rdx, rdx
call fcn.1400e2868
lea rdx, [rbp - 0x70]
jmp 0x14008b53a
jne 0x14008aef0
xchg rdi, rdi
mov r12, qword [rsp + 0x30]
jmp 0x14008b580
jmp 0x14008b1c3
cmp r13, 0x10
jb 0x14008b55f
xchg rdi, rdi
lea rdx, [r13 + 1]
jmp 0x14008b484
mov rcx, rbx
mov dword [rsp - 0x38], ebx
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x14008b5cc
xor edi, edi
mov dword [rsp - 0x10], ecx
jmp 0x14008b57b
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
xchg rdx, rdx
jmp 0x14008b54a
xchg r9, rcx
mov r9, rbx
xchg rcx, r9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rsp - 0x40], ebp
xchg r12, r10
jmp 0x14008b63d
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
pop rbp
jmp 0x14008b666
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
mov dword [rsp - 0x44], ebx
call fcn.1400e2980
jmp 0x14008b617
xchg rbx, r14
mov r14, qword [rsp + 0x320]
xchg rbx, r14
add rsp, 0x94cdfc5
sub rsp, 0x94cdce5
nop
mov r15, qword [rsp]
jmp 0x14008b653
mov rcx, r10
xchg r10, r12
call 0x1400901f0
mov r11, r11
mov eax, r14d
jmp 0x14008b5ff
add rsp, 8
pop r14
pop r13
pop r12
mov r11, r11
nop
jmp 0x14008b5e8
ret
call fcn.1400e951c
mov dword [rsp - 0x2c], 0x8211d6d
nop
call fcn.14000e760
int3
call fcn.1400e951c
mov dword [rsp - 0x10], ecx
jmp 0x14008b689
int3