Function at 0x1400ae88c
Capabilities:
Enumerate process modules

Disassembly:
push rax
pushf
mov eax, 0x998f29d6
pushf
not eax
add eax, 0x96287ad5
xor eax, 0xb5e337a8
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x8895f880
xor eax, 0x9ef89f5a
rol eax, 0xde
popf
cmp eax, 4
jne 0x1400ae8c9
popf
pop rax
jmp 0x1400aec8c
cmp eax, 0
jne 0x1400ae8d8
popf
pop rax
jmp 0x1400ae9aa
cmp eax, 3
jne 0x1400ae8e7
popf
pop rax
jmp 0x1400aebf4
cmp eax, 1
jne 0x1400ae8f6
popf
pop rax
jmp 0x1400aeb1f
cmp eax, 0xd
jne 0x1400ae905
popf
pop rax
jmp 0x1400af27b
cmp eax, 7
jne 0x1400ae914
popf
pop rax
jmp 0x1400aefa1
cmp eax, 0xe
jne 0x1400ae923
popf
pop rax
jmp 0x1400af2d6
cmp eax, 0xb
jne 0x1400ae932
popf
pop rax
jmp 0x1400af182
cmp eax, 0xc
jne 0x1400ae941
popf
pop rax
jmp 0x1400af1df
cmp eax, 8
jne 0x1400ae950
popf
pop rax
jmp 0x1400af004
cmp eax, 5
jne 0x1400ae95f
popf
pop rax
jmp 0x1400aee0b
cmp eax, 2
jne 0x1400ae96e
popf
pop rax
jmp 0x1400aebaa
cmp eax, 9
jne 0x1400ae97d
popf
pop rax
jmp 0x1400af09a
cmp eax, 0xa
jne 0x1400ae98c
popf
pop rax
jmp 0x1400af0e3
cmp eax, 6
jne 0x1400ae99b
popf
pop rax
jmp 0x1400aeef3
cmp eax, 0xf
jne 0x1400ae9aa
popf
pop rax
jmp 0x1400af32e
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x4e701dca
pushf
not eax
add eax, 0xc7e9e40d
xor eax, 0x956ef296
rol eax, 0x34
popf
pushf
not eax
add eax, 0xb829f2b3
xor eax, 0x8a45d97a
rol eax, 0x98
popf
pushf
not eax
add eax, 0xf28dca33
xor eax, 0xcec5d098
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xcccb002b
xor eax, 0x8dd622d0
rol eax, 0x3e
popf
call fcn.1400df5dc
sub rsp, rax
mov rax, qword [0x140085080]
xor rax, rsp
mov qword [rsp + 0x1140], rax
mov rsi, rcx
lea r8, [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov edx, 0x13c6c9d9
pushf
not edx
add edx, 0xb02e9cb5
xor edx, 0x952dca54
rol edx, 0x92
popf
pushf
not edx
add edx, 0x966329ce
xor edx, 0xfbcd82b3
rol edx, 0xb4
popf
pushf
not edx
add edx, 0xebfd49ea
xor edx, 0x8a904941
rol edx, 0x43
popf
jmp 0x1400aea72
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x1400aeac6
push rax
pushf
mov eax, 0x7ebacc71
pushf
not eax
add eax, 0xa03a8543
xor eax, 0xf15a484c
rol eax, 0xf
popf
pushf
not eax
add eax, 0xe33d6951
xor eax, 0x9cab362c
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xec4db569
xor eax, 0xc9622c2d
rol eax, 0x2c
popf
jmp 0x1400ae8ba
push rax
pushf
mov eax, 0x9c265f4c
pushf
not eax
add eax, 0x86c309f5
xor eax, 0xb73cf0c7
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xe0a3c255
xor eax, 0xe2572edb
rol eax, 0x85
popf
pushf
not eax
add eax, 0xc2e84006
xor eax, 0xc4e2039c
rol eax, 0x32
popf
pushf
not eax
add eax, 0xb3d2955a
xor eax, 0xe7f0e87a
rol eax, 0xb8
popf
jmp 0x1400ae8ba
mov ecx, dword [rsp + 0x28]
xor ebx, ebx
test ecx, 0xfffffffc
jbe 0x1400aeb77
push rax
pushf
mov eax, 0xc348fc5f
pushf
not eax
add eax, 0xebda32ab
xor eax, 0xe1e176af
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xe1db6829
xor eax, 0x85254b06
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xf01d177f
xor eax, 0xcdf6f3c3
rol eax, 0x9a
popf
jmp 0x1400ae8ba
push rax
pushf
mov eax, 0x5dfce32f
pushf
not eax
add eax, 0xda6120fc
xor eax, 0x9f606d2a
rol eax, 0xd9
popf
pushf
not eax
add eax, 0x969108d8
xor eax, 0xc5cb0036
rol eax, 0x68
popf
jmp 0x1400ae8ba
nop dword [rax]
push rax
pushf
mov eax, 0x5c7212a9
pushf
not eax
add eax, 0x87a72654
xor eax, 0xc53e8538
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xd0668e54
xor eax, 0x80515bc7
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xc6c863cb
xor eax, 0xabcd0e8e
rol eax, 0xf5
popf
jmp 0x1400ae8ba
mov edi, dword [rsp + rbx*4 + 0x30]
test edi, edi
je 0x1400aec33
push rax
pushf
mov eax, 0xc7e3b4bd
pushf
not eax
add eax, 0xf7f4664f
xor eax, 0xc594ae6c
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xb9d8af92
xor eax, 0xb9fd5750
rol eax, 0x90
popf
jmp 0x1400ae8ba
push rax
pushf
mov eax, 0x52518716
pushf
not eax
add eax, 0xc6c37bf8
xor eax, 0x8ffa2cf5
rol eax, 0xbe
popf
pushf
not eax
add eax, 0x99e2b382
xor eax, 0xb28ed8a3
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x9a799d26
xor eax, 0xa49efaf4
rol eax, 0x30
popf
pushf
not eax
add eax, 0xd9f7482e
xor eax, 0xae67db25
rol eax, 0x72
popf
jmp 0x1400ae8ba
movsd xmm0, qword [str._unknown_]
lea rcx, [rsp + 0x103a]
movzx eax, word [0x140078390]
xor edx, edx
mov r8d, 0x716862a2
pushf
not r8d
add r8d, 0xb0376eca
xor r8d, 0xd8fee5ae
rol r8d, 0xfd
popf
pushf
not r8d
add r8d, 0xe101961b
xor r8d, 0xf16cbd3d
rol r8d, 0x60
popf
pushf
not r8d
add r8d, 0xa1c55596
xor r8d, 0x9660ea18
rol r8d, 0xd1
popf
pushf
not r8d
add r8d, 0x81517c15
xor r8d, 0x819dc7f8
rol r8d, 0xa7
popf
movsd qword [rsp + 0x1030], xmm0
mov word [rsp + 0x1038], ax
call sub.VCRUNTIME140.dll_memset
mov r8d, edi
xor edx, edx
mov ecx, 0xc9d8dfdc
pushf
not ecx
add ecx, 0xe23468e3
xor ecx, 0xfe5718b6
rol ecx, 0x6b
popf
pushf
not ecx
add ecx, 0xd70b8f52
xor ecx, 0x9248dc8c
rol ecx, 0xbd
popf
pushf
not ecx
add ecx, 0xf7d9b3ee
xor ecx, 0xb5ad8736
rol ecx, 0x6d
popf
pushf
not ecx
add ecx, 0xe9ba061a
xor ecx, 0xf5ec3448
rol ecx, 0xc9
popf
jmp 0x1400aed84
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400aedd8
push rax
pushf
mov eax, 0x3dcae5f7
pushf
not eax
add eax, 0x950d7567
xor eax, 0xe290483d
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xe9865467
xor eax, 0x9e880a48
rol eax, 0x16
popf
pushf
not eax
add eax, 0x99427d91
xor eax, 0x814f25a3
rol eax, 0xaa
popf
jmp 0x1400ae8ba
push rax
pushf
mov eax, 0xb8154590
pushf
not eax
add eax, 0xc8d86181
xor eax, 0xe02b7f2c
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x80d89bc8
xor eax, 0xa3e7b373
rol eax, 0x5f
popf
jmp 0x1400ae8ba
lea r9, [rsp + 0x2c]
mov r8d, 0x408c25b5
pushf
not r8d
add r8d, 0xed91b94e
xor r8d, 0xdf7cfe59
rol r8d, 0x76
popf
pushf
not r8d
add r8d, 0xfd193ec2
xor r8d, 0xef3b4f49
rol r8d, 0x5c
popf
pushf
not r8d
add r8d, 0xf593217c
xor r8d, 0xc9dce765
rol r8d, 0xa
popf
pushf
not r8d
add r8d, 0xb1d6d9fd
xor r8d, 0x98bf2822
rol r8d, 0x7b
popf
lea rdx, [rsp + 0x20]
mov rcx, rax
jmp 0x1400aee83
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400aeec0
push rax
pushf
mov eax, 0x124770e1
pushf
not eax
add eax, 0x834f84cf
xor eax, 0xf7f867e3
rol eax, 0x19
popf
pushf
not eax
add eax, 0xc62d9f7a
xor eax, 0xa919be91
rol eax, 0x70
popf
jmp 0x1400ae8ba
push rax
pushf
mov eax, 0xed14c439
pushf
not eax
add eax, 0xf46d1061
xor eax, 0xcfcae6eb
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x83e58794
xor eax, 0xead33c3a
rol eax, 0xf7
popf
jmp 0x1400ae8ba
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x1030]
mov r9d, 0xce2b9754
pushf
not r9d
add r9d, 0x9d0a5921
xor r9d, 0xea00d582
rol r9d, 0x7a
popf
pushf
not r9d
add r9d, 0xea33c1af
xor r9d, 0x8dd9548b
rol r9d, 0x59
popf
pushf
not r9d
add r9d, 0xab98218a
xor r9d, 0xff3faf4e
rol r9d, 0x13
popf
mov rcx, rdi
jmp 0x1400aef55
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push rax
pushf
mov eax, 0xe7b02918
pushf
not eax
add eax, 0xa27012b8
xor eax, 0xc98b84f8
rol eax, 0x67
popf
pushf
not eax
add eax, 0xa5e1815c
xor eax, 0xe823599e
rol eax, 0xe6
popf
pushf
not eax
add eax, 0x9eab2712
xor eax, 0xbc4117d9
rol eax, 0xd0
popf
jmp 0x1400ae8ba
mov rcx, rdi
jmp 0x1400aefa5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0xe706fb2a
pushf
not eax
add eax, 0xc36d7613
xor eax, 0xe7ed57ce
rol eax, 0x35
popf
pushf
not eax
add eax, 0xebf5854e
xor eax, 0xda6d764a
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xefd6ed78
xor eax, 0xeac9d961
rol eax, 0x28
popf
pushf
not eax
add eax, 0xb77ffad1
xor eax, 0xec1176a4
rol eax, 0xf8
popf
jmp 0x1400ae8ba
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400af041
push rax
pushf
mov eax, 0xd04c5638
pushf
not eax
add eax, 0x851866c6
xor eax, 0x9e0746f1
rol eax, 0x20
popf
pushf
not eax
add eax, 0xe59e372c
xor eax, 0xbad2f2af
rol eax, 0xd7
popf
jmp 0x1400ae8ba
push rax
pushf
mov eax, 0x3317ec5a
pushf
not eax
add eax, 0x8bf815e9
xor eax, 0xfd927919
rol eax, 0x71
popf
pushf
not eax
add eax, 0xe867f336
xor eax, 0xbec30f23
rol eax, 0xb
popf
pushf
not eax
add eax, 0xb4b69daf
xor eax, 0xcc99c137
rol eax, 4
popf
pushf
not eax
add eax, 0x8dd1c903
xor eax, 0xcfa57a8b
rol eax, 0xc0
popf
jmp 0x1400ae8ba
mov rdx, qword [rsi]
push rax
pushf
mov eax, 0xf36a41af
pushf
not eax
add eax, 0x835b8469
xor eax, 0x8e7c1724
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xcb7300be
xor eax, 0xf2c0fc53
rol eax, 0x91
popf
pushf
not eax
add eax, 0x98f54a36
xor eax, 0x91aba5cc
rol eax, 0x3c
popf
jmp 0x1400ae8ba
lea rcx, [rsp + 0x1030]
jmp 0x1400af0ec
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400af13c
push rax
pushf
mov eax, 0xd57191b2
pushf
not eax
add eax, 0xce88796e
xor eax, 0xf01104da
rol eax, 0x29
popf
pushf
not eax
add eax, 0xdf730260
xor eax, 0xc51d1298
rol eax, 0x81
popf
pushf
not eax
add eax, 0xc771e07f
xor eax, 0xb36f3ad4
rol eax, 0xb
popf
jmp 0x1400ae8ba
push rax
pushf
mov eax, 0x98b098f
pushf
not eax
add eax, 0xfb2d10c5
xor eax, 0xea1ec50a
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xe693ab06
xor eax, 0xecb73754
rol eax, 0x94
popf
pushf
not eax
add eax, 0x819b1b49
xor eax, 0xb66ec4e3
rol eax, 0xaa
popf
jmp 0x1400ae8ba
mov ecx, dword [rsp + 0x28]
push rax
pushf
mov eax, 0xe0978b74
pushf
not eax
add eax, 0x8078b337
xor eax, 0x9955452c
rol eax, 0xa8
popf
pushf
not eax
add eax, 0xbc4910f5
xor eax, 0x9159ff32
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xce6b66a3
xor eax, 0xefadc99c
rol eax, 0xec
popf
pushf
not eax
add eax, 0xb4320fbc
xor eax, 0x9ee75bc9
rol eax, 0x66
popf
jmp 0x1400ae8ba
mov eax, ecx
jmp 0x1400af1e2
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x1400af222
push rax
pushf
mov eax, 0x23877409
pushf
not eax
add eax, 0xa095014a
xor eax, 0xb716e489
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xbffefea2
xor eax, 0xe58c8f5b
rol eax, 0x1a
popf
jmp 0x1400ae8ba
push rax
pushf
mov eax, 0x4cf1eaed
pushf
not eax
add eax, 0x9f4b2776
xor eax, 0xb163f1a7
rol eax, 0x6c
popf
pushf
not eax
add eax, 0x80f6c0f3
xor eax, 0xc4cb9ab0
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x976c7ed2
xor eax, 0xb3d9785b
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xeeda8d5f
xor eax, 0xb814a02e
rol eax, 0xfa
popf
jmp 0x1400ae8ba
xor eax, eax
push rax
pushf
mov eax, 0xdefccfc4
pushf
not eax
add eax, 0xa14b3f11
xor eax, 0xcbb6c881
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xfbd533ca
xor eax, 0xc3a25c5b
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xab0f2be6
xor eax, 0xfe17d68c
rol eax, 0x77
popf
pushf
not eax
add eax, 0xdd5840eb
xor eax, 0xc36a6bb3
rol eax, 0xb2
popf
jmp 0x1400ae8ba
mov rcx, qword [rsp + 0x1140]
xor rcx, rsp
call fcn.1400dadee
lea r11, [rsp + 0x1150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov eax, dword [rsp + rbx*4 + 0x30]
jmp 0x1400af2d6