Function at 0x140011302
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1400124d0
push rbp
push rdi
sub rsp, 0x528
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xde
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x4e8], rax
lea rcx, [0x1400250f8]
call fcn.140011429
mov dword [rbp + 4], 0
lea rdx, str.Counter_Strike_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14001277b
lea rdx, [rbp + 4]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x14001277b
mov dword [rbp + 0x70], 0x238
mov edx, dword [rbp + 4]
mov ecx, 0x18
call fcn.140011208
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0xffffffffffffffff
je 0x140012652
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x2c8]
call fcn.140011069
test eax, eax
je 0x140012645
lea rdx, str.Find
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011091
lea rdx, [rbp + 0xa0]
mov rcx, rax
call fcn.140011091
lea rdx, str._DLL
mov rcx, rax
call fcn.140011091
mov qword [rbp + 0x4d8], rax
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov qword [rbp + 0x4e0], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x4e0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.client.dll
lea rcx, [rbp + 0xa0]
call fcn.140011492
test eax, eax
jne 0x14001262d
mov rax, qword [rbp + 0x88]
mov qword [0x14001f1b0], rax
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x2c8]
call fcn.140011154
test eax, eax
jne 0x1400125a1
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x2e8], 0
mov qword [rbp + 0x308], 0
mov rax, qword [0x14001f1b0]
add rax, 0x19038f8
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x308]
mov rdx, rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [0x14001f1b0]
add rax, 0x1729348
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x2e8]
mov rdx, rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x308]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x4d8], rax
lea rdx, [0x14001103c]
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x324], 0x96
movss xmm0, dword [0x14001be90]
movss dword [rbp + 0x344], xmm0
mov rax, qword [rbp + 0x308]
add rax, 0x6cc
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x324]
mov rdx, rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rbp + 0x2e8]
add rax, 0x14c8
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x344]
mov rdx, rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bd70]
call fcn.1400113b1
mov eax, edi
mov rcx, qword [rbp + 0x4e8]
xor rcx, rbp
call fcn.140011221
lea rsp, [rbp + 0x4f8]
pop rdi
pop rbp
ret