Function at 0x1401ef202
Capabilities:
Enumerate process modules

Disassembly:
push rax
pushf
mov eax, 0x9bedb0a0
pushf
not eax
add eax, 0xe4fc5551
xor eax, 0xdc41f0f7
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xd052b3fa
xor eax, 0xb1fd76a8
rol eax, 0xe1
popf
cmp eax, 4
jne 0x1401ef23f
popf
pop rax
jmp 0x1401ef643
cmp eax, 0
jne 0x1401ef24e
popf
pop rax
jmp 0x1401ef2d5
cmp eax, 3
jne 0x1401ef25d
popf
pop rax
jmp 0x1401ef5e3
cmp eax, 1
jne 0x1401ef26c
popf
pop rax
jmp 0x1401ef48a
cmp eax, 0xa
jne 0x1401ef27b
popf
pop rax
jmp 0x1401ef88f
cmp eax, 7
jne 0x1401ef28a
popf
pop rax
jmp 0x1401ef74a
cmp eax, 6
jne 0x1401ef299
popf
pop rax
jmp 0x1401ef6f9
cmp eax, 2
jne 0x1401ef2a8
popf
pop rax
jmp 0x1401ef572
cmp eax, 9
jne 0x1401ef2b7
popf
pop rax
jmp 0x1401ef81d
cmp eax, 8
jne 0x1401ef2c6
popf
pop rax
jmp 0x1401ef7ba
cmp eax, 5
jne 0x1401ef2d5
popf
pop rax
jmp 0x1401ef6ec
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0xf42d1101
pushf
not eax
add eax, 0xe3c3d861
xor eax, 0xf6a7c058
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xbdfb39a9
xor eax, 0xe7e7fa1b
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xa27fdb64
xor eax, 0xc731a460
rol eax, 0x13
popf
pushf
not eax
add eax, 0xf1b1a14a
xor eax, 0xff068188
rol eax, 0x86
popf
call fcn.14029380f
sub rsp, rax
mov rax, qword [0x140103090]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rdi, rdx
mov qword [rsp + 0x28], rdx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], rcx
mov qword [rdx + 8], rcx
mov qword [rdx + 0x10], rcx
mov dword [rsp + 0x20], 1
jmp 0x1401ef378
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0xc64a00ab
pushf
not ecx
add ecx, 0x9feb7990
xor ecx, 0xd0c9ae70
rol ecx, 9
popf
pushf
not ecx
add ecx, 0xc6008498
xor ecx, 0xb4a2680e
rol ecx, 0x86
popf
pushf
not ecx
add ecx, 0x96a61cd5
xor ecx, 0xb01f9de4
rol ecx, 0x7e
popf
pushf
not ecx
add ecx, 0xf6fd8618
xor ecx, 0xbc69a41f
rol ecx, 0xf9
popf
jmp 0x1401ef3dd
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x1401ef431
push rax
pushf
mov eax, 0xf4759c5f
pushf
not eax
add eax, 0xe8769c7a
xor eax, 0x9662c306
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xf42abea7
xor eax, 0xcd03a1f1
rol eax, 0x37
popf
pushf
not eax
add eax, 0xb4390522
xor eax, 0xf1c7c190
rol eax, 0xb2
popf
jmp 0x1401ef230
push rax
pushf
mov eax, 0xb403f8e0
pushf
not eax
add eax, 0xd9f8d2a3
xor eax, 0xd6ee38e1
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xc341e956
xor eax, 0x9730aa8e
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xa2c74e62
xor eax, 0x8475e6af
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xfff3f7ce
xor eax, 0x83826403
rol eax, 0x86
popf
jmp 0x1401ef230
lea r9, [rsp + 0x30]
mov r8d, 0x7c5f3592
pushf
not r8d
add r8d, 0xd1bff64f
xor r8d, 0x9ba35218
rol r8d, 0xb1
popf
pushf
not r8d
add r8d, 0xc93aea47
xor r8d, 0xafe87616
rol r8d, 0xb3
popf
pushf
not r8d
add r8d, 0xb3072088
xor r8d, 0xdc9033bb
rol r8d, 0xf
popf
pushf
not r8d
add r8d, 0xfb19394e
xor r8d, 0xb517b8b6
rol r8d, 0xfd
popf
lea rdx, [rsp + 0x40]
mov rcx, rax
jmp 0x1401ef502
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1401ef53f
push rax
pushf
mov eax, 0x136c59e3
pushf
not eax
add eax, 0x998ae926
xor eax, 0x964a6b2a
rol eax, 0xf1
popf
pushf
not eax
add eax, 0x94294c56
xor eax, 0xcb512bac
rol eax, 0x2e
popf
jmp 0x1401ef230
push rax
pushf
mov eax, 0xd01aa3ad
pushf
not eax
add eax, 0x83b3aa3c
xor eax, 0xcee772ec
rol eax, 0x82
popf
pushf
not eax
add eax, 0xa23a95a6
xor eax, 0xac41c41c
rol eax, 0xb3
popf
jmp 0x1401ef230
mov eax, dword [rsp + 0x30]
shr eax, 3
test eax, eax
je 0x1401ef5b0
push rax
pushf
mov eax, 0x4db566cc
pushf
not eax
add eax, 0x9285a5bc
xor eax, 0xbace8f05
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xf7053e24
xor eax, 0xd8533325
rol eax, 0xf3
popf
jmp 0x1401ef230
push rax
pushf
mov eax, 0x62d6eee1
pushf
not eax
add eax, 0xc2f6c7fa
xor eax, 0xaabf6254
rol eax, 0x26
popf
pushf
not eax
add eax, 0xa07e2d45
xor eax, 0xf84b5a12
rol eax, 0x91
popf
jmp 0x1401ef230
lea rbx, [rsp + 0x40]
mov esi, eax
push rax
pushf
mov eax, 0x477b646d
pushf
not eax
add eax, 0xc5eb214a
xor eax, 0xca23e2a5
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xb7358951
xor eax, 0x85e719e0
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xcb3d9dcb
xor eax, 0xdcb6dd52
rol eax, 0xb
popf
pushf
not eax
add eax, 0xd0f10f4f
xor eax, 0xf8d79fa1
rol eax, 0x4a
popf
jmp 0x1401ef230
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x1401ef6a6
push rax
pushf
mov eax, 0x9979b722
pushf
not eax
add eax, 0xf0f455ea
xor eax, 0x8a16e207
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xed787184
xor eax, 0xb8d6ddf5
rol eax, 0x53
popf
pushf
not eax
add eax, 0xcbdf49ca
xor eax, 0xa92a72ae
rol eax, 0x42
popf
pushf
not eax
add eax, 0xf6275868
xor eax, 0xe20d8f4e
rol eax, 0x68
popf
jmp 0x1401ef230
push rax
pushf
mov eax, 0xb77d283b
pushf
not eax
add eax, 0xdcd332f2
xor eax, 0xe1570636
rol eax, 0x63
popf
pushf
not eax
add eax, 0x85cf78f1
xor eax, 0xf0554d3b
rol eax, 0x37
popf
pushf
not eax
add eax, 0xd6349c21
xor eax, 0xed09d2f4
rol eax, 0xec
popf
jmp 0x1401ef230
mov rax, qword [rbx]
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x1401ef74a
mov r8, rbx
mov rcx, rdi
call fcn.1402f7403
push rax
pushf
mov eax, 0xdfa8289
pushf
not eax
add eax, 0xb1d41bc9
xor eax, 0x964aca62
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x9584b6d9
xor eax, 0xf546a304
rol eax, 0x46
popf
pushf
not eax
add eax, 0xe679b8ec
xor eax, 0xe70e2a68
rol eax, 0x58
popf
jmp 0x1401ef230
add rbx, 8
sub rsi, 1
jne 0x1401ef787
push rax
pushf
mov eax, 0xeca5323
pushf
not eax
add eax, 0xd5bb3572
xor eax, 0xe3e7a409
rol eax, 3
popf
pushf
not eax
add eax, 0xa9f7a871
xor eax, 0x803d7637
rol eax, 0x2b
popf
jmp 0x1401ef230
push rax
pushf
mov eax, 0xa4a2fdf4
pushf
not eax
add eax, 0xaee11b13
xor eax, 0xdc059c3c
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xddd34ec3
xor eax, 0xc72162b9
rol eax, 0xb6
popf
jmp 0x1401ef230
mov rcx, rbp
jmp 0x1401ef7be
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x1a14fe5f
pushf
not eax
add eax, 0x980b1f56
xor eax, 0xba6eb71e
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xa5dfcf8a
xor eax, 0x91f631d9
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xc2cd4e55
xor eax, 0xf1470295
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x804ebf4c
xor eax, 0x9da06d26
rol eax, 0xf8
popf
jmp 0x1401ef230
mov rax, rdi
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14027ae25
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
int3