Function at 0x14008c1b0
Capabilities:
Enumerate process modules

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
jmp 0x14008c420
xchg rsi, r13
mov rsi, qword [rsp + 0x60]
xchg r13, rsi
xchg rdi, r15
mov rdi, qword [rsp + 0x48]
xchg r15, rdi
jmp 0x14008c557
cmp r14, 0x10
jae 0x14008c663
mov dword [rsp - 0x20], ebx
xchg r12, r13
movups xmm0, xmmword [r13]
xchg r13, r12
xchg rsp, r13
jmp 0x14008c508
xchg rbx, rsp
xchg r15, rax
mov qword [rsp + 0x38], r15
xchg r15, rax
xor edx, edx
mov r8d, 0x64be301c
jmp 0x14008c308
xor edi, 0x1e1d11bf
lea rdx, [rsp + 0x68]
xchg r13, r13
jmp 0x14008c547
mov dword [rsp - 0x28], 0x5045db37
test eax, eax
je 0x14008c9c8
mov qword [rsp + 0x48], rdi
mov rbp, rbp
jmp 0x14008c245
xchg r12, rdi
mov qword [rsp + 0x58], r12
xchg r12, rdi
mov qword [rsp + 0x60], 0x61ebab73
jmp 0x14008c25e
xor qword [rsp + 0x60], 0x4e402770
add qword [rsp + 0x60], 0x1a3c098a
sub qword [rsp + 0x60], 0x473554ba
add qword [rsp + 0x60], 0x2452e388
xor qword [rsp + 0x60], 0x381f0593
xor qword [rsp + 0x60], 0xed645b2
sub qword [rsp + 0x60], 0x11cc646b
jmp 0x14008c4a3
add rsp, 0xfffffffffffffd20
mov rax, qword [0x1402567f0]
xor rax, rsp
jmp 0x14008c4e3
sub ecx, 0x4d71c845
xor ecx, 0x79ec87
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xchg rsp, rbx
mov rsp, rax
jmp 0x14008c1fc
jne 0x14008c343
lea rdx, [rbp - 0x40]
mov dword [rsp - 0x2c], edi
lea rcx, [rsp + 0x48]
jmp 0x14008c568
lea rax, [rbp - 0x40]
mov dword [rsp - 0x24], 0x69232306
nop
movabs r8, 0xffffffff5949a932
jmp 0x14008c649
add r8d, 0x332c610
add r8d, 0x13e4c05e
xor r8d, 0x65959e5b
add r8d, 0x18522e30
add r8d, 0x467e546b
jmp 0x14008c5d4
xor r8, 0x7ba0ee01
nop word [rax + rax]
mov r13, r13
inc r8
cmp byte [rax + r8], 0
jmp 0x14008c2d4
mov r13, qword [rsp + 0x60]
mov r8, r8
cmp r13, 0x10
cmovae rdi, r15
jmp 0x14008c5b6
mov rsp, qword [r12 + 8]
xchg rsp, rax
mov qword [rsp + 0x28], rax
xchg r15, r15
cmp rsi, rax
jmp 0x14008c430
mov qword [rsp], rdi
push r12
mov dword [rsp - 0xc], 0xdd6c0f7
push r13
push rcx
jmp 0x14008c630
xchg rbx, r12
mov rbx, rsi
xchg r12, rbx
cmp qword [rsi + 0x18], 0x10
jb 0x14008c1db
xchg r8, r8
mov r12, qword [rsi]
jmp 0x14008c1db
lea rdi, [rsp + 0x48]
xchg r15, rdi
mov rdi, qword [rsp + 0x48]
xchg r15, rdi
jmp 0x14008c350
add r8, 0x317f68df
sub r8, 0x69ca4393
xor r8, 0xb9d8af0
xor r8, 0xb5c4f73
add r8, 0x7fffffff
jmp 0x14008c330
xor ecx, 0xd575a48
sub ecx, 0x8160b45
xor ecx, 0x1aeed673
jmp 0x14008c2b8
mov qword [rsp + 0x40], r8
mov ecx, 0x1bcb2cd6
xor ecx, 0x3fd65fbc
add ecx, 0x2e2ec43a
jmp 0x14008c3ee
push rax
mov qword [rsp], rbp
push rsi
nop
sub rsp, 8
jmp 0x14008c37c
je 0x14008c98e
nop word [rax + rax]
mov qword [rbp - 0x80], 0x4411bfc3
xor qword [rbp - 0x80], 0x41651621
xor qword [rbp - 0x80], 0x3e14c244
jmp 0x14008c4c6
cmovae rbx, r15
cmp rbx, rsi
je 0x14008c557
xchg r13, r13
sub rdi, rbx
movsx ecx, byte [rbx]
jmp 0x14008c61b
xchg rdx, rsi
add rsi, rcx
lea rbx, [rsp + 0x48]
mov dword [rsp - 0x28], esi
cmp r13, 0x10
jmp 0x14008c459
lea rdx, [rbp - 0x70]
xchg rcx, r13
mov r13, rbx
xchg rcx, r13
call sub.KERNEL32.dll_Module32First
jmp 0x14008c228
mov byte [rsp + 0x48], 0x27
xor byte [rsp + 0x48], 0x7b
xor byte [rsp + 0x48], 0x3c
sub byte [rsp + 0x48], 0x59
xor byte [rsp + 0x48], 0x45
xor byte [rsp + 0x48], 0x42
jmp 0x14008c2ec
xor qword [rbp - 0x80], 0x1dfeb16d
sub qword [rbp - 0x80], 0xc0ff665
sub qword [rbp - 0x80], 0x25772fe
jmp 0x14008c520
mov qword [rbp + 0x1d0], rax
xchg r14, r14
xchg r12, r8
mov r8, r12
xchg r12, r8
mov qword [rsp + 0x30], r8
mov dword [rsp - 0x1c], 0x67205729
jmp 0x14008c405
movups xmmword [r13 + 0x68], xmm0
xchg r13, rsp
mov edi, 0x7829f274
xor edi, 0x166608db
jmp 0x14008c5fe
add qword [rbp - 0x80], 0x2c7566d7
xor qword [rbp - 0x80], 0x1e5aa261
sub qword [rbp - 0x80], 0x5af67a5e
xchg r12, r14
mov r12, qword [rsi + 0x10]
xchg r14, r12
jmp 0x14008c392
xchg rcx, rbx
mov rcx, qword [rsp + 0x68]
xchg rbx, rcx
jmp 0x14008c78c
xchg r15, rsi
mov r15, qword [r12]
xchg r15, rsi
xchg rsp, rax
jmp 0x14008c365
call fcn.140019990
nop
mov dword [rsp - 0x24], 0x6a71d71
jmp 0x14008c3b1
sub dword [rbp - 0x70], 0x154e63ad
add dword [rbp - 0x70], 0x24a0939a
sub dword [rbp - 0x70], 0x58eaf1e1
xor edi, edi
mov r14d, edi
xchg rdi, rdi
mov dword [rsp + 0x20], edi
jmp 0x14008c48c
inc rbx
cmp rbx, rsi
mov dword [rsp - 0x2c], edx
jne 0x14008c46c
jmp 0x14008c1c0
lea rcx, [rsp + 0x48]
mov dword [rsp - 0x40], 0x70124e06
cmovae rcx, r15
xchg rdx, rsi
mov rdx, qword [rsp + 0x58]
jmp 0x14008c474
sub r8d, 0x7d10a938
lea rcx, [rbp - 0x6c]
call fcn.1400ec5d0
mov dword [rbp - 0x70], 0x55760823
sub dword [rbp - 0x70], 0x2161e133
xor dword [rbp - 0x70], 0x7d8ce2dc
jmp 0x14008c57b
xor edi, 0x5c4ce3ff
add edi, 0x1c418661
sub edi, 0x25a8eb43
sub edi, 0xa7ea2be
jmp 0x14008c215
call fcn.1400b68a0
mov dword [rsp - 0xc], 0x6e913bdb
mov byte [rbx + rdi], al
jmp 0x14008c5a1
mov qword [rsp], r14
push rdx
mov qword [rsp], r15
lea rbp, [rsp - 0x1e0]
xchg r10, r10
jmp 0x14008c2a2
xor r8, 0xe4633f6
xor r8, 0x2ec7380b
sub r8, 0x3cdef39f
jmp 0x14008c3c6
xchg rsi, r14
mov rdi, rsi
xchg rsi, r14
or rdi, 0xf
jmp 0x14008c719
mov rcx, rbx
xchg rbx, rax
call fcn.1400e9d24
mov rsi, rsi
test rax, rax
jmp 0x14008c6ff
add rax, 0x211a4772
sub rax, 0x22a976ce
sub rax, 0x3fb73911
xor rax, 0x53a00e12
xor rax, 0x2d9bf62a
add rax, 0x1ed1aaf
add rax, 0x7fffffff
jmp 0x14008c6d3
cmp rcx, 0x1000
mov dword [rsp - 0xc], ebp
jb 0x14008c732
lea rax, [rcx + 0x27]
jmp 0x14008c6ec
add rax, 0x125422b2
cmp rdi, rax
xchg rdi, rdi
cmova rdi, rax
lea rcx, [rdi + 1]
jmp 0x14008c6b9
cmp rax, rcx
jbe 0x14008ca78
mov r13, r13
xchg rbx, rax
jmp 0x14008c675
je 0x14008ca86
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov rdx, rdx
mov qword [rbx - 8], rax
jmp 0x14008c75d
mov dword [rsp - 0x24], ecx
movabs rax, 0x7fffffff48c45608
add rax, 0xe074d0c
jmp 0x14008c68a
test rcx, rcx
mov dword [rsp - 0x44], 0x1afc25b7
je 0x14008c75b
jmp 0x14008c748
call fcn.1400e9d24
xchg rsi, rbx
mov rsi, rax
xchg rsi, rbx
jmp 0x14008c75d
xor ebx, ebx
xchg rbx, r14
mov qword [rsp + 0x68], r14
xchg rbx, r14
lea r8, [r14 + 1]
xchg rcx, rcx
jmp 0x14008c7fb
mov r9, qword [rsp + 0x60]
xchg r13, r9
xchg r15, r13
jmp 0x14008c784
mov r13, qword [rsp + 0x48]
xchg r15, r13
mov qword [rbp - 0x80], rdi
jmp 0x14008c80c
call fcn.1400ebf20
xchg rsp, rsp
lea rdx, [rsp + 0x68]
cmp rdi, 0x10
cmovae rdx, rbx
mov dword [rsp - 0x34], edx
xchg r13, r9
jmp 0x14008c774
sub cl, 0x49
sub cl, 0x33
jmp 0x14008c848
jne 0x14008c83e
mov rbp, rbp
call fcn.1400ecb20
test eax, eax
jne 0x14008c83e
jmp 0x14008c82d
cmp r13, 0x10
mov dword [rsp - 0xc], edx
cmovae rcx, r15
xchg r14, r8
mov r14, qword [rsp + 0x58]
xchg r8, r14
cmp r8, r14
jmp 0x14008c7c1
mov rdx, r12
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
jmp 0x14008c795
mov dword [rsp - 0x10], esp
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x48]
jmp 0x14008c7dc
xor cl, 0xa
add cl, 0x18
xor cl, 0x27
jmp 0x14008c7b6
mov dword [rsp - 0x20], esp
mov cl, 0x1f
xor cl, 0x5a
xor cl, 0xd
jmp 0x14008c81f
xor cl, cl
mov dword [rsp - 0x44], 0x588de811
mov r14d, dword [rsp + 0x20]
lea eax, [r14 + 1]
test cl, cl
jmp 0x14008c89d
sub rdx, 0x608ebdba
add rdx, 0x608ebde1
mov r15, qword [r15 - 8]
mov dword [rsp - 0x38], 0x2de3af35
sub rax, r15
neg rax
add rax, 8
jmp 0x14008c9a4
xchg rbp, r15
mov rax, rbp
xchg rbp, r15
cmp rdx, 0x1000
jb 0x14008c9b4
nop
jmp 0x14008c858
mov r11, r11
cmove eax, r14d
mov r14d, eax
mov dword [rsp + 0x20], eax
cmp rdi, 0x10
mov dword [rsp - 0x18], 0x1c4ee4e3
jb 0x14008c944
jmp 0x14008c91e
xchg rcx, r15
call fcn.1400e9d60
lea rdx, [rbp - 0x70]
mov dword [rsp - 0x34], 0x5fc3cf7
mov rbx, qword [rsp + 0x38]
xchg rcx, rbp
jmp 0x14008c900
jb 0x14008c969
sub rdx, 0xffffffffffffffd9
mov rbx, qword [rbx - 8]
mov rsp, rsp
sub rax, rbx
sub rax, 8
jmp 0x14008c95c
mov rbp, rbx
xchg rcx, rbp
call sub.KERNEL32.dll_Module32Next
mov dword [rsp - 0x18], edx
test eax, eax
je 0x14008c9c8
xor edi, edi
jmp 0x14008c9bf
lea rdx, [rdi + 1]
xchg r15, rax
mov r15, rbx
xchg r15, rax
cmp rdx, 0x1000
mov dword [rsp - 0x30], ecx
jmp 0x14008c8e3
xchg r15, r9
mov r9, qword [rsp + 0x48]
xchg r9, r15
add rsi, 0x20
cmp rsi, qword [rsp + 0x28]
jne 0x14008c43c
mov dword [rsp - 0x20], edx
jmp 0x14008c983
cmp rax, 0x1f
ja 0x14008ca86
xchg rcx, rcx
mov rcx, rbx
call fcn.1400e9d60
mov r13, qword [rsp + 0x60]
mov dword [rsp - 0x2c], 0x12fa191
jmp 0x14008c939
xchg r12, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, r12
cmp r13, 0x10
jb 0x14008c8ca
lea rdx, [r13 + 1]
mov r10, r10
jmp 0x14008c881
neg rax
cmp rax, 0x1f
ja 0x14008ca6e
xchg rsi, rsi
xchg r15, rcx
mov r15, rcx
jmp 0x14008c8c2
mov dword [rsp - 0x24], esp
jmp 0x14008c238
xchg rcx, rbp
mov rbp, rbx
xchg rbp, rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rsp - 0x40], 0x6599a32d
jmp 0x14008ca4c
pop r13
mov dword [rsp - 0x38], edi
pop r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
jmp 0x14008ca16
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
jmp 0x14008c9e5
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
xor rcx, rsp
xchg r10, r10
call fcn.1400e9e80
mov rbx, qword [rsp + 0x320]
add rsp, 0x2e0
xchg r14, r14
jmp 0x14008c9fd
mov rcx, r12
call 0x140091720
mov eax, r14d
jmp 0x14008ca5c
xchg rbx, rcx
mov rbx, qword [rbp + 0x1d0]
xchg rcx, rbx
jmp 0x14008ca2a
call fcn.1400f0a1c
mov dword [rsp - 0x14], ebp
nop
call fcn.14000e910
int3
call fcn.1400f0a1c
int3