Function at 0x1400ee4ee
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x14011a920
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x2c78
call fcn.1400ec5ae
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x992
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c98]
mov rax, qword [0x140359238]
xor rax, rbp
mov qword [rbp + 0x2c30], rax
lea rcx, [0x14038109f]
call fcn.1400f28c8
mov rax, qword [rbp + 0x2c60]
mov r8d, dword [rax + 0x28]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2048], rax
cmp qword [rbp + 0x2048], 0
jne 0x14011a9ae
xor al, al
jmp 0x14011ad12
lea rdx, [rbp + 0x2064]
mov rcx, qword [rbp + 0x2048]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x14011a9da
mov rcx, qword [rbp + 0x2048]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14011ad12
cmp dword [rbp + 0x2064], 0
je 0x14011a9ec
mov byte [rbp + 0x2c24], 1
jmp 0x14011a9f3
mov byte [rbp + 0x2c24], 0
mov rax, qword [rbp + 0x2c60]
movzx ecx, byte [rbp + 0x2c24]
mov byte [rax + 0x2c], cl
movzx eax, byte [rbp + 0x2c78]
test eax, eax
je 0x14011acdd
movzx eax, byte [rbp + 0x2c70]
test eax, eax
je 0x14011aa2a
mov dword [rbp + 0x2c24], 1
jmp 0x14011aa34
mov dword [rbp + 0x2c24], 2
mov eax, dword [rbp + 0x2c24]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x2024]
mov r8d, 0x2000
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x2048]
call fcn.1400f29db
test eax, eax
je 0x14011acdd
lea rax, [rbp + 0x2090]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rcx, [rbp + 0x22b8]
call fcn.1400f0cc6
nop
mov eax, 8
imul rax, rax, 0
mov r9d, 0x104
lea r8, [rbp + 0x2090]
mov rdx, qword [rbp + rax + 0x10]
mov rcx, qword [rbp + 0x2048]
call fcn.1400f2f85
test eax, eax
je 0x14011acd1
lea rcx, [rbp + 0x2090]
call fcn.1400f2878
lea rdx, [rbp + 0x2090]
lea rcx, [rbp + 0x22b8]
call fcn.1400eceaf
mov rcx, qword [rbp + 0x2c68]
call fcn.1400ebb4f
movzx eax, al
test eax, eax
je 0x14011ab26
mov rax, qword [rbp + 0x2c60]
lea rdx, [rbp + 0x22b8]
mov rcx, rax
call fcn.1400f1dab
mov rcx, qword [rbp + 0x2048]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0x2b74], 1
lea rcx, [rbp + 0x22b8]
call fcn.1400f165d
movzx eax, byte [rbp + 0x2b74]
jmp 0x14011ad12
mov dword [rbp + 0x22f4], 0
jmp 0x14011ab40
mov eax, dword [rbp + 0x22f4]
inc eax
mov dword [rbp + 0x22f4], eax
mov eax, dword [rbp + 0x22f4]
mov qword [rbp + 0x2c28], rax
mov ecx, dword [rbp + 0x2024]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rbp + 0x2c28]
cmp rcx, rax
jae 0x14011acd1
lea rax, [rbp + 0x2320]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov eax, dword [rbp + 0x22f4]
mov r9d, 0x104
lea r8, [rbp + 0x2320]
mov rdx, qword [rbp + rax*8 + 0x10]
mov rcx, qword [rbp + 0x2048]
call fcn.1400f2f85
test eax, eax
je 0x14011accc
lea rcx, [rbp + 0x2320]
call fcn.1400f2878
mov edx, 0x18
lea rcx, [rbp + 0x2548]
call fcn.1400f1392
lea rdx, [rbp + 0x2548]
mov rcx, qword [rbp + 0x2c68]
call fcn.1400f0a6e
nop
jmp 0x14011ac03
xor r8d, r8d
lea rdx, [rbp + 0x2b98]
lea rcx, [rbp + 0x2548]
call fcn.1400eb92e
lea rcx, [rbp + 0x2b98]
call fcn.1400ef8f3
lea rdx, [rbp + 0x2be8]
mov rcx, qword [rbp + 0x2c68]
call fcn.1400f0b54
mov qword [rbp + 0x2c28], rax
mov rdx, qword [rbp + 0x2c28]
lea rcx, [rbp + 0x2548]
call fcn.1400eb6ae
mov byte [rbp + 0x2bc4], al
lea rcx, [rbp + 0x2be8]
call fcn.1400ef8f3
movzx eax, byte [rbp + 0x2bc4]
test eax, eax
je 0x14011acc0
lea rcx, [rbp + 0x2548]
call fcn.1400ec414
lea rdx, [rbp + 0x2320]
mov rcx, rax
call fcn.1400ed977
movzx eax, al
test eax, eax
je 0x14011acbb
mov rax, qword [rbp + 0x2c60]
lea rdx, [rbp + 0x22b8]
mov rcx, rax
call fcn.1400f1dab
mov rcx, qword [rbp + 0x2048]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0x2c14], 1
lea rcx, [rbp + 0x2548]
call fcn.1400ef8f3
nop
lea rcx, [rbp + 0x22b8]
call fcn.1400f165d
movzx eax, byte [rbp + 0x2c14]
jmp 0x14011ad12
jmp 0x14011abe1
lea rcx, [rbp + 0x2548]
call fcn.1400ef8f3
jmp 0x14011ab32
lea rcx, [rbp + 0x22b8]
call fcn.1400f165d
mov rcx, qword [rbp + 0x2048]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rbp + 0x2c78]
test eax, eax
jne 0x14011ad01
mov dword [rbp + 0x2c24], 1
jmp 0x14011ad0b
mov dword [rbp + 0x2c24], 0
movzx eax, byte [rbp + 0x2c24]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1402e0cb8]
call fcn.1400f1356
mov rax, rdi
mov rcx, qword [rbp + 0x2c30]
xor rcx, rbp
call fcn.1400eea70
lea rsp, [rbp + 0x2c48]
pop rdi
pop rbp
ret