Function at 0x18009f1b0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x678]
sub rsp, 0x778
mov r13, rcx
xor r15d, r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov edi, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x70], r15
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x10], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0xc]
call fcn.1800bcb60
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18009f2fe
nop dword [rax]
mov r9, qword [rsp + 0x68]
cmp r9, rdi
je 0x18009f2ce
mov rcx, r9
lea rax, [rbp - 0x10]
mov edx, 4
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18009f250
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
mov qword [rsp + 0x68], r9
jmp 0x18009f2e4
lea r8, [rbp - 0x10]
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.1800a4820
mov rdi, qword [rsp + 0x70]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18009f230
mov qword [rsp + 0x58], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
cmp rbx, rsi
je 0x18009f4c0
mov r9, rbx
mov r8, rsi
sub r8, 0x238
cmp r9, r8
je 0x18009f4c0
mov rax, r9
lea rcx, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18009f340
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r9
mov rax, r8
mov edx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18009f3c0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rcx, r8
lea rax, [rbp + 0x230]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18009f440
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
add r9, 0x238
cmp r9, r8
jne 0x18009f320
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov dword [rbp + 0x6d0], eax
mov r14, rbx
mov qword [rbp + 0x6d8], rbx
cmp rbx, rsi
je 0x18009f993
mov eax, dword [r14 + 8]
cmp eax, ecx
je 0x18009f970
mov qword [rsp + 0x50], 0xffffffffffffffff
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x60], 0x30
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x60]
mov edx, 0x1fffff
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov rdi, qword [rsp + 0x50]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18009f96a
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rsp + 0x78]
lea edx, [r9 + 0x12]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jne 0x18009f96a
cmp qword [rsp + 0x78], 0
je 0x18009f96a
mov edx, dword [r14 + 8]
lea ecx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x18009f96a
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xor edi, edi
mov r12d, edi
mov qword [rbp - 0x70], rdi
mov dword [rbp + 0x230], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 0x234]
call fcn.1800bcb60
xor r13b, r13b
lea rdx, [rbp + 0x230]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
mov r15, qword [rbp - 0x78]
test eax, eax
je 0x18009f8d7
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x460]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18009f610
lea rdx, [rbp + 0x460]
lea rcx, [rsp + 0x30]
call fcn.180006af0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.18009d6c0
nop
mov rdx, r15
cmp r15, r12
je 0x18009f6dd
lea rax, [rbp + 0x230]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x18009f660
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rcx, qword [rax + 0x30]
mov qword [rdx + 0x30], rcx
add r15, 0x438
mov qword [rbp - 0x78], r15
jmp 0x18009f6f5
lea r8, [rbp + 0x230]
lea rcx, [rbp - 0x80]
call fcn.1800a4ab0
mov r12, qword [rbp - 0x70]
mov r15, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
test r13b, r13b
jne 0x18009f875
movups xmm0, xmmword [str.FGPD]
movups xmmword [rsp + 0x30], xmm0
mov ecx, dword [0x18015b580]
mov dword [rsp + 0x40], ecx
movzx eax, word [0x18015b584]
mov edx, 0x75
mov word [rsp + 0x30], dx
xor word [rsp + 0x32], 0x34
xor word [rsp + 0x34], 0x35
xor word [rsp + 0x36], 0x36
xor word [rsp + 0x38], 0x37
xor word [rsp + 0x3a], 0x38
xor word [rsp + 0x3c], 0x39
xor word [rsp + 0x3e], 0x3a
xor cx, 0x3b
mov word [rsp + 0x40], cx
xor word [rsp + 0x42], 0x3c
xor ax, 0x3d
mov word [rsp + 0x44], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18009f780
lea rcx, [rbp - 0x60]
cmp rdi, 8
setae r14b
cmovae rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rsi, qword [rbp - 0x50]
mov rdx, rsi
call fcn.1800134a0
cmp rax, 0xffffffffffffffff
je 0x18009f86e
movups xmm0, xmmword [str._MFAXO]
movups xmmword [rsp + 0x30], xmm0
movzx eax, word [0x18015b6e0]
mov ecx, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x30], cx
xor word [rsp + 0x32], 0x34
xor word [rsp + 0x34], 0x35
xor word [rsp + 0x36], 0x36
xor word [rsp + 0x38], 0x37
xor word [rsp + 0x3a], 0x38
xor word [rsp + 0x3c], 0x39
xor word [rsp + 0x3e], 0x3a
xor ax, 0x3b
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18009f820
lea rcx, [rbp - 0x60]
test r14b, r14b
cmovne rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
call fcn.1800134a0
mov r14, qword [rbp + 0x6d8]
cmp rax, 0xffffffffffffffff
je 0x18009f875
mov r13b, 1
mov rcx, qword [rbp + 0x6c8]
test rcx, rcx
je 0x18009f875
mov eax, dword [r14 + 8]
mov dword [rcx], eax
jmp 0x18009f875
mov r14, qword [rbp + 0x6d8]
cmp rdi, 8
jb 0x18009f8b0
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18009f8a8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009fa91
mov rcx, rbx
call fcn.1800b9f6c
lea rdx, [rbp + 0x230]
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
mov edi, 0
jne 0x18009f5f0
mov rsi, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbp - 0x80]
movabs r9, 0x795ceb240795ceb3
test r13b, r13b
je 0x18009f917
mov rcx, r15
sub rcx, r8
mov rax, r9
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 5
jae 0x18009fa12
test r8, r8
je 0x18009f967
sub r12, r8
mov rax, r9
imul r12
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x438
mov rax, r8
cmp rdx, 0x1000
jb 0x18009f95f
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009fa7f
mov rcx, r8
call fcn.1800b9f6c
xor r15d, r15d
mov ecx, dword [rbp + 0x6d0]
add r14, 0x238
mov qword [rbp + 0x6d8], r14
cmp r14, rsi
jne 0x18009f4e1
mov rbx, qword [rsp + 0x60]
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r15
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r15
test rbx, rbx
je 0x18009f9fb
mov rdx, qword [rsp + 0x58]
sub rdx, rbx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rbx
cmp rdx, 0x1000
jb 0x18009f9f3
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009fa8b
mov rcx, rbx
call fcn.1800b9f6c
mov rax, r13
add rsp, 0x778
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r13, qword [rbp + 0x6c0]
mov qword [r13], r8
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18009f9fb
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
movabs rax, 0x73615a240e6c2b45
imul rdx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x238
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009f9f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009fa85
jmp 0x18009f9f6
call fcn.1800c5e04
nop
call fcn.1800c5e04
int3
call fcn.1800c5e04
nop
call fcn.1800c5e04
int3