Function at 0x140001ea0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14007a180]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rdx
mov qword [rbp + 8], rdx
mov rsi, rcx
mov qword [rbp + 0x38], rcx
xor r15d, r15d
mov dword [rbp + 0x14], r15d
lea r9, [rbp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400023b6
mov ebx, dword [rbp + 0x58]
shr ebx, 3
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov qword [rbp + 0x90], r15
mov edx, ebx
test ebx, ebx
je 0x140001f2a
lea rcx, [rbp + 0x80]
call fcn.140009150
lea r8d, [rbx*8]
lea r9, [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400024a4
mov eax, dword [rbp + 0x58]
shr eax, 3
cmp ebx, eax
cmovae ebx, eax
mov r14d, ebx
mov qword [rbp + 0x18], r14
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
mov dword [rbp + 0x14], 1
mov qword [rbp + 0x98], r14
test ebx, ebx
je 0x140001f92
lea rdx, [rbp + 0x98]
mov rcx, rsi
call fcn.1400076f0
mov ebx, r15d
mov dword [rbp], ebx
test r14d, r14d
je 0x14000223f
mov r12, r15
nop dword [rax]
nop dword [rax + rax]
mov r9d, 0x104
lea r8, [rbp + 0x100]
mov rdx, qword [rbp + 0x80]
mov rdx, qword [rdx + r12]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x1400022b3
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r15
mov r8d, eax
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x60]
call fcn.1400079e0
nop
mov r9d, 0x18
lea r8, [rbp + 0x40]
mov rdx, qword [rbp + 0x80]
mov rdx, qword [rdx + r12]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x14000259e
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
lea r14, [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0xf
seta byte [rbp + 0x10]
mov r15, qword [rbp + 0x60]
cmova r14, r15
mov rdi, qword [rbp + 0x70]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140002598
cmp rdi, 0xf
ja 0x140002091
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0xc0], xmm0
jmp 0x140002135
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x1400020b0
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400020d7
cmp rbx, 0x16
mov eax, reloc.WS2_32.dll_shutdown
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400020f9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002592
mov rcx, rax
call fcn.1400583c0
mov rcx, rax
test rax, rax
je 0x140002231
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002107
test rcx, rcx
je 0x140002105
call fcn.1400583c0
jmp 0x140002107
xor eax, eax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp + 0xc0]
mov ebx, dword [rbp]
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0xe0], rcx
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x14000217a
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [rdx + 0x10], xmm0
mov qword [rbp + 0xd0], 0
mov eax, reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov qword [rdx + 0x20], rcx
add qword [rsi + 8], 0x28
jmp 0x140002190
lea r8, [rbp + 0xc0]
mov rcx, rsi
call fcn.1400092b0
mov rax, qword [rbp + 0xd8]
cmp rax, 0xf
jbe 0x1400021c7
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002231
call fcn.140058714
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
cmp byte [rbp + 0x10], 0
je 0x140002217
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000220f
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002238
mov rcx, r15
call fcn.140058714
inc ebx
mov dword [rbp], ebx
add r12, 8
cmp ebx, dword [rbp + 0x18]
jae 0x14000223f
mov rdi, qword [rbp + 8]
xor r15d, r15d
jmp 0x140001fb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x140002286
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002281
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002281
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058714
mov rax, rsi
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140058280
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xe56eddfcc9b35b02
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa0], rcx
movabs rax, 0x64e094d38cf6a463
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa8], rcx
movabs rax, 0x42bd32796bd64bc2
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xb0], rcx
movabs rcx, 0x91644784dc0c7330
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0x891bb99384c73e45
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x981dab6ff97e606
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0x42bd32796bd64ba7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
vzeroupper
call fcn.140001850
lea rdx, [0x140077130]
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xea74cbc3e9b25000
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
movabs rax, 0x65f4bed9b2e49563
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
movabs rax, 0x42bd32796bd638c2
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
movabs rcx, 0x91644784dc0c7330
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x891bb99384c73e45
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x981dab6ff97e606
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x42bd32796bd64ba7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140001850
lea rdx, [0x140077130]
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xea74cbc3e9b25000
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
movabs rax, 0x65f4bed9b2e49563
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
movabs rax, 0x42bd32796bd638c2
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
movabs rcx, 0x91644784dc0c7330
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x891bb99384c73e45
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x981dab6ff97e606
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x42bd32796bd64ba7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140001850
lea rdx, [0x140077130]
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140001580
int3
call fcn.140001630
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xe56eddfcc9b35b02
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa0], rcx
movabs rax, 0x68eca8d999f9af63
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa8], rcx
movabs rax, 0x42bd327905b922d3
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xb0], rcx
movabs rcx, 0x91644784dc0c7330
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0x891bb99384c73e45
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x981dab6ff97e606
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0x42bd32796bd64ba7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
vzeroupper
call fcn.140001850
lea rdx, [0x140077130]
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3