Function at 0x140001000
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x308
mov ecx, 1
mov edx, 1
call fcn.140001df8
test rax, rax
je 0x14000177c
mov r13, rax
mov byte [rax], 0
lea rcx, [0x14000a370]
mov edx, 0xa
call fcn.1400054c1
test rax, rax
je 0x140001069
mov rdi, rax
mov ecx, 1
mov rdx, rax
call fcn.140005a44
test eax, eax
je 0x140001834
mov eax, eax
add rdi, rax
jmp 0x1400014e7
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
lea rdi, [rsp + 0x50]
and qword [rdi], 0
mov qword [rdi + 8], 8
and qword [rdi + 0x10], 0
lea rbx, [rsp + 0x90]
and dword [rbx], 0
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov esi, 8
xor r15d, r15d
lea r8d, [r14*8]
mov dword [rsp + 0x20], 3
mov rdx, rsi
mov r9, rbx
call sub.psapi.dll_EnumProcessModulesEx
test eax, eax
je 0x14000177e
mov r12d, dword [rsp + 0x90]
cmp r12d, r15d
jbe 0x140001136
mov r15, r12
mov rax, r12
sub r15, r14
jbe 0x140001121
mov r9d, 8
mov rcx, rdi
mov rdx, r14
mov r8, r15
call fcn.1400083a1
mov rsi, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
lea rcx, [rsi + rax*8]
mov edx, 1
cmp rdx, r15
jae 0x14000111a
and qword [rcx], 0
inc rdx
add rcx, 8
inc rax
jmp 0x140001105
and qword [rcx], 0
inc rax
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x28]
mov r14, rax
mov r15d, r12d
jmp 0x1400010a3
mov edi, r12d
shr edi, 3
cmp r14, rdi
jb 0x14000177c
mov ebp, eax
mov qword [rsp + 0x20], 0x10
lea rbx, [rsp + 0x100]
mov r9d, 8
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.140001e9f
cmp dword [rbx], 1
je 0x14000177c
lea rbx, [rsp + 0x100]
movups xmm0, xmmword [rbx + 8]
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
mov r9d, 0x10
mov rcx, rbx
xor edx, edx
mov r8, rdi
call fcn.1400083a1
mov r14, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
cmp r12d, 8
jb 0x1400011df
mov rax, rbx
shl rax, 4
add rax, r14
add rax, 8
lea ecx, [rdi*8]
add rbx, rdi
xor edx, edx
lea r8, [rsp + 0x28]
mov r9, qword [rsi + rdx]
mov qword [rax + rdx*2 - 8], r8
mov qword [rax + rdx*2], r9
add rdx, 8
cmp rcx, rdx
jne 0x1400011c9
mov qword [rsp + 0x78], r13
mov rdi, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
call fcn.140003938
test ebp, ebp
je 0x14000177c
lea rax, [rsp + 0x38]
and qword [rax], 0
mov qword [rax + 8], 8
and qword [rax + 0x10], 0
shl rbx, 4
add rbx, r14
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rbx
mov edi, 8
lea r15, [rsp + 0xc8]
lea r13, [0x14000d86a]
xor r12d, r12d
mov qword [rsp + 0x80], rbx
cmp r14, rbx
je 0x14000147c
lea rax, [r14 + 0x10]
mov qword [rsp + 0x30], rax
mov rbp, qword [r14]
mov rbx, qword [r14 + 8]
mov ecx, 1
mov rdx, rbx
call fcn.140005a44
test eax, eax
je 0x14000134b
mov esi, eax
mov r8d, 0x208
lea r14, [rsp + 0x100]
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp]
mov rdx, rbx
mov r8, r14
mov r9d, 0x104
call sub.psapi.dll_GetModuleBaseNameW
test eax, eax
je 0x140001794
cmp eax, 0x105
jae 0x14000177c
mov r8d, eax
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x100]
call fcn.140006b4a
mov r14, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa0]
mov rcx, r15
mov rdx, r14
call fcn.140007de1
lea rcx, [rsp + 0x58]
mov rdx, r15
call fcn.140001fcf
mov rcx, qword [rsp + 0x90]
mov rdx, r14
call fcn.140001e7d
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
mov edx, 4
lea rcx, str..exe.text
mov r8, rbp
call fcn.140005d66
test al, al
je 0x1400014a0
mov rcx, r14
mov rdx, rbp
call fcn.140001e7d
lea rcx, [rsp + 0x100]
mov rdx, rbx
call fcn.140006261
mov rcx, qword [rsp + 0x2f0]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x14000138c
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
call fcn.140001e7d
jmp 0x14000146a
mov qword [rsp + 0xc0], rcx
mov rsi, qword [rsp + 0x2f8]
imul r14, qword [rsp + 0x300], 0x28
xor ebp, ebp
cmp r14, rbp
je 0x14000145a
lea rax, [rsi + rbp]
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0xb0], rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov r8d, 8
mov rcx, r15
lea rdx, [rsp + 0x50]
call fcn.140002f50
cmp dword [rsp + 0xc8], 1
je 0x14000177c
mov r8, qword [rsp + 0xd0]
mov r9, qword [rsp + 0xd8]
mov edx, 5
mov rcx, r13
call fcn.140005d66
test al, al
je 0x140001451
cmp dword [rsp + 0x58], 1
jbe 0x140001451
cmp r12, qword [rsp + 0x38]
jne 0x140001445
lea rcx, [rsp + 0x38]
call fcn.1400058a5
mov rdi, qword [rsp + 0x40]
mov qword [rdi + r12*8], rbx
inc r12
mov qword [rsp + 0x48], r12
add rbp, 0x28
jmp 0x1400013a7
mov rcx, qword [rsp + 0xc0]
mov rdx, rsi
call fcn.140003d2f
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x80]
jmp 0x140001255
lea rcx, [rsp + 0xe0]
mov qword [rcx + 8], r14
call fcn.1400058dc
test r12, r12
je 0x140001843
mov rdx, qword [rsp + 0x40]
mov rdi, qword [rdx]
jmp 0x1400014ce
lea r15, [rsp + 0xe0]
mov rax, qword [rsp + 0x30]
mov qword [r15 + 8], rax
mov rcx, r14
mov rdx, rbp
call fcn.140001e7d
mov edi, esi
add rdi, rbx
mov rcx, r15
call fcn.1400058dc
mov rdx, qword [rsp + 0x40]
mov r13, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call fcn.140003938
mov rcx, qword [rsp + 0x28]
call fcn.1400083c7
test rdi, rdi
je 0x14000185c
mov rbp, r13
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x100]
mov edx, 1
mov r9d, 1
mov rcx, rsi
mov r8b, 1
call fcn.140001e9f
cmp dword [rsi], 1
je 0x14000177c
lea rsi, [rsp + 0x100]
mov rbx, qword [rsi + 8]
mov r14, qword [rsi + 0x10]
and qword [rsp + 0xc8], 0
lea rdx, [0x14000d798]
mov r8d, 9
mov rcx, rsi
call fcn.14000411c
mov r15, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov rcx, r15
call fcn.140004265
mov r12, rax
mov rcx, qword [rsi]
mov rdx, r15
call fcn.140001e7d
lea rdx, [0x14000d813]
lea r15, [rsp + 0x100]
mov r8d, 0x13
mov rcx, r15
call fcn.14000411c
mov r13, qword [r15 + 8]
mov r8, qword [r15 + 0x10]
mov rcx, r12
mov rdx, r13
call fcn.140004766
mov rsi, rax
mov rcx, qword [r15]
mov rdx, r13
call fcn.140001e7d
test rsi, rsi
je 0x14000179b
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov rcx, 0xffffffffffffffff
mov rdx, rdi
mov r8, r14
call rsi
test eax, eax
jne 0x14000179b
lea rdx, [rsp + 0xe0]
mov qword [rdx], 1
lea r9, [rsp + 0x28]
and dword [r9], 0
lea rcx, [rsp + 0x88]
mov r8d, 4
call fcn.140004055
test eax, eax
jne 0x1400017b7
and qword [rsp + 0x90], 0
lea rdx, [0x14000d798]
lea rsi, [rsp + 0x100]
mov r8d, 9
mov rcx, rsi
call fcn.14000411c
mov r15, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov rcx, r15
call fcn.140004265
mov r12, rax
mov rcx, qword [rsi]
mov rdx, r15
call fcn.140001e7d
lea rdx, [0x14000d7d0]
lea r15, [rsp + 0x100]
mov r8d, 0x14
mov rcx, r15
call fcn.14000411c
mov r13, qword [r15 + 8]
mov r8, qword [r15 + 0x10]
mov rcx, r12
mov rdx, r13
call fcn.140004766
mov rsi, rax
mov rcx, qword [r15]
mov rdx, r13
call fcn.140001e7d
test rsi, rsi
je 0x1400016cf
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov rcx, 0xffffffffffffffff
mov rdx, rdi
mov r15, rbp
mov r8, rbp
call rsi
test eax, eax
sete sil
jmp 0x1400016d4
xor esi, esi
mov r15, rbp
lea rdx, [rsp + 0x50]
mov qword [rdx], 1
lea r9, [rsp + 0x38]
and dword [r9], 0
lea rcx, [rsp + 0x88]
mov r8d, 0x20
call fcn.140004055
test sil, sil
je 0x1400017e4
test eax, eax
jne 0x1400017fb
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], r14
mov qword [rsp + 0x110], 1
mov qword [rsp + 0x118], rdi
movabs rax, 0x8000000000000000
cmp rbx, rax
je 0x14000177c
mov rsi, qword [rsp + 0x108]
call qword [rsp + 0x118]
mov rcx, rbx
mov rdx, rsi
call fcn.140001e7d
mov ecx, 1
mov rdx, r15
call fcn.140001e7d
nop
add rsp, 0x308
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
call fcn.140006e0a
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
call fcn.140003938
ud2
call fcn.140006e0a
ud2
lea rcx, [rsp + 0x108]
lea rdx, [0x14000d942]
mov r8d, 0x17
call fcn.1400058f4
jmp 0x140001827
lea rsi, [rsp + 0x108]
lea rdx, [0x14000d91c]
mov r8d, 0x26
mov rcx, rsi
call fcn.1400058f4
movabs rax, 0x8000000000000000
mov qword [rsi - 8], rax
jmp 0x140001827
lea rcx, [rsp + 0x108]
lea rdx, [0x14000d901]
mov r8d, 0x1b
jmp 0x140001810
lea rcx, [rsp + 0x108]
lea rdx, [0x14000d8d8]
mov r8d, 0x29
call fcn.1400058f4
movabs rax, 0x8000000000000000
mov qword [rsp + 0x100], rax
mov rcx, rbx
mov rdx, r14
call fcn.140001e7d
ud2
lea rdx, [0x14000d86f]
mov r8d, 0x3a
jmp 0x140001869
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
call fcn.140003938
mov rcx, qword [rsp + 0x28]
call fcn.1400083c7
lea rdx, [0x14000d8a9]
mov r8d, 0x2f
lea rcx, [rsp + 0x108]
call fcn.1400058f4
ud2