Function at 0x140001ce0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rdx
mov qword [rbp + 8], rdx
mov rsi, rcx
mov qword [rbp + 0x38], rcx
xor r15d, r15d
mov dword [rbp + 0x14], r15d
lea r9, [rbp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400021f6
mov ebx, dword [rbp + 0x58]
shr ebx, 3
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov qword [rbp + 0x90], r15
mov edx, ebx
test ebx, ebx
je 0x140001d6a
lea rcx, [rbp + 0x80]
call fcn.140009930
lea r8d, [rbx*8]
lea r9, [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400022e4
mov eax, dword [rbp + 0x58]
shr eax, 3
cmp ebx, eax
cmovae ebx, eax
mov r14d, ebx
mov qword [rbp + 0x18], r14
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
mov dword [rbp + 0x14], 1
mov qword [rbp + 0x98], r14
test ebx, ebx
je 0x140001dd2
lea rdx, [rbp + 0x98]
mov rcx, rsi
call fcn.140008470
mov ebx, r15d
mov dword [rbp], ebx
test r14d, r14d
je 0x14000207f
mov r12, r15
nop dword [rax]
nop dword [rax + rax]
mov r9d, 0x104
lea r8, [rbp + 0x100]
mov rdx, qword [rbp + 0x80]
mov rdx, qword [rdx + r12]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x1400020f3
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r15
mov r8d, eax
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x60]
call fcn.1400088c0
nop
mov r9d, 0x18
lea r8, [rbp + 0x40]
mov rdx, qword [rbp + 0x80]
mov rdx, qword [rdx + r12]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x1400023de
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
lea r14, [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0xf
seta byte [rbp + 0x10]
mov r15, qword [rbp + 0x60]
cmova r14, r15
mov rdi, qword [rbp + 0x70]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x1400023d8
cmp rdi, 0xf
ja 0x140001ed1
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0xc0], xmm0
jmp 0x140001f75
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140001ef0
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140001f17
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001f39
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400023d2
mov rcx, rax
call fcn.14000c370
mov rcx, rax
test rax, rax
je 0x140002071
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001f47
test rcx, rcx
je 0x140001f45
call fcn.14000c370
jmp 0x140001f47
xor eax, eax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp + 0xc0]
mov ebx, dword [rbp]
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0xe0], rcx
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140001fba
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [rdx + 0x10], xmm0
mov qword [rbp + 0xd0], 0
mov eax, 0xf
mov byte [rbp + 0xc0], 0
mov qword [rdx + 0x20], rcx
add qword [rsi + 8], 0x28
jmp 0x140001fd0
lea r8, [rbp + 0xc0]
mov rcx, rsi
call fcn.140009a90
mov rax, qword [rbp + 0xd8]
cmp rax, 0xf
jbe 0x140002007
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002002
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002071
call fcn.14000c6c4
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], 0xf
mov byte [rbp + 0xc0], 0
cmp byte [rbp + 0x10], 0
je 0x140002057
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000204f
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002078
mov rcx, r15
call fcn.14000c6c4
inc ebx
mov dword [rbp], ebx
add r12, 8
cmp ebx, dword [rbp + 0x18]
jae 0x14000207f
mov rdi, qword [rbp + 8]
xor r15d, r15d
jmp 0x140001df0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x1400020c6
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400020c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000c6c4
mov rax, rsi
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.14000c350
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xa1220fba5f5d6142
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa0], rcx
movabs rax, 0xf7e7a1a1ff7ef20f
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa8], rcx
movabs rax, 0xb9dcfdc7e0781da2
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xb0], rcx
movabs rcx, 0xfa3566e770af73c
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0xcd576bd512290405
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x9a86efc48c1fb06a
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0xb9dcfdc7e0781dc7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
vzeroupper
call fcn.140001690
lea rdx, [0x1400112b8]
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xae3819857f5c6a40
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
movabs rax, 0xf6f38babc16cc30f
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
movabs rax, 0xb9dcfdc7e0786ea2
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
movabs rcx, 0xfa3566e770af73c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xcd576bd512290405
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x9a86efc48c1fb06a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xb9dcfdc7e0781dc7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140001690
lea rdx, [0x1400112b8]
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xae3819857f5c6a40
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
movabs rax, 0xf6f38babc16cc30f
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
movabs rax, 0xb9dcfdc7e0786ea2
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
movabs rcx, 0xfa3566e770af73c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xcd576bd512290405
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x9a86efc48c1fb06a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xb9dcfdc7e0781dc7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140001690
lea rdx, [0x1400112b8]
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.1400014c0
int3
call fcn.140001570
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movabs rax, 0xa1220fba5f5d6142
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa0], rcx
movabs rax, 0xfbeb9dabea71f90f
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xa8], rcx
movabs rax, 0xb9dcfdc78e1774b3
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xb0], rcx
movabs rcx, 0xfa3566e770af73c
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xb8], rax
movabs rax, 0xcd576bd512290405
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0x9a86efc48c1fb06a
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0xb9dcfdc7e0781dc7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
vzeroupper
call fcn.140001690
lea rdx, [0x1400112b8]
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3