Function at 0x14008c3a0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
nop
push 0x67546a5b
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
jmp 0x14008c755
lea rax, [rbp - 0x40]
nop
movabs r8, 0xffffffff1109c231
xor r8, 0x6d3afcac
sub r8, 0x52348242
add r8, 0x25217fca
sub r8, 0x4f024c51
jmp 0x14008c5ea
xor edx, edx
mov r8d, 0x52c37f70
add r8d, 0x2c361db1
sub r8d, 0x58b63dc1
add r8d, 0x3494e05d
jmp 0x14008c72e
xor edi, edi
mov r14d, edi
mov dword [rsp + 0x20], edi
mov dword [rsp - 0x14], 0xa884f52
lea rdx, [rbp - 0x70]
xchg rcx, r8
jmp 0x14008c4f0
mov r13, qword [rsp + 0x60]
mov r15, qword [rsp + 0x48]
mov rsi, qword [r12]
jmp 0x14008c696
xor ecx, 0x5771f9cc
add ecx, 0x31336121
xor ecx, 0x2587c3d5
add ecx, 0x1fc7fa7
xor ecx, 0x286cf481
sub ecx, 0x170242e7
jmp 0x14008c795
mov dword [rsp - 0x34], 0x72d5126
jb 0x14008c479
mov r12, qword [rsi]
cmp r14, 0x10
mov dword [rsp - 0x44], 0x711f0586
jae 0x14008c7f0
jmp 0x14008c70f
xor qword [rsp + 0x60], 0x372d6b2
xor qword [rsp + 0x60], 0x41072ef5
add qword [rsp + 0x60], 0x1b41724d
add qword [rsp + 0x60], 0xf4fa1a8
add qword [rsp + 0x60], 0x172c3f64
sub qword [rsp + 0x60], 0x7482b4d7
jmp 0x14008c777
call fcn.1400197b0
mov dword [rsp - 0x2c], 0x7715171a
nop
lea rdi, [rsp + 0x48]
mov r15, qword [rsp + 0x48]
xchg rbx, rbx
mov r13, qword [rsp + 0x60]
jmp 0x14008c5cb
mov r8, rbx
xchg rcx, r8
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x14008cb5a
jmp 0x14008c7b0
mov byte [rbx + rdi], al
inc rbx
cmp rbx, rsi
xchg r15, r15
jne 0x14008c630
jmp 0x14008c42c
mov dword [rsp - 0xc], 0x222943d
mov rbx, qword [rsp + 0x68]
jmp 0x14008c939
sub rsp, 0x2e0
mov rax, qword [0x1402567f0]
xor rax, rsp
jmp 0x14008c606
mov r14, r8
xchg r14, r12
xchg r8, r10
mov qword [rsp + 0x30], r10
xchg r8, r10
jmp 0x14008c580
mov qword [rsp - 8], r12
sub rsp, 8
push r13
mov r8, r8
jmp 0x14008c641
mov r8, rsi
xchg r12, r8
cmp qword [rsi + 0x18], 0x10
jmp 0x14008c468
xchg r15, r8
mov qword [rsp + 0x40], r15
xchg r15, r8
mov ecx, 0x418200e7
jmp 0x14008c43f
add dword [rbp - 0x70], 0x5fbe6a90
sub dword [rbp - 0x70], 0x63446015
xor dword [rbp - 0x70], 0x71db3c4e
sub dword [rbp - 0x70], 0x685be45d
xor dword [rbp - 0x70], 0x79020734
sub dword [rbp - 0x70], 0x6afd06c9
sub dword [rbp - 0x70], 0x19d34c6
jmp 0x14008c40f
cmp r13, 0x10
cmovae rdi, r15
mov dword [rsp - 0x2c], esp
lea rcx, [rsp + 0x48]
cmovae rcx, r15
mov rsi, qword [rsp + 0x58]
jmp 0x14008c75f
add r8, 0x7fffffff
add r8, 0x7fe2102c
nop word [rax + rax]
jmp 0x14008c65a
xchg r13, r13
xchg r13, rax
mov qword [rbp + 0x1d0], r13
xchg r13, rax
xchg r14, r12
jmp 0x14008c547
cmp rbx, rsi
xchg r10, r10
je 0x14008c436
sub rdi, rbx
jmp 0x14008c630
movsx ecx, byte [rbx]
mov dword [rsp - 0x40], esp
call fcn.1400b61f0
jmp 0x14008c508
push r14
push r15
lea rbp, [rsp - 0x1e0]
mov dword [rsp - 0x28], 0x42ff7ec9
jmp 0x14008c531
mov dword [rsp - 0x34], edx
inc r8
cmp byte [rax + r8], 0
jne 0x14008c65e
jmp 0x14008c671
mov rdi, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x48]
jmp 0x14008c4cb
xor byte [rsp + 0x48], 0x55
add byte [rsp + 0x48], 2
xor byte [rsp + 0x48], 0x18
jmp 0x14008c3bd
mov rbx, rbx
mov rax, qword [r12 + 8]
mov qword [rsp + 0x28], rax
cmp rsi, rax
mov dword [rsp - 0x18], 0x6a1e40a8
je 0x14008ca26
nop word [rax + rax]
jmp 0x14008c7cb
xor qword [rbp - 0x80], 0x7348fb45
xor qword [rbp - 0x80], 0x8b82e13
xchg r14, r10
mov r10, qword [rsi + 0x10]
xchg r10, r14
xchg r12, r8
jmp 0x14008c570
add edi, 0xe6a8be3
sub edi, 0x28cbec6d
xor edi, 0x21d8fa49
add edi, 0x578756a7
sub edi, 0x602b669b
sub edi, 0x113093e3
lea rdx, [rsp + 0x68]
jmp 0x14008c51f
xchg r12, rbp
movups xmm0, xmmword [rbp]
xchg r12, rbp
xchg rsp, r11
movups xmmword [r11 + 0x68], xmm0
xchg rsp, r11
mov edi, 0x526dba39
jmp 0x14008c6e1
sub r8d, 0x5499511d
sub r8d, 0x63eec6c
lea rcx, [rbp - 0x6c]
mov dword [rsp - 0x3c], ecx
call fcn.1400ebfc0
mov dword [rbp - 0x70], 0xfb518a3
jmp 0x14008c595
push rdi
xchg r10, r10
nop
jmp 0x14008c55d
add rsi, rcx
mov r12, r12
lea rbx, [rsp + 0x48]
cmp r13, 0x10
cmovae rbx, r15
jmp 0x14008c61c
mov byte [rsp + 0x48], 0x76
xor byte [rsp + 0x48], 0x7c
add byte [rsp + 0x48], 0x39
xor byte [rsp + 0x48], 0x2c
sub byte [rsp + 0x48], 0x2c
jmp 0x14008c682
sub ecx, 0x30efaad2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x38], rax
mov r15, r15
jmp 0x14008c3ed
mov r8, r8
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 0x70b099ca
jmp 0x14008c490
mov qword [rbp - 0x80], 0x24604cb1
add qword [rbp - 0x80], 0x306dff93
sub qword [rbp - 0x80], 0x88198f3
xor qword [rbp - 0x80], 0x37bc6607
jmp 0x14008c6bf
xchg rdi, r12
mov r12, r14
xchg r12, rdi
or rdi, 0xf
movabs rax, 0x7fffffff1d248ab3
add rax, 0xb89a04c
xor rax, 0x25c482d7
jmp 0x14008c818
add rax, 0x138912bd
add rax, 0x325a745
add rax, 0x48d16809
sub rax, 0x44e52ca
jmp 0x14008c883
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14008c8c9
mov dword [rsp - 0x38], 0xed29182
jmp 0x14008c85a
xchg rcx, rax
jmp 0x14008c8e5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14008cc1c
jmp 0x14008c89e
mov dword [rsp - 0x40], 0x6d938737
je 0x14008cc22
lea rbx, [rax + 0x27]
jmp 0x14008c8b6
add rax, 0x7fffffff
add rax, 0x17638897
cmp rdi, rax
cmova rdi, rax
mov r15, r15
jmp 0x14008c835
mov dword [rsp - 0x34], 0x4bd193f
mov rcx, rax
call fcn.1400e9714
test rax, rax
jmp 0x14008c86c
and rbx, 0xffffffffffffffe0
mov dword [rsp - 0x18], esi
xchg rcx, rax
mov qword [rbx - 8], rcx
jmp 0x14008c853
test rcx, rcx
je 0x14008c8e3
call fcn.1400e9714
mov dword [rsp - 0xc], ebx
mov rbx, rax
jmp 0x14008c8e5
xor ebx, ebx
xchg rbx, rdi
mov qword [rsp + 0x68], rdi
xchg rdi, rbx
jmp 0x14008c9b3
jne 0x14008c9d5
call fcn.1400ec510
test eax, eax
jmp 0x14008c9c2
mov dword [rsp - 0x20], 0x7329a444
cmp r13, 0x10
cmovae rcx, r15
mov r8, qword [rsp + 0x58]
mov dword [rsp - 0x1c], edx
cmp r8, r14
jmp 0x14008c8f5
cmovae rdx, rbx
xchg r13, r10
mov r10, qword [rsp + 0x60]
jmp 0x14008c96c
xchg rdi, r11
mov qword [rbp - 0x80], r11
xchg rdi, r11
xchg rcx, r14
mov qword [rsp + 0x78], rcx
xchg r14, rcx
lea rcx, [rsp + 0x48]
jmp 0x14008c907
sub cl, 0x53
add cl, 0x4e
add cl, 0xc
add cl, 4
sub cl, 0x47
jmp 0x14008c97c
xchg r13, r10
mov r15, qword [rsp + 0x48]
mov rbp, rbp
jmp 0x14008c939
xor cl, 0x3e
sub cl, 0xd
jmp 0x14008c9d7
xchg rdx, rbx
xchg r12, rcx
mov r12, rbx
jmp 0x14008c995
xchg r12, rcx
call fcn.1400eb910
lea rdx, [rsp + 0x68]
cmp rdi, 0x10
mov dword [rsp - 0x14], 0x45a2cd07
jmp 0x14008c928
lea r8, [r14 + 1]
xchg rdx, rbx
mov rbx, r12
jmp 0x14008c987
xchg rsp, rsp
jne 0x14008c9d5
mov cl, 4
xor cl, 0x68
jmp 0x14008c958
xor cl, cl
mov r14d, dword [rsp + 0x20]
xchg r12, r12
lea eax, [r14 + 1]
test cl, cl
jmp 0x14008cb04
xchg rdx, rbx
mov rdx, qword [rsp + 0x38]
xchg rbx, rdx
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
jmp 0x14008ca3e
cmp rdi, 0x10
jb 0x14008ca86
mov dword [rsp - 0x2c], edx
lea rdx, [rdi + 1]
xchg rbx, r8
jmp 0x14008cac9
mov r12, qword [rsp + 0x30]
mov dword [rsp - 0x1c], ecx
cmp r13, 0x10
jb 0x14008cafb
lea rdx, [r13 + 1]
xchg r9, rax
mov r9, r15
jmp 0x14008cb2e
call sub.KERNEL32.dll_Module32Next
mov dword [rsp - 0x44], 0x7c9804c5
test eax, eax
je 0x14008cb5a
xor edi, edi
jmp 0x14008c7b3
mov rbx, qword [rbx - 8]
sub rax, rbx
mov dword [rsp - 0x24], 0x1378a76a
jmp 0x14008ca8c
call fcn.1400e9750
xchg rsp, rsp
mov r13, qword [rsp + 0x60]
xchg r15, r12
mov r12, qword [rsp + 0x48]
xchg r15, r12
nop
jmp 0x14008caab
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
xchg r11, r11
ja 0x14008cc22
mov rcx, rbx
jmp 0x14008ca6e
sub rsi, 0x6c726c05
add rsi, 0x6c726c25
cmp rsi, qword [rsp + 0x28]
jne 0x14008c7cb
jmp 0x14008ca1d
mov rax, r8
xchg rbx, r8
cmp rdx, 0x1000
jb 0x14008caa3
nop
add rdx, 0x66ef3a13
sub rdx, 0x66ef39ec
jmp 0x14008ca5a
xchg r13, r13
mov rcx, r15
call fcn.1400e9750
lea rdx, [rbp - 0x70]
jmp 0x14008c9ea
cmove eax, r14d
mov dword [rsp - 0x34], ebp
mov r14d, eax
mov dword [rsp + 0x20], eax
jmp 0x14008ca03
sub rax, r15
sub rax, 8
cmp rax, 0x1f
ja 0x14008cc0e
jmp 0x14008caf0
xchg r9, rax
cmp rdx, 0x1000
mov dword [rsp - 0x18], 0x4fc75a3d
jb 0x14008caf3
add rdx, 0x27
mov r15, qword [r15 - 8]
mov dword [rsp - 0x28], 0x17f6147f
jmp 0x14008cb18
xchg r12, rcx
mov r12, rbx
xchg rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp - 0x3c], 0x5f2e12de
jmp 0x14008cc02
call fcn.1400e9870
mov rbx, qword [rsp + 0x320]
add rsp, 0x6e6fc8fa
sub rsp, 0x6e6fc61a
jmp 0x14008cba9
xchg r12, rcx
call 0x140091640
mov eax, r14d
xchg rcx, r9
jmp 0x14008cbc0
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
jmp 0x14008cbda
mov r9, qword [rbp + 0x1d0]
xchg r9, rcx
xor rcx, rsp
mov r9, r9
jmp 0x14008cb76
add rsp, 8
ret
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
pop rdi
mov rsi, rsi
nop
jmp 0x14008cbf0
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
jmp 0x14008cbd5
nop
xchg r12, rcx
mov r12, rcx
jmp 0x14008cb96
call fcn.1400f040c
nop
mov dword [rsp - 0x40], 0x4801ab28
call fcn.14000e6d0
int3
call fcn.1400f040c
int3