Function at 0x1400d3cfa
Capabilities:
Enumerate process modules

Disassembly:
push rax
pushf
mov eax, 0x21675fec
pushf
not eax
add eax, 0x9aa90d27
xor eax, 0xbe68df23
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xcab42aed
xor eax, 0xe7b70261
rol eax, 0x47
popf
pushf
not eax
add eax, 0x9daa1479
xor eax, 0x843729f7
rol eax, 0x83
popf
cmp eax, 4
jne 0x1400d3d4a
popf
pop rax
jmp 0x1400d4155
cmp eax, 0
jne 0x1400d3d59
popf
pop rax
jmp 0x1400d3de0
cmp eax, 3
jne 0x1400d3d68
popf
pop rax
jmp 0x1400d40f5
cmp eax, 1
jne 0x1400d3d77
popf
pop rax
jmp 0x1400d3f95
cmp eax, 0xa
jne 0x1400d3d86
popf
pop rax
jmp 0x1400d43ff
cmp eax, 7
jne 0x1400d3d95
popf
pop rax
jmp 0x1400d426e
cmp eax, 6
jne 0x1400d3da4
popf
pop rax
jmp 0x1400d421d
cmp eax, 2
jne 0x1400d3db3
popf
pop rax
jmp 0x1400d4071
cmp eax, 9
jne 0x1400d3dc2
popf
pop rax
jmp 0x1400d437a
cmp eax, 8
jne 0x1400d3dd1
popf
pop rax
jmp 0x1400d4317
cmp eax, 5
jne 0x1400d3de0
popf
pop rax
jmp 0x1400d4210
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x8261770
pushf
not eax
add eax, 0xd743bdc9
xor eax, 0xf07395c0
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xd5b2e26c
xor eax, 0xe467ea87
rol eax, 0x25
popf
pushf
not eax
add eax, 0xdd205ebe
xor eax, 0x8259d02c
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xb14cefe3
xor eax, 0xcd5bd1da
rol eax, 0x4c
popf
call fcn.1401399f7
sub rsp, rax
mov rax, qword [0x14004b090]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rdi, rdx
mov qword [rsp + 0x28], rdx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], rcx
mov qword [rdx + 8], rcx
mov qword [rdx + 0x10], rcx
mov dword [rsp + 0x20], 1
jmp 0x1400d3e83
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0xb356b8de
pushf
not ecx
add ecx, 0xf7ac514e
xor ecx, 0xd017ea99
rol ecx, 0x4f
popf
pushf
not ecx
add ecx, 0xa1ba3d94
xor ecx, 0xeb0c068f
rol ecx, 0xdc
popf
pushf
not ecx
add ecx, 0xc1c455f6
xor ecx, 0x93200334
rol ecx, 0xae
popf
pushf
not ecx
add ecx, 0xd926cc03
xor ecx, 0x8f9ead56
rol ecx, 0x75
popf
jmp 0x1400d3ee8
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x1400d3f4f
push rax
pushf
mov eax, 0xcb22fe0c
pushf
not eax
add eax, 0xeec1fa49
xor eax, 0xe8657856
rol eax, 0xff
popf
pushf
not eax
add eax, 0x970b077a
xor eax, 0x8b0a6e49
rol eax, 0x59
popf
pushf
not eax
add eax, 0xa56c4c2d
xor eax, 0xdc08b3c9
rol eax, 0x11
popf
pushf
not eax
add eax, 0xb2661741
xor eax, 0x96256b5f
rol eax, 0xef
popf
jmp 0x1400d3d3b
push rax
pushf
mov eax, 0x82326f34
pushf
not eax
add eax, 0xcc1c1b11
xor eax, 0x8d37c72e
rol eax, 0xf7
popf
pushf
not eax
add eax, 0xa7b37c68
xor eax, 0xe444abd0
rol eax, 0x25
popf
pushf
not eax
add eax, 0xd34b8681
xor eax, 0x9096aad7
rol eax, 0xbc
popf
jmp 0x1400d3d3b
lea r9, [rsp + 0x30]
mov r8d, 0x4fc905a2
pushf
not r8d
add r8d, 0xe1819c21
xor r8d, 0xa3c3f179
rol r8d, 0x30
popf
pushf
not r8d
add r8d, 0xac18b089
xor r8d, 0xc5117e0d
rol r8d, 0x6e
popf
lea rdx, [rsp + 0x40]
mov rcx, rax
jmp 0x1400d3fdb
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400d402b
push rax
pushf
mov eax, 0x75a9d83
pushf
not eax
add eax, 0xb2be2120
xor eax, 0xd1f776ae
rol eax, 0x30
popf
pushf
not eax
add eax, 0xc994d19a
xor eax, 0xbd6c0f8e
rol eax, 0xa2
popf
pushf
not eax
add eax, 0x96927999
xor eax, 0xf2591769
rol eax, 0xe0
popf
jmp 0x1400d3d3b
push rax
pushf
mov eax, 0x8d6b3798
pushf
not eax
add eax, 0x95346cb5
xor eax, 0xaba8b9dd
rol eax, 4
popf
pushf
not eax
add eax, 0xb2b44f26
xor eax, 0xb908332f
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x88b472a4
xor eax, 0xd8981d10
rol eax, 0x50
popf
jmp 0x1400d3d3b
mov eax, dword [rsp + 0x30]
shr eax, 3
test eax, eax
je 0x1400d40c2
push rax
pushf
mov eax, 0xc568f507
pushf
not eax
add eax, 0xff7cd88b
xor eax, 0xe8d94aab
rol eax, 0xce
popf
pushf
not eax
add eax, 0xa63038d1
xor eax, 0xecf685a6
rol eax, 0xed
popf
pushf
not eax
add eax, 0xc233cf20
xor eax, 0xb1cccc3d
rol eax, 0x8c
popf
jmp 0x1400d3d3b
push rax
pushf
mov eax, 0x7e76e46a
pushf
not eax
add eax, 0x8abc0196
xor eax, 0xca4dc4ce
rol eax, 0xe
popf
pushf
not eax
add eax, 0xb94d78c3
xor eax, 0x82d00740
rol eax, 0x71
popf
jmp 0x1400d3d3b
lea rbx, [rsp + 0x40]
mov esi, eax
push rax
pushf
mov eax, 0x4424563b
pushf
not eax
add eax, 0x9327d580
xor eax, 0xe411299b
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xea97cac3
xor eax, 0xc4cc8096
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xe29bcecf
xor eax, 0xcbed2c20
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xc4b523cb
xor eax, 0xdefd2af2
rol eax, 0x7c
popf
jmp 0x1400d3d3b
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x1400d41b8
push rax
pushf
mov eax, 0xb57bae16
pushf
not eax
add eax, 0x83dab69e
xor eax, 0xa9917172
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xf25bb202
xor eax, 0xd8d869a2
rol eax, 0x35
popf
pushf
not eax
add eax, 0x9a6c19d2
xor eax, 0xe115513c
rol eax, 4
popf
pushf
not eax
add eax, 0xef9d8bd2
xor eax, 0xc406af1d
rol eax, 0xd0
popf
jmp 0x1400d3d3b
push rax
pushf
mov eax, 0x878d782e
pushf
not eax
add eax, 0xa4059439
xor eax, 0x8343e081
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xad887406
xor eax, 0xc190d4c6
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xf63e81a0
xor eax, 0xb529019b
rol eax, 0x46
popf
pushf
not eax
add eax, 0xc991c79d
xor eax, 0xcd00eef5
rol eax, 1
popf
jmp 0x1400d3d3b
mov rax, qword [rbx]
mov qword [rdx], rax
add qword [rdi + 8], 8
jmp 0x1400d426e
mov r8, rbx
mov rcx, rdi
call fcn.14017af74
push rax
pushf
mov eax, 0xa5faf12
pushf
not eax
add eax, 0xe059c08d
xor eax, 0xbde9b538
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xcfc2a596
xor eax, 0xcb1c2ce0
rol eax, 0x4a
popf
pushf
not eax
add eax, 0x94cb8c5e
xor eax, 0x9adbfcc9
rol eax, 0xfb
popf
jmp 0x1400d3d3b
add rbx, 8
sub rsi, 1
jne 0x1400d42d1
push rax
pushf
mov eax, 0x8c00bd43
pushf
not eax
add eax, 0x944b1e5c
xor eax, 0xd821a621
rol eax, 0x73
popf
pushf
not eax
add eax, 0x87e2dfc5
xor eax, 0x9daac731
rol eax, 0x40
popf
pushf
not eax
add eax, 0x98aa1b7a
xor eax, 0xf8496965
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x8a60a8f8
xor eax, 0xfbe76305
rol eax, 0xfe
popf
jmp 0x1400d3d3b
push rax
pushf
mov eax, 0x596cad5f
pushf
not eax
add eax, 0xd9cac6d6
xor eax, 0x9ce68b20
rol eax, 0x25
popf
pushf
not eax
add eax, 0xe49972ba
xor eax, 0x9c9e90f0
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xd62d0d4f
xor eax, 0x9fa43f9e
rol eax, 0xbf
popf
jmp 0x1400d3d3b
mov rcx, rbp
jmp 0x1400d431b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x94bf0cba
pushf
not eax
add eax, 0xdf6118eb
xor eax, 0x83ae7a3b
rol eax, 0x38
popf
pushf
not eax
add eax, 0x87bacd16
xor eax, 0xa6ec2f66
rol eax, 0x21
popf
pushf
not eax
add eax, 0x9c8f2348
xor eax, 0xb0ac559b
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xbad23a05
xor eax, 0xd072570f
rol eax, 0x7e
popf
jmp 0x1400d3d3b
mov rax, rdi
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14012cd5d
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
int3