Function at 0x18001aae0
Capabilities:
Enumerate process modules

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1060
call fcn.18002fad0
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1090], rbx
mov qword [rsp + 0x10a0], rbp
mov qword [rsp + 0x10a8], rsi
mov rax, qword [0x180050b58]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov r12, rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov edi, ebp
mov qword [rsp + 0x28], rbp
mov ebx, ebp
mov qword [rsp + 0x30], rbx
mov r13d, ebp
mov qword [rsp + 0x38], rbp
lea r8, [rsp + 0x20]
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x18001ab8c
mov qword [r12], rbp
mov qword [r12 + 8], rbp
mov qword [r12 + 0x10], rbp
lea rax, [rsp + 0x28]
cmp r12, rax
je 0x18001ab87
mov qword [r12], rbp
mov qword [r12 + 8], rbp
mov qword [r12 + 0x10], rbp
jmp 0x18001ad49
mov r15d, dword [rsp + 0x20]
shr r15d, 2
mov r14d, ebp
test r15d, r15d
je 0x18001ad13
lea rsi, [rsp + 0x50]
movabs rdx, 0x3ffffffffffffffe
movabs rax, 0x3fffffffffffffff
nop word [rax + rax]
cmp dword [rsi], 0
je 0x18001ace6
cmp rsi, rbx
jae 0x18001ac60
cmp rdi, rsi
ja 0x18001ac60
mov rbp, rsi
sub rbp, rdi
sar rbp, 2
cmp rbx, r13
jne 0x18001ac4e
mov rcx, rbx
sub rcx, rdi
sar rcx, 2
cmp rcx, rdx
ja 0x18001acf7
inc rcx
mov rdx, r13
sub rdx, rdi
sar rdx, 2
cmp rcx, rdx
jbe 0x18001ac44
mov r8, rdx
shr r8, 1
sub rax, r8
cmp rax, rdx
jae 0x18001ac21
xor edx, edx
jmp 0x18001ac24
add rdx, r8
cmp rdx, rcx
cmovb rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.18001a310
mov r13, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
movabs rdx, 0x3ffffffffffffffe
test rbx, rbx
je 0x18001ac58
mov eax, dword [rdi + rbp*4]
mov dword [rbx], eax
add rbx, 4
xor ebp, ebp
jmp 0x18001acd7
cmp rbx, r13
jne 0x18001acca
mov rcx, rbx
sub rcx, rdi
sar rcx, 2
cmp rcx, rdx
ja 0x18001ad05
inc rcx
mov rdx, r13
sub rdx, rdi
sar rdx, 2
cmp rcx, rdx
jbe 0x18001acc0
mov r8, rdx
shr r8, 1
sub rax, r8
cmp rax, rdx
jae 0x18001ac9d
mov rdx, rbp
jmp 0x18001aca0
add rdx, r8
cmp rdx, rcx
cmovb rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.18001a310
mov r13, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
movabs rdx, 0x3ffffffffffffffe
test rbx, rbx
je 0x18001acd3
mov eax, dword [rsi]
mov dword [rbx], eax
add rbx, 4
movabs rax, 0x3fffffffffffffff
mov qword [rsp + 0x30], rbx
inc r14d
add rsi, 4
cmp r14d, r15d
jae 0x18001ad13
jmp 0x18001abc0
lea rcx, str.vector_T__too_long
call qword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rcx, str.vector_T__too_long
call qword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [r12], rbp
mov qword [r12 + 8], rbp
mov qword [r12 + 0x10], rbp
lea rax, [rsp + 0x28]
cmp r12, rax
je 0x18001ad3c
mov qword [r12], rdi
mov qword [r12 + 8], rbx
mov qword [r12 + 0x10], r13
mov rdi, rbp
test rdi, rdi
je 0x18001ad49
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, r12
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.18002f870
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret