Function at 0x180057820
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rbx, rdx
xor r15d, r15d
mov edx, ecx
lea ecx, [r15 + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x180057ad1
mov dword [rbp - 0x40], 0x238
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x180057ac8
lea rax, [rsp + 0x20]
mov qword [rbp + 0x250], rax
nop dword [rax + rax]
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.180069280
mov rdi, rax
mov qword [rbp + 0x258], rax
mov rsi, rax
mov rcx, qword [rax + 0x18]
mov r14, qword [rax + 0x10]
cmp rcx, 0xf
jbe 0x1800578bf
mov rsi, qword [rax]
add r14, rsi
jmp 0x1800578cb
add r14, rdi
mov rbx, rdi
cmp rcx, 0xf
jbe 0x1800578ce
mov rbx, qword [rax]
cmp rbx, r14
je 0x1800578ea
sub rsi, rbx
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rbx], al
inc rbx
cmp rbx, r14
jne 0x1800578d6
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x10]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180057931
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x20]
call fcn.18003e720
nop
lea rdi, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
seta cl
mov rbx, qword [rsp + 0x20]
cmova rdi, rbx
lea rdx, [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
test cl, cl
je 0x180057974
add rsi, rbx
jmp 0x18005797c
add rsi, rdx
lea rbx, [rsp + 0x20]
cmp rbx, rsi
je 0x180057998
sub rdi, rbx
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x180057984
movups xmm1, xmmword [rsp + 0x20]
movups xmmword [rbp - 0x80], xmm1
movups xmm2, xmmword [rsp + 0x30]
movups xmmword [rbp - 0x70], xmm2
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x60]
mov rbx, qword [rsp + 0x40]
movups xmm3, xmmword [rsp + 0x50]
movdqa xmm0, xmm3
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 0xf
cmova rdx, rbx
lea rcx, [rbp - 0x80]
movdqa xmm0, xmm2
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
seta r12b
movq rdi, xmm1
cmova rcx, rdi
movq r8, xmm2
movq rax, xmm3
cmp r8, rax
jne 0x180057a22
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180057a22
mov sil, 1
jmp 0x180057a25
xor sil, sil
test r12b, r12b
je 0x180057a58
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180057a4f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180057ab0
mov rcx, rdi
call fcn.180096ef4
nop
cmp r14, 0xf
jbe 0x180057a8b
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180057a83
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180057ab7
mov rcx, rbx
call fcn.180096ef4
mov rcx, r13
test sil, sil
jne 0x180057abe
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x180057ac8
mov rbx, qword [rbp + 0x248]
xor r15d, r15d
jmp 0x180057890
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x180057ad3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x340]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret