Function at 0x140008490
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push r12
push r13
push r15
mov eax, 0x4048
call fcn.14000cc00
sub rsp, rax
mov rax, qword [0x140043080]
xor rax, rsp
mov qword [rsp + 0x4030], rax
xor r15d, r15d
mov rbx, rcx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov r13, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140008714
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140008714
mov ecx, eax
mov edx, 1
call fcn.140016c58
mov r12, rax
test rax, rax
je 0x140008714
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov rcx, r13
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400086f7
lea rcx, [rbx + 0x2022]
mov r8d, 0x1000
lea rdx, [rsp + 0x2030]
call fcn.140009740
test rax, rax
je 0x1400086f7
mov qword [rsp + 0x4078], rbp
lea rax, [rsp + 0x2030]
mov qword [rsp + 0x4080], rsi
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x4040], r14
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x140008570
mov eax, dword [rsp + 0x20]
lea rcx, str.LOADER:_found__d_loaded_DLLs..._n
shr eax, 3
mov ebp, r15d
mov edx, eax
mov qword [rsp + 0x4088], rdi
mov r14d, eax
call fcn.140001f80
test r14, r14
je 0x140008618
mov rdi, r15
mov rsi, r12
nop dword [rax + rax]
mov rdx, qword [r12 + rdi*8]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov rcx, r13
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
jne 0x1400085d9
lea rcx, str.LOADER:_could_not_resolve_DLLs_name___skipping__n
call fcn.140001f80
jmp 0x140008610
lea rdx, [rsp + 0x30]
lea rcx, str.LOADER:_loaded_DLL:__ls_n
call fcn.140001f80
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2030]
call fcn.140019768
test eax, eax
jne 0x140008610
mov rax, qword [r12 + rdi*8]
inc ebp
mov qword [rsi], rax
add rsi, 8
inc rdi
cmp rdi, r14
jl 0x1400085b0
mov edx, ebp
lea rcx, str.LOADER:_found__d_DLL_s__loaded_from_applications_temporary_directory__n
call fcn.140001f80
mov r14, qword [rsp + 0x4040]
movsxd rsi, ebp
mov rbp, qword [rsp + 0x4078]
test rsi, rsi
jle 0x1400086e7
mov rdi, r12
nop word [rax + rax]
mov rdx, qword [rdi]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov rcx, r13
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
jne 0x140008678
lea rcx, str.LOADER:_could_not_resolve_DLLs_name__was_it_unloaded_____skipping__n
call fcn.140001f80
jmp 0x1400086d9
mov ebx, 1
lea rdx, [rsp + 0x30]
mov r8d, ebx
lea rcx, str.LOADER:_forcing_unload_of__ls__attempt__d__n
call fcn.140001f80
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x1400086c8
nop
cmp ebx, 0x20
jge 0x140008704
inc ebx
lea rdx, [rsp + 0x30]
mov r8d, ebx
lea rcx, str.LOADER:_forcing_unload_of__ls__attempt__d__n
call fcn.140001f80
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1400086a0
mov edx, ebx
lea rcx, str.LOADER:_DLL_unloaded_after__d_attempt_s___n
call fcn.140001f80
inc r15d
add rdi, 8
sub rsi, 1
jne 0x140008650
mov rdi, qword [rsp + 0x4088]
mov rsi, qword [rsp + 0x4080]
mov rcx, r12
call fcn.140016c60
mov eax, r15d
jmp 0x140008716
mov edx, ebx
lea rcx, str.LOADER:_giving_up_after__d_attempts__n
call fcn.140001f80
jmp 0x1400086d9
xor eax, eax
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.14000c900
add rsp, 0x4048
pop r15
pop r13
pop r12
pop rbx
ret