Function at 0x1800039e0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x180049080]
xor rax, rsp
mov qword [rbp], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov qword [rbp - 0x20], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
mov rdx, rcx
lea rcx, [rbp - 0x80]
call fcn.1800075b0
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.180002a60
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
xor r13d, r13d
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov dword [rbp - 0x60], r13d
test rax, rax
je 0x180003ace
lea r9, [rbp - 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x180003ac5
mov eax, dword [rbp - 0x60]
test eax, eax
je 0x180003ac5
mov edx, eax
lea ecx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180003ac0
lea r9, [rbp - 0x60]
mov r8d, dword [rbp - 0x60]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x180003ab7
mov r13, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, 1
lea rcx, [rsp + 0x38]
call fcn.180002090
lea rdx, [rsp + 0x38]
lea rcx, str.Process_name:
call fcn.18000b770
mov edx, esi
lea rcx, str.Process_ID:
call fcn.18000bcb0
mov rdx, r13
lea rcx, [rsp + 0x38]
call fcn.18000bfe0
mov rdx, rax
lea rcx, str.Process_base_address:
call fcn.18000b770
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1800075b0
mov rdx, rax
lea rcx, str.AOB:
call fcn.18000b770
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1800075b0
mov rcx, rax
call fcn.1800031f0
test al, al
jne 0x180003c25
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180003ba9
mov rdx, qword [rbp - 0x10]
call fcn.18000cf60
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003b94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003fd6
call fcn.180010350
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180003be3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180003bde
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003fdc
mov rcx, r8
call fcn.180010350
xor eax, eax
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.180010330
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor ebx, ebx
mov qword [rsp + 0x58], rbx
xor esi, esi
movabs rdi, 0x4000000000000045
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov r8d, 0x30
lea rdx, [rbp - 0x50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180003efa
mov r13, qword [rbp - 0x50]
mov r15, qword [rbp - 0x38]
add r15, r13
mov qword [rsp + 0x20], r15
mov ecx, dword [rbp - 0x2c]
mov edx, dword [rbp - 0x30]
lea rax, [rcx - 2]
cmp rax, 0x3e
ja 0x180003c91
bt rdi, rax
jb 0x180003c9e
cmp rcx, 0x80
jne 0x180003e18
cmp rdx, 0x1000
jne 0x180003e18
mov rdx, r13
lea rcx, [rsp + 0x38]
call fcn.18000bfe0
mov rdx, rax
lea rcx, str.Checking_region:
call fcn.18000b770
mov rsi, r13
mov r14, qword [rbp - 0x10]
mov rcx, r14
mov rdi, qword [rbp - 0x18]
sub rcx, rdi
sar rcx, 5
mov rax, r15
sub rax, rcx
cmp r13, rax
jae 0x180003df0
nop dword [rax + rax]
xor r15d, r15d
mov rax, r14
sub rax, rdi
sar rax, 5
test rax, rax
je 0x180003dd0
xor r12d, r12d
nop dword [rax]
lea rbx, [r12 + rdi]
lea rdx, [0x18004c1d0]
cmp qword [0x18004c1e8], 0x10
cmovae rdx, qword [0x18004c1d0]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180003d3c
mov rcx, qword [rbx]
cmp r8, qword [0x18004c1e0]
jne 0x180003d4e
call fcn.1800132b0
test eax, eax
je 0x180003dae
call fcn.180019f00
mov rdi, rax
cmp qword [rbx + 0x18], 0x10
jb 0x180003d60
mov rbx, qword [rbx]
mov dword [rax], 0
mov r8d, 0x10
lea rdx, [rbp - 0x58]
mov rcx, rbx
call fcn.180017e9c
cmp rbx, qword [rbp - 0x58]
je 0x180003ffb
cmp dword [rdi], 0x22
je 0x180003fee
mov r14, qword [rbp - 0x10]
mov rdi, qword [rbp - 0x18]
cmp byte [rsi], al
jne 0x180003dcd
mov rcx, r14
sub rcx, rdi
sar rcx, 5
lea rax, [rcx - 1]
cmp r15, rax
je 0x180003e36
inc rsi
inc r15
add r12, 0x20
mov rax, r14
sub rax, rdi
sar rax, 5
cmp r15, rax
jb 0x180003d10
jmp 0x180003dd0
inc rsi
mov rcx, r14
sub rcx, rdi
sar rcx, 5
mov rax, qword [rsp + 0x20]
sub rax, rcx
cmp rsi, rax
jb 0x180003cf0
mov rbx, qword [rsp + 0x58]
movabs rdi, 0x4000000000000045
inc rbx
mov qword [rsp + 0x58], rbx
add r13, qword [rbp - 0x38]
cmp rbx, 0x2710
jae 0x180003f21
jmp 0x180003c40
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.18000bfe0
mov rdx, rax
lea rcx, str.Skipped_region:
call fcn.18000b770
jmp 0x180003dfa
sub rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x60]
call fcn.18000bfe0
mov rdx, rax
lea rcx, str.Found_signature_at
call fcn.18000b770
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180003eb2
mov rdx, qword [rbp - 0x10]
call fcn.18000cf60
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003e9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003fe2
call fcn.180010350
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], 0
mov rbx, qword [rsp + 0x28]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180003ef1
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180003eec
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180003fe8
mov rcx, r8
call fcn.180010350
lea rax, [rsi + 1]
jmp 0x180003be5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x180003f13
lea rcx, str.Reached_end_of_scannable_memory.
call fcn.18000c150
jmp 0x180003f21
mov edx, eax
lea rcx, str.VirtualQuery_failed__error_code:
call fcn.18000bcb0
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.18000bfe0
mov r9, rbx
mov rdx, rax
call fcn.18000c470
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov r8d, 0x19
lea rdx, str.Could_not_find_signature_
lea rcx, [rsp + 0x38]
call fcn.18000caa0
lea rcx, [rsp + 0x38]
call fcn.1800026d0
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180003fcc
mov rdx, qword [rbp - 0x10]
call fcn.18000cf60
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003fb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003fd6
call fcn.180010350
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], 0
mov rbx, qword [rsp + 0x28]
jmp 0x180003ba9
call fcn.18001ab64
nop
call fcn.18001ab64
nop
call fcn.18001ab64
nop
call fcn.18001ab64
nop
lea rcx, str.stoul_argument_out_of_range
call fcn.18000f3d4
int3
lea rcx, str.invalid_stoul_argument
call fcn.18000f38c
int3