Function at 0x140011136
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140014c50
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov eax, 0x1d80
call fcn.1400110b9
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5d8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1da8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1d58], rax
lea rcx, [0x1400281b2]
call fcn.1400113c5
lea r8, [rbp + 0x1044]
mov edx, 0x1000
lea rcx, [rbp + 0x30]
call fcn.14001118b
test eax, eax
jne 0x140014cf0
lea rax, [rbp + 0x1b70]
mov rdi, rax
xor eax, eax
mov ecx, 0xd8
rep stosb byte [rdi], al
lea rax, [rbp + 0x1b70]
mov rdi, qword [rbp + 0x1d80]
mov rsi, rax
mov ecx, 0xd8
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x1d80]
jmp 0x140014f3b
mov eax, dword [rbp + 0x1044]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x1084], eax
lea rax, [rbp + 0x10b0]
lea rcx, str.notepad.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x10c8]
mov rdi, rax
xor eax, eax
mov ecx, 0xb0
rep stosb byte [rdi], al
lea rax, [rbp + 0x11a0]
lea rcx, str.calc.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x11b2]
mov rdi, rax
xor eax, eax
mov ecx, 0xb6
rep stosb byte [rdi], al
lea rax, [rbp + 0x1290]
lea rcx, str.CalculatorApp.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x12b4]
mov rdi, rax
xor eax, eax
mov ecx, 0xa4
rep stosb byte [rdi], al
lea rax, [rbp + 0x1380]
lea rcx, str.cmd.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1390]
mov rdi, rax
xor eax, eax
mov ecx, 0xb8
rep stosb byte [rdi], al
mov dword [rbp + 0x1064], 0
jmp 0x140014dd8
mov eax, dword [rbp + 0x1064]
inc eax
mov dword [rbp + 0x1064], eax
mov eax, dword [rbp + 0x1084]
cmp dword [rbp + 0x1064], eax
jae 0x140014f09
lea rax, [rbp + 0x1470]
mov rdi, rax
xor eax, eax
mov ecx, 0xd8
rep stosb byte [rdi], al
mov eax, dword [rbp + 0x1064]
mov eax, dword [rbp + rax*4 + 0x30]
mov dword [rbp + 0x1470], eax
mov r8d, dword [rbp + 0x1470]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140014e4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, dword [rbp + 0x1470]
lea rcx, str.ACCESS_DENIED_for_pid__d__reason_:__lx_n
call fcn.1400111c7
jmp 0x140014f04
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1478], rax
mov r9d, 0xc8
lea r8, [rbp + 0x1480]
xor edx, edx
mov rcx, qword [rbp + 8]
call fcn.140011401
lea r9, [rbp + 0x1480]
mov r8, qword [rbp + 0x1478]
mov edx, dword [rbp + 0x1470]
lea rcx, str.Got_access_to_process_with_pid__d__handle_is_0x_p__Module_base_name_is__ls_n
call fcn.1400111c7
lea rdx, [rbp + 0x10b0]
lea rcx, [rbp + 0x1480]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x140014ed7
lea rdx, [rbp + 0x1290]
lea rcx, [rbp + 0x1480]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x140014ed7
lea rdx, [rbp + 0x1380]
lea rcx, [rbp + 0x1480]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140014f04
lea rcx, str.Found_injectable_process__
call fcn.1400111c7
lea rax, [rbp + 0x1470]
mov rdi, qword [rbp + 0x1d80]
mov rsi, rax
mov ecx, 0xd8
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x1d80]
jmp 0x140014f3b
jmp 0x140014dca
lea rax, [rbp + 0x1c70]
mov rdi, rax
xor eax, eax
mov ecx, 0xd8
rep stosb byte [rdi], al
lea rax, [rbp + 0x1c70]
mov rdi, qword [rbp + 0x1d80]
mov rsi, rax
mov ecx, 0xd8
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x1d80]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001e240]
call fcn.14001134d
mov rax, rdi
mov rcx, qword [rbp + 0x1d58]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x1d60]
pop rdi
pop rsi
pop rbp
ret