Function at 0x1400012b0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1240]
mov eax, 0x1340
call fcn.1400055c0
sub rsp, rax
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x1230], rax
lea r8, [rbp + 0x18]
mov edx, 0x1000
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140001969
mov esi, dword [rbp + 0x18]
shr esi, 2
mov dword [rsp + 0x24], esi
xor r15d, r15d
mov ebx, r15d
mov dword [rsp + 0x20], ebx
test esi, esi
je 0x1400018b6
lea rdi, [rbp + 0x20]
mov qword [rsp + 0x30], rdi
movabs r13, 0x7ffffffffffffffe
movabs r12, 0x7fffffffffffffff
mov r8d, dword [rdi]
test r8d, r8d
je 0x14000189f
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14000189f
mov r9d, 0x104
lea r8, [rbp + 0x1020]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x140001896
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r15
lea rax, [rbp + 0x1020]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400013b0
cmp rbx, r13
ja 0x1400019af
cmp rbx, 7
ja 0x1400013f6
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x1020]
lea rcx, [rbp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov word [rbp + rbx - 8], r15w
jmp 0x140001495
mov rdi, rbx
or rdi, 7
cmp rdi, r13
jbe 0x14000140b
mov rdi, r13
lea rcx, [r12 + r12]
jmp 0x140001431
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, r12
ja 0x1400019a9
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000145d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019a9
mov rcx, rax
call fcn.1400046e0
test rax, rax
je 0x1400019a2
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000146f
test rcx, rcx
je 0x14000146c
call fcn.1400046e0
mov rsi, rax
jmp 0x14000146f
mov rsi, r15
mov qword [rbp - 8], rsi
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rdi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x1020]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r15w
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 7
seta r8b
cmova rdx, qword [rbp - 8]
mov rax, qword [rbp + 8]
lea rsi, [rdx + rax*2]
lea rdi, [rbp - 8]
test r8b, r8b
cmovne rdi, qword [rbp - 8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
cmp rdi, rsi
jne 0x1400014e1
mov rbx, r15
mov qword [rbp - 0x30], rbx
mov r13d, 0xf
mov qword [rbp - 0x28], r13
mov byte [rbp - 0x40], 0
jmp 0x1400015d6
sub rsi, rdi
sar rsi, 1
mov qword [rbp - 0x30], r15
mov ebx, 0xf
mov qword [rbp - 0x28], rbx
cmp rsi, r12
ja 0x1400019bb
cmp rsi, rbx
jbe 0x140001597
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x140001525
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000154c
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001576
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019b5
mov rcx, rax
call fcn.1400046e0
mov rcx, rax
test rax, rax
je 0x14000199b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x28], rbx
jmp 0x14000159b
test rcx, rcx
je 0x14000158a
call fcn.1400046e0
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x28], rbx
jmp 0x14000159b
mov rax, r15
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x28], rbx
jmp 0x14000159b
mov rax, qword [rbp - 0x40]
lea r8, [rbp - 0x40]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x1400015c5
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x1400015b2
mov qword [rbp - 0x30], rsi
mov byte [r8 + rsi], 0
mov rbx, qword [rbp - 0x30]
mov r13, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0xb
mov qword [rsp + 0x58], 0xf
movsd xmm0, qword [str.ollydbg.exe]
movsd qword [rsp + 0x40], xmm0
movzx eax, word [0x140006550]
mov word [rsp + 0x48], ax
movzx eax, byte [0x140006552]
mov byte [rsp + 0x4a], al
mov byte [rsp + 0x4b], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 0xf
movabs rax, 0x6578652e71616469
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 0
movups xmmword [rbp - 0x80], xmm0
mov eax, 0xa
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 0xf
movsd xmm0, qword [str.x64dbg.exe]
movsd qword [rbp - 0x80], xmm0
movzx eax, word [0x140006560]
mov word [rbp - 0x78], ax
mov byte [rbp - 0x76], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 0xb
mov qword [rbp - 0x48], 0xf
movsd xmm0, qword [str.debugee.exe]
movsd qword [rbp - 0x60], xmm0
movzx eax, word [0x140006570]
mov word [rbp - 0x58], ax
movzx eax, byte [0x140006572]
mov byte [rbp - 0x56], al
mov byte [rbp - 0x55], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
mov ecx, 0x80
call fcn.1400046e0
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
lea rcx, [rax + 0x80]
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x28], rcx
lea r9, [rbp - 0x20]
mov r8, rax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.140004340
mov qword [rbp - 0x18], rax
lea r9, [fcn.140003230]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rsp + 0x40]
call fcn.14000471c
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x40]
mov qword [rsp + 0x28], r12
cmp rsi, qword [rbp - 0x18]
je 0x1400017f2
mov r14, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x14000173f
mov r14, qword [rsi]
lea r15, [rbp - 0x40]
cmp r13, 0xf
cmova r15, r12
mov rdi, qword [rsi + 0x10]
cmp rdi, rbx
ja 0x1400017dc
mov rax, rbx
sub rax, rdi
test rdi, rdi
je 0x1400018c6
lea r12, [rax + r15]
movsx r13d, byte [r14]
lea r8, [r12 + 1]
sub r8, r15
mov edx, r13d
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400017cf
nop word [rax + rax]
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400017c2
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov edx, r13d
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140001790
jmp 0x1400017cf
sub rbx, r15
cmp rbx, 0xffffffffffffffff
jne 0x1400018bd
mov rbx, qword [rbp - 0x30]
mov r13, qword [rbp - 0x28]
mov r12, qword [rsp + 0x28]
add rsi, 0x20
cmp rsi, qword [rbp - 0x18]
jne 0x140001732
mov r14, qword [rsp + 0x38]
xor r15d, r15d
lea rcx, [rbp - 0x20]
call fcn.1400035b0
nop
cmp r13, 0xf
jbe 0x140001835
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14000182c
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000199b
mov rcx, r12
call fcn.1400047ec
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x140001875
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001870
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019a2
call fcn.1400047ec
movabs r13, 0x7ffffffffffffffe
movabs r12, 0x7fffffffffffffff
mov esi, dword [rsp + 0x24]
mov rdi, qword [rsp + 0x30]
mov ebx, dword [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
mov dword [rsp + 0x20], ebx
add rdi, 4
mov qword [rsp + 0x30], rdi
cmp ebx, esi
jb 0x140001342
mov al, 1
jmp 0x14000196b
mov r13, qword [rbp - 0x28]
mov r12, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x30
lea r8, str.Alerte_D
lea rdx, [0x1400065a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [rbp - 0x20]
call fcn.1400035b0
nop
cmp r13, 0xf
jbe 0x14000192d
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140001924
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000199b
mov rcx, r12
call fcn.1400047ec
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x140001969
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001964
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019a2
call fcn.1400047ec
xor al, al
mov rcx, qword [rbp + 0x1230]
xor rcx, rsp
call fcn.1400046c0
lea r11, [rsp + 0x1340]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001110
int3
call fcn.1400011b0
nop
call fcn.140001110
int3
call fcn.1400011b0
int3