Function at 0x1800066a0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x25a0]
mov eax, 0x26a0
call fcn.180011bc0
sub rsp, rax
mov rdi, rdx
xor esi, esi
mov ebx, esi
xor eax, eax
mov r14d, 1
lock cmpxchg dword [0x18004c448], r14d
je 0x180006703
nop
cmp rbx, 0x20
jae 0x1800066ea
xor ecx, ecx
jmp 0x1800066ed
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18004c448], r14d
jne 0x1800066e0
cmp qword [0x18004c5c8], rsi
jne 0x180006aa2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x18004c5c8], rax
mov ecx, esi
xchg dword [0x18004c448], ecx
test rax, rax
je 0x180006aa8
mov qword [0x18004c558], rdi
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rsp + 0x70]
call fcn.1800132b4
test rax, rax
je 0x180006766
mov word [rax], si
lea r9, [rsp + 0x70]
lea r8, str._s_server
mov edx, 0x104
lea rcx, [rbp + 0x390]
call fcn.180006400
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r15, rax
lea r9, [rbp + 0x25f0]
mov r8d, 0x2000
lea rdx, [rbp + 0x5a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
lea r12, str.jvm.dll
lea r13, str.java.dll
test eax, eax
je 0x18000693c
mov edi, esi
test dword [rbp + 0x25f0], 0xfffffff8
jbe 0x18000693c
mov eax, edi
lea r14, [rbp + 0x5a0]
lea r14, [r14 + rax*8]
mov r9d, 0x104
lea r8, [rbp + 0x180]
mov rdx, qword [r14]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x180006929
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], si
jne 0x180006820
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x48]
call fcn.180005160
mov rbx, qword [rsp + 0x60]
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
cmp qword [0x18004c568], rsi
jne 0x18000689e
lea r8, [rsp + 0x48]
cmp rbx, 7
cmova r8, r11
cmp r10, 7
jb 0x18000689e
mov edx, 7
mov rcx, r12
lea r9, [r10*2 - 0xe]
sub r9, r12
add r9, r8
nop dword [rax]
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x18000689e
add rcx, 2
sub rdx, 1
jne 0x180006880
mov rax, qword [r14]
mov qword [0x18004c568], rax
cmp qword [0x18004c400], rsi
jne 0x1800068ee
lea r8, [rsp + 0x48]
cmp rbx, 7
cmova r8, r11
cmp r10, 8
jb 0x1800068ee
mov edx, 8
mov rcx, r13
lea r9, [r10*2 - 0x10]
sub r9, r13
add r9, r8
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x1800068ee
add rcx, 2
sub rdx, 1
jne 0x1800068d0
mov rax, qword [r14]
mov qword [0x18004c400], rax
cmp rbx, 7
jbe 0x180006929
lea rdx, [rbx*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x180006921
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006add
mov rcx, r11
call fcn.1800110b8
inc edi
mov eax, dword [rbp + 0x25f0]
shr eax, 3
cmp edi, eax
jb 0x1800067d1
cmp qword [0x18004c568], rsi
jne 0x1800069b8
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18004c568], rax
test rax, rax
jne 0x1800069b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp + 0x25f8], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rbp + 0x25f8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor r9d, r9d
lea r8, str.JvmDLL
mov rdx, qword [rbp + 0x25f8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp qword [0x18004c400], rsi
jne 0x180006a2c
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18004c400], rax
test rax, rax
jne 0x180006a2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor r9d, r9d
lea r8, str.JavaDLL
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rax, qword [0x18004c400]
cmp qword [0x18004c558], rsi
je 0x180006a59
test rax, rax
je 0x180006a59
cmp qword [0x18004c568], rsi
je 0x180006a62
call fcn.180006460
jmp 0x180006ac2
cmp qword [0x18004c568], rsi
jne 0x180006a82
xor r9d, r9d
lea r8, [0x180041508]
lea rdx, str.Error_Load_Jvm.dll
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rax, qword [0x18004c400]
test rax, rax
jne 0x180006ac2
xor r9d, r9d
lea r8, [0x180041508]
lea rdx, str.Error_Load_Java.dll
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x180006ac2
xchg dword [0x18004c448], esi
xor r9d, r9d
lea r8, [0x180041320]
lea rdx, [0x180041498]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rbx, qword [rsp + 0x26e0]
add rsp, 0x26a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18001d1e0
int3