Function at 0x140031b70
Capabilities:
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5d8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
jne 0x140031b9f
mov rcx, qword [rsi + 8]
cmp qword [rcx], 0x64
ja 0x140032140
mov byte [rsp + 0x45], 0
mov byte [rsp + 0x46], 0
mov rdi, qword [rsi + 0x10]
mov r14, qword [rsi + 0x18]
mov r15, qword [rsi + 0x20]
lea rcx, [rsp + 0x45]
mov qword [rsp + 0x158], rcx
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rdi
lea rax, [rsp + 0x46]
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x188], rbx
mov rbp, qword [rbx + 0x10]
lea rax, [rsp + 0x158]
mov qword [rsp + 0x190], rax
lea rax, [0x14007e810]
mov qword [rsp + 0x198], rax
cmp qword [0x140084110], 0
jne 0x140032122
mov ecx, 0x3c0
mov edx, 8
call fcn.14000aa00
test rax, rax
je 0x1400321e3
mov qword [rsp + 0x140], 4
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x60], 0
mov ecx, 8
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1400320cb
mov r12, rax
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], r14
lea rbp, [rsp + 0x1a0]
mov r8d, 0x438
mov rcx, rbp
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x1a0], 0x438
mov rcx, r12
mov rdx, rbp
call sub.KERNEL32.dll_Module32FirstW
cmp eax, 1
jne 0x140032093
lea rdi, [rsp + 0x3d0]
lea r13, [rsp + 0x5d8]
lea rsi, [rsp + 0x88]
mov eax, 8
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0xc0]
jmp 0x140031da9
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
shl rax, 6
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movups xmm2, xmmword [rsp + 0xa0]
movups xmm3, xmmword [rsp + 0xb0]
movups xmmword [rcx + rax + 0x30], xmm3
movups xmmword [rcx + rax + 0x20], xmm2
movups xmmword [rcx + rax + 0x10], xmm1
mov qword [rsp + 0x70], rcx
movups xmmword [rcx + rax], xmm0
inc rdx
mov rax, rdx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x60], rdx
nop word [rax + rax]
mov rcx, r12
lea rdx, [rsp + 0x1a0]
call sub.KERNEL32.dll_Module32NextW
cmp eax, 1
jne 0x140032093
xor r8d, r8d
nop dword [rax]
cmp word [rsp + r8*2 + 0x3d0], 0
je 0x140031e10
lea rax, [rsp + r8*2]
add rax, 0x3d0
cmp word [rax + 2], 0
je 0x140031df7
cmp word [rax + 4], 0
je 0x140031dfc
cmp word [rax + 6], 0
je 0x140031e02
cmp word [rax + 8], 0
je 0x140031e08
add r8, 5
add rax, 0xa
cmp rax, r13
jne 0x140031db0
mov r8d, 0x104
jmp 0x140031e10
inc r8
jmp 0x140031e10
add r8, 2
jmp 0x140031e10
add r8, 3
jmp 0x140031e10
add r8, 4
nop dword [rax]
mov rcx, rbx
mov rdx, rdi
call fcn.140016d80
mov rbp, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xd0]
lea rcx, [rsp + 0x80]
mov rdx, rbp
mov r8, r14
call fcn.140017ea0
cmp qword [rsp + 0x80], 0
je 0x140031ef5
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xe0], xmm0
mov r15, qword [rsp + 0xe8]
cmp rax, 0x40
jb 0x140031ee0
test r15, r15
je 0x140031ee0
movzx ecx, word [r15]
cmp ecx, 0x5a4d
jne 0x140031ee0
mov r9d, dword [r15 + 0x3c]
mov rcx, rax
sub rcx, r9
mov r8, rbx
setb bl
mov rdx, rdi
mov rdi, rsi
lea rsi, [r15 + r9]
cmp rcx, 0x88
setb cl
or cl, bl
mov rbx, r8
mov ecx, 0
cmove rcx, rsi
mov rsi, rdi
mov rdi, rdx
jne 0x140031ee0
cmp dword [rcx], 0x4550
jne 0x140031ee0
movzx ebx, word [rcx + 0x18]
cmp ebx, 0x20b
mov rbx, r8
jne 0x140031ee0
movzx r8d, word [rcx + 0x14]
cmp r8, 0x70
jae 0x140031f1a
nop
mov rcx, r15
call sub.KERNEL32.dll_UnmapViewOfFile
mov rcx, qword [rsp + 0xe0]
call sub.KERNEL32.dll_CloseHandle
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x140031d90
not rdx
shr rdx, 0x3f
mov rcx, rbp
call fcn.14000aa90
jmp 0x140031d90
add r9, 0x88
sub rax, r9
jb 0x140031ee0
add r8, 0xffffffffffffff90
cmp rax, r8
jb 0x140031ee0
mov eax, dword [rcx + 0x84]
shl rax, 3
cmp rax, r8
ja 0x140031ee0
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x108], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmm1, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
mov ecx, 0x10
mov edx, 8
call fcn.14000aa00
test rax, rax
je 0x1400321f4
mov edx, dword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
mov qword [rsp + 0x100], rax
mov qword [rax + 8], rdx
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xf8], rax
movzx eax, byte [rsp + 0xd8]
mov byte [rsp + 0x47], al
lea rcx, [rsp + 0xd9]
mov eax, dword [rcx]
mov ecx, dword [rcx + 3]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4b], ecx
mov rcx, r15
call sub.KERNEL32.dll_UnmapViewOfFile
mov rcx, qword [rsp + 0xe0]
call sub.KERNEL32.dll_CloseHandle
movzx eax, byte [rsp + 0x47]
cmp al, 2
je 0x140031d90
mov rdx, qword [rsp + 0x108]
sub rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], r14
mov byte [rsp + 0x98], al
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x4b]
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x11], eax
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0xa8], 1
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
mov rdx, qword [rsp + 0x78]
cmp rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
jne 0x140031d38
lea rcx, [rsp + 0x50]
call fcn.140018790
jmp 0x140031d2e
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
mov r14, qword [rsp + 0x138]
mov rbx, qword [rsp + 0x130]
mov r15, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x118]
mov rbp, qword [rsp + 0x110]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1b0], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x140]
movups xmmword [rsp + 0x1b8], xmm1
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x1c8], rax
movups xmmword [0x140084108], xmm0
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [0x140084118], xmm0
movaps xmm0, xmmword [rsp + 0x1c0]
movups xmmword [0x140084128], xmm0
xor ecx, ecx
sub rbp, 1
cmovae rcx, rbp
lea rdx, [rsp + 0x190]
call fcn.1400189e0
cmp byte [rsp + 0x46], 0
je 0x140032147
xor ecx, ecx
jmp 0x1400321cd
cmp byte [rsp + 0x45], 0
jne 0x1400321bf
cmp byte [rdi], 0
je 0x1400321bf
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x160], r15
mov rdx, qword [rbx + 0x10]
mov qword [rsp + 0x1a0], 3
mov qword [rsp + 0x80], 2
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x158]
lea r8, [rsp + 0x1a0]
lea r9, [rsp + 0x80]
call fcn.14002f0c0
mov byte [r14], al
mov rax, qword [rsp + 0x160]
inc qword [rax + 0x10]
mov rax, qword [rsi + 8]
inc qword [rax]
cmp byte [r14], 0
sete cl
mov eax, ecx
add rsp, 0x5d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x3c0
mov edx, 8
call fcn.140002f40
ud2
mov ecx, 0x10
mov edx, 8
call fcn.140002f40
ud2