Function at 0x140098f70
Capabilities:
Enumerate process modules
Get system information on windows
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, rcx
mov r8d, edx
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140099303
lea r9, [rsp + 0x60]
mov r8d, 8
lea rdx, [rsp + 0x68]
mov rcx, rdi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140099004
mov ecx, 0x1000
call fcn.14025e98c
mov rbx, rax
mov r9d, 0x1000
mov r8, rax
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call sub.KERNEL32.dll_K32GetModuleBaseNameA
test rbx, rbx
je 0x140099004
mov rcx, rbx
call fcn.14025e328
xor esi, esi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0xa0], sil
lea rcx, [0x1402f35c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ebp, [rsi + 0x20]
test rax, rax
jne 0x140099053
mov ebx, ebp
jmp 0x140099076
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rax
test eax, eax
je 0x140099074
mov ebx, 0x40
cmp dword [rsp + 0x50], 0
cmovne ebx, ebp
jmp 0x140099076
mov ebx, esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x70]
cmp ax, 9
jne 0x1400990ab
mov esi, 0x40
jmp 0x1400990b1
test ax, ax
cmove esi, ebp
cmp ebx, ebp
jne 0x1400990bc
mov eax, reloc.WS2_32.dll_recv
jmp 0x1400990ca
cmp ebx, 0x40
jne 0x1400992f5
mov eax, Ordinal_41
add r14, rax
je 0x1400992f5
mov rax, qword [r14]
mov rbp, qword [r14 + 8]
sub rbp, rax
je 0x1400992f5
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x1400990f9
lea rcx, str.Invalid_DOS_header_n
jmp 0x1400992ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp rcx, rax
jb 0x1400992e8
add rax, 0xfffffffffffffef8
add rax, rbp
cmp rcx, rax
ja 0x1400992e8
cmp dword [rcx], 0x4550
jne 0x1400992e8
movzx eax, word [rcx + 4]
mov ecx, 0x14c
cmp ax, cx
jne 0x14009913a
cmp ebx, 0x20
jmp 0x140099147
mov ecx, 0x8664
cmp ax, cx
jne 0x14009914d
cmp ebx, 0x40
jne 0x1400992f5
mov eax, 0x535
mov r13d, 0x478
cmp ebx, 0x20
cmovne r13d, eax
lea rcx, str._UVATAUAVH
lea rax, [0x1402f2be0]
cmovne rax, rcx
mov qword [rsp + 0x50], rax
mov r15, rbp
add r15, r13
lea rcx, [0x1402f35c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualAllocEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400992f5
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r15
xor edx, edx
mov rcx, rdi
call rax
mov r15, rax
test rax, rax
je 0x1400992f5
lea rcx, [0x1402f35c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.WriteProcessMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x1400992f5
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, qword [rsp + 0x50]
mov rdx, r15
mov rcx, rdi
call r12
test eax, eax
je 0x1400992d5
lea rdx, [r15 + r13]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9, rbp
mov r8, qword [r14]
mov rcx, rdi
call r12
test eax, eax
je 0x1400992d5
cmp esi, 0x40
je 0x14009924a
cmp esi, ebx
jne 0x1400992cd
lea rcx, [0x1402f3684]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlCreateUserThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400992f5
xor edx, edx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call rax
cmp qword [rsp + 0x50], 0
je 0x1400992cd
lea rdx, str.RtlCreateUserThread_Success_n
mov ecx, 3
call fcn.14009a640
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1400992cf
xor al, al
test al, al
jne 0x140099300
jmp 0x1400992f5
lea rdx, str.Failed_to_write_remote_process_memory_n
mov ecx, 3
call fcn.14009a640
jmp 0x1400992f5
lea rcx, str.Invalid_NT_header_n
call fcn.14009a120
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov rax, rdi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14025e930
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret