Function at 0x1400582a0
Capabilities:
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov r14, r8
mov r15, rdx
mov r12, qword [rcx + 8]
cmp qword [0x140102230], 0
jne 0x140058850
mov ecx, 0x3c0
mov edx, 8
call fcn.140002ee0
test rax, rax
je 0x140058881
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], 4
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 8
xor edx, edx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140058730
mov rbx, rax
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x118], r15
mov qword [rsp + 0x120], r14
lea rsi, [rsp + 0x140]
mov r8d, 0x438
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x140], 0x438
mov rcx, rbx
mov rdx, rsi
call sub.KERNEL32.DLL_Module32FirstW
cmp eax, 1
jne 0x140058710
lea r13, [rsp + 0x578]
mov eax, 8
mov qword [rsp + 0x90], rax
xor eax, eax
mov qword [rsp + 0x98], rax
jmp 0x140058419
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
shl rax, 6
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movups xmm2, xmmword [rsp + 0x70]
movups xmm3, xmmword [rsp + 0x80]
movups xmmword [rcx + rax + 0x30], xmm3
movups xmmword [rcx + rax + 0x20], xmm2
movups xmmword [rcx + rax + 0x10], xmm1
mov qword [rsp + 0x90], rcx
movups xmmword [rcx + rax], xmm0
inc rdx
mov rax, rdx
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0x48], rdx
nop word cs:[rax + rax]
mov rcx, rbx
lea rdx, [rsp + 0x140]
call sub.KERNEL32.DLL_Module32NextW
cmp eax, 1
jne 0x140058710
xor r8d, r8d
nop dword [rax]
cmp word [rsp + r8*2 + 0x370], 0
je 0x140058480
lea rax, [rsp + r8*2]
add rax, 0x370
cmp word [rax + 2], 0
je 0x140058467
cmp word [rax + 4], 0
je 0x14005846c
cmp word [rax + 6], 0
je 0x140058472
cmp word [rax + 8], 0
je 0x140058478
add r8, 5
add rax, 0xa
cmp rax, r13
jne 0x140058420
mov r8d, 0x104
jmp 0x140058480
inc r8
jmp 0x140058480
add r8, 2
jmp 0x140058480
add r8, 3
jmp 0x140058480
add r8, 4
nop dword [rax]
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x370]
call fcn.140034c90
mov rbp, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xb0]
lea rcx, [rsp + 0xe0]
mov rdx, rbp
mov r8, rsi
call fcn.140058040
cmp qword [rsp + 0xe0], 0
je 0x1400585c5
lea rax, [rsp + 0xe8]
mov r14, qword [rax + 0x10]
mov qword [rsp + 0xd0], r14
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc0], xmm0
mov rdi, qword [rsp + 0xc8]
mov r9d, 0x40
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.140061e20
test rax, rax
je 0x1400585b0
cmp rdx, 0x40
jb 0x1400585b0
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400585b0
mov r12d, dword [rax + 0x3c]
mov r9d, 0x88
mov rcx, rdi
mov rdx, r14
mov r8, r12
call fcn.140061e20
mov r15, rax
test rax, rax
je 0x1400585b0
cmp rdx, 0x88
jb 0x1400585b0
cmp dword [r15], 0x4550
jne 0x1400585b0
movzx eax, word [r15 + 0x18]
cmp eax, 0x20b
jne 0x1400585b0
movzx r9d, word [r15 + 0x14]
cmp r9, 0x70
jb 0x1400585b0
add r12, 0x88
add r9, 0xffffffffffffff90
mov rcx, rdi
mov rdx, r14
mov r8, r12
call fcn.140061e20
test rax, rax
je 0x1400585b0
mov r8, rdx
mov r9d, dword [r15 + 0x84]
lea rcx, [rsp + 0xe0]
mov rdx, rax
call fcn.140062c40
cmp qword [rsp + 0xe0], 0
je 0x1400585e9
mov rcx, rdi
call sub.KERNEL32.DLL_UnmapViewOfFile
mov rcx, qword [rsp + 0xc0]
call sub.KERNEL32.DLL_CloseHandle
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x140058400
mov r8d, 1
mov rcx, rbp
call fcn.140002ef0
jmp 0x140058400
mov r15, qword [r15 + 0x30]
mov r12, qword [rsp + 0x158]
movups xmm0, xmmword [rsp + 0xa0]
movups xmm1, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
mov ecx, 0x10
mov edx, 8
call fcn.140002ee0
test rax, rax
je 0x140058892
mov r14, rax
mov eax, dword [rsp + 0x160]
mov qword [r14], r15
mov qword [r14 + 8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x108], rax
movzx eax, byte [rsp + 0xb8]
mov byte [rsp + 0x2f], al
lea rcx, [rsp + 0xb9]
mov eax, dword [rcx]
mov ecx, dword [rcx + 3]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x33], ecx
mov rcx, rdi
call sub.KERNEL32.DLL_UnmapViewOfFile
mov rcx, qword [rsp + 0xc0]
call sub.KERNEL32.DLL_CloseHandle
movzx eax, byte [rsp + 0x2f]
cmp al, 2
je 0x140058400
sub r12, r15
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], rbp
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x88], al
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x33]
lea rdx, [rsp + 0x89]
mov dword [rdx + 3], ecx
mov dword [rdx], eax
mov rdx, qword [rsp + 0x98]
cmp rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
jne 0x1400583a7
lea rcx, [rsp + 0x38]
call fcn.140012b70
jmp 0x14005839d
mov rcx, rbx
call sub.KERNEL32.DLL_CloseHandle
mov r14, qword [rsp + 0x120]
mov r15, qword [rsp + 0x118]
mov r12, qword [rsp + 0x110]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x150], rax
movups xmm0, xmmword [rsp + 0x38]
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x168], rax
movups xmm1, xmmword [rsp + 0x128]
movups xmmword [rsp + 0x158], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x78], rax
mov rsi, qword [0x140102230]
test rsi, rsi
je 0x14005882c
mov rdi, qword [0x140102240]
test rdi, rdi
je 0x1400587fe
add rsi, 0x28
jmp 0x1400587c9
add rsi, 0x40
dec rdi
je 0x1400587fe
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400587e0
mov rcx, qword [rsi - 8]
mov r8d, 1
call fcn.140002ef0
mov rdx, qword [rsi - 0x18]
test rdx, rdx
je 0x1400587c0
mov rcx, qword [rsi - 0x20]
shl rdx, 4
mov r8d, 8
call fcn.140002ef0
jmp 0x1400587c0
mov rdx, qword [0x140102238]
test rdx, rdx
je 0x140058820
mov rcx, qword [0x140102230]
shl rdx, 6
mov r8d, 8
call fcn.140002ef0
lea rcx, [0x140102248]
call fcn.140007ab0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmm2, xmmword [rsp + 0x70]
movups xmmword [0x140102250], xmm2
movups xmmword [0x140102240], xmm1
movups xmmword [0x140102230], xmm0
xor ecx, ecx
sub r12, 1
cmovae rcx, r12
lea r9, [0x140102230]
mov rdx, r15
mov r8, r14
call fcn.140058960
nop
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x3c0
call fcn.14008e910
ud2
mov ecx, 8
mov edx, 0x10
call fcn.14008e910
ud2