Function at 0x140001000
Capabilities:
Enumerate process modules

Disassembly:
push rbp
sub rsp, 0x340
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2b8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rdx
mov qword [rbp + 0x2a8], rdx
mov dword [rbp + 0x2a4], ecx
mov edx, dword [rbp + 0x2a4]
mov ecx, 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 8], rax
jmp 0x140001045
mov rax, qword [rbp - 8]
mov qword [rbp + 0x298], rax
mov rax, 0xffffffffffffffff
cmp qword [rbp + 0x298], rax
jne 0x140001157
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp - 0x18], rax
jmp 0x14000107b
mov rcx, qword [rbp - 0x18]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x140001091
movups xmm0, xmmword [0x14005a6c0]
movaps xmmword [rbp + 0x280], xmm0
movups xmm0, xmmword [0x14005a6b0]
movaps xmmword [rbp + 0x270], xmm0
movups xmm0, xmmword [str.U7E.H]
movaps xmmword [rbp + 0x260], xmm0
movabs rax, 0x6fd19afd91c088f3
mov qword [rbp + 0x28f], rax
lea rcx, [rbp + 0x260]
mov edx, 0x37
call fcn.14000eb50
mov qword [rbp - 0x20], rax
jmp 0x1400010e6
mov rdx, qword [rbp - 0x20]
lea rcx, [0x140077710]
call fcn.140003c70
mov qword [rbp - 0x28], rax
jmp 0x1400010ff
mov rcx, qword [rbp - 0x28]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x140001114
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp - 0x30], rax
jmp 0x14000112b
mov rcx, qword [rbp - 0x30]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x140001141
mov byte [rbp + 0x2b7], 0
mov dword [rbp + 0x25c], 1
jmp 0x1400012d3
mov dword [rbp + 0x20], 0x238
mov rcx, qword [rbp + 0x298]
lea rdx, [rbp + 0x20]
call sub.KERNEL32.dll_Module32First
mov dword [rbp - 0x34], eax
jmp 0x140001176
mov eax, dword [rbp - 0x34]
cmp eax, 0
je 0x1400012ad
jmp 0x140001187
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0x20]
add rdx, 0x30
call fcn.140004010
test al, 1
jne 0x1400011a5
jmp 0x140001284
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp - 0x40], rax
jmp 0x1400011bc
mov rcx, qword [rbp - 0x40]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x1400011d2
movups xmm0, xmmword [0x14005a6e4]
movups xmmword [rbp + 0xd], xmm0
movups xmm0, xmmword [0x14005a6d7]
movaps xmmword [rbp], xmm0
mov rcx, rbp
mov edx, 0x1d
call fcn.14000eb50
mov qword [rbp - 0x48], rax
jmp 0x1400011fe
mov rdx, qword [rbp - 0x48]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp - 0x50], rax
jmp 0x140001217
mov rcx, qword [rbp - 0x50]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x14000122c
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp - 0x58], rax
jmp 0x140001243
mov rcx, qword [rbp - 0x58]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x140001259
mov rcx, qword [rbp + 0x298]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x14000126e
mov byte [rbp + 0x2b7], 1
mov dword [rbp + 0x25c], 1
jmp 0x1400012d3
mov rcx, qword [rbp + 0x298]
lea rdx, [rbp + 0x20]
call sub.KERNEL32.dll_Module32Next
mov dword [rbp - 0x5c], eax
jmp 0x14000129c
mov eax, dword [rbp - 0x5c]
cmp eax, 0
jne 0x140001187
jmp 0x1400012ad
mov rcx, qword [rbp + 0x298]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x1400012c2
mov byte [rbp + 0x2b7], 0
mov dword [rbp + 0x25c], 1
mov rcx, qword [rbp - 0x10]
call fcn.140004040
mov al, byte [rbp + 0x2b7]
and al, 1
movzx eax, al
add rsp, 0x340
pop rbp
ret