Function at 0x140063d60
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140087010]
xor rax, rsp
mov qword [rbp + 0x188], rax
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x142c
mov eax, dword [rcx + rbx]
mov edi, 0x14e8
test al, 1
jne 0x140063de0
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rdi + 9], 0x177
mov dword [rbx + rdi], 0xbd000114
mov dword [rbx + rdi + 4], 0x4aff2ce4
mov byte [rbx + rdi + 8], 0x33
lea rcx, [0x1400709b0]
call fcn.1400684c0
nop
lea rax, [rdi + rbx]
cmp byte [rax + 0xa], 0
je 0x140063e15
xor byte [rax], 0x5b
xor byte [rax + 1], 0x77
xor byte [rax + 2], 0x65
xor byte [rax + 3], 0xcf
xor byte [rax + 4], 0x93
xor byte [rax + 5], 0x4d
xor byte [rax + 6], 0x8b
xor byte [rax + 7], 0x29
xor byte [rax + 8], 0x5b
xor byte [rax + 9], 0x77
mov byte [rax + 0xa], 0
mov rdx, qword [0x1400884e0]
mov qword [rdx], rax
mov ecx, 0x14b4
mov eax, dword [rcx + rbx]
mov edi, 0x17d8
test al, 1
jne 0x140063e6d
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rdi + 0xd], 0x155
mov dword [rbx + rdi], 0x9dda83c2
mov dword [rbx + rdi + 4], 0xbe4d34ae
mov dword [rbx + rdi + 8], 0x97dadbe5
mov byte [rbx + rdi + 0xc], 0xbc
lea rcx, [0x140070990]
call fcn.1400684c0
nop
mov rdx, qword [0x1400884e0]
lea rax, [rbx + rdi]
cmp byte [rax + 0xe], 0
je 0x140063eb2
xor byte [rax], 0x8d
xor byte [rax + 1], 0xf5
xor byte [rax + 2], 0xbf
xor byte [rax + 3], 0xef
xor byte [rax + 4], 0xd9
xor byte [rax + 5], 0x55
xor byte [rax + 6], 0x39
xor byte [rax + 7], 0xdd
xor byte [rax + 8], 0x8d
xor byte [rax + 9], 0xf5
xor byte [rax + 0xa], 0xbf
xor byte [rax + 0xb], 0xef
xor byte [rax + 0xc], 0xd9
xor byte [rax + 0xd], 0x55
mov byte [rax + 0xe], 0
mov qword [rdx + 8], rax
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdx, qword [0x1400884e0]
mov qword [rdx + 0x98], rax
test rax, rax
jne 0x140063feb
mov ecx, 0x14a8
mov eax, dword [rcx + rbx]
mov edi, 0x1738
test al, 1
jne 0x140063f1e
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rdi + 0xb], 0x175
mov dword [rbx + rdi], 0x1159803b
mov dword [rbx + rdi + 4], 0x73aaf46d
mov word [rbx + rdi + 8], 0x8639
mov byte [rbx + rdi + 0xa], 0x40
lea rcx, [0x140070950]
call fcn.1400684c0
nop
add rdi, rbx
cmp byte [rdi + 0xc], 0
je 0x140063f5a
xor byte [rdi], 0x5d
xor byte [rdi + 1], 0xe9
xor byte [rdi + 2], 0x37
xor byte [rdi + 3], 0x75
xor byte [rdi + 4], 0x4d
xor byte [rdi + 5], 0x83
xor byte [rdi + 6], 0xc3
xor byte [rdi + 7], 0x1d
xor byte [rdi + 8], 0x5d
xor byte [rdi + 9], 0xe9
xor byte [rdi + 0xa], 0x37
xor byte [rdi + 0xb], 0x75
mov byte [rdi + 0xc], 0
mov ecx, 0x16c0
mov eax, dword [rcx + rbx]
mov esi, 0x1720
test al, 1
jne 0x140063f99
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rsi + 9], 0x1e9
mov dword [rbx + rsi], 0x1942861e
mov dword [rbx + rsi + 4], 0x72ada329
mov byte [rbx + rsi + 8], 0x29
lea rcx, [0x140070970]
call fcn.1400684c0
nop
lea rcx, [rsi + rbx]
cmp byte [rcx + 0xa], 0
je 0x140063fce
xor byte [rcx], 0x5d
xor byte [rcx + 1], 0xe9
xor byte [rcx + 2], 0x37
xor byte [rcx + 3], 0x75
xor byte [rcx + 4], 0x4d
xor byte [rcx + 5], 0x83
xor byte [rcx + 6], 0xc3
xor byte [rcx + 7], 0x1d
xor byte [rcx + 8], 0x5d
xor byte [rcx + 9], 0xe9
mov byte [rcx + 0xa], 0
mov rdx, rdi
call fcn.140063900
mov rax, qword [0x1400884e0]
xor ecx, ecx
mov qword [rax + 0x98], rcx
jmp 0x140064822
add rdx, 0xa0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
jne 0x1400641a2
movdqa xmm0, xmmword [0x140079c20]
mov dword [rbp + 0x180], 0x225eb6bf
mov word [rbp + 0x184], 0x106f
mov ecx, 0x1638
mov eax, dword [rcx + rbx]
mov edi, 0x15f0
test al, 1
jne 0x14006409e
or eax, 1
mov dword [rcx + rbx], eax
lea rcx, [rbx + rdi]
mov byte [rcx + 0x17], 1
lea rax, [rcx + 0x16]
lea rdx, [rbp + 0x186]
cmp rcx, rdx
ja 0x140064076
lea rdx, [rbp + 0x170]
cmp rax, rdx
jb 0x140064076
movups xmmword [rcx], xmm0
mov eax, dword [rbp + 0x180]
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x184]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0x39
jmp 0x140064091
movups xmmword [rcx], xmm0
mov eax, dword [rbp + 0x180]
mov dword [rcx + 0x10], eax
movzx eax, word [rbp + 0x184]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0x39
lea rcx, [0x140070900]
call fcn.1400684c0
nop
lea rsi, [rbx + rdi]
cmp byte [rsi + 0x17], 0
je 0x140064107
xor byte [rsi], 0xd1
xor byte [rsi + 1], 0xc5
xor byte [rsi + 2], 0x37
xor byte [rsi + 3], 0x4d
xor byte [rsi + 4], 1
xor byte [rsi + 5], 0x63
xor byte [rsi + 6], 0x39
xor byte [rsi + 7], 0xc1
xor byte [rsi + 8], 0xd1
xor byte [rsi + 9], 0xc5
xor byte [rsi + 0xa], 0x37
xor byte [rsi + 0xb], 0x4d
xor byte [rsi + 0xc], 1
xor byte [rsi + 0xd], 0x63
xor byte [rsi + 0xe], 0x39
xor byte [rsi + 0xf], 0xc1
xor byte [rsi + 0x10], 0xd1
xor byte [rsi + 0x11], 0xc5
xor byte [rsi + 0x12], 0x37
xor byte [rsi + 0x13], 0x4d
xor byte [rsi + 0x14], 1
xor byte [rsi + 0x15], 0x63
xor byte [rsi + 0x16], 0x39
mov byte [rsi + 0x17], 0
mov ecx, 0x1574
mov eax, dword [rcx + rbx]
mov edi, 0x1628
test al, 1
jne 0x140064146
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rdi + 9], 0x1c5
mov dword [rbx + rdi], 0x2142aa92
mov dword [rbx + rdi + 4], 0xae574365
mov byte [rbx + rdi + 8], 0xa5
lea rcx, [0x140070930]
call fcn.1400684c0
nop
lea rcx, [rbx + rdi]
cmp byte [rcx + 0xa], 0
je 0x14006417b
xor byte [rcx], 0xd1
xor byte [rcx + 1], 0xc5
xor byte [rcx + 2], 0x37
xor byte [rcx + 3], 0x4d
xor byte [rcx + 4], 1
xor byte [rcx + 5], 0x63
xor byte [rcx + 6], 0x39
xor byte [rcx + 7], 0xc1
xor byte [rcx + 8], 0xd1
xor byte [rcx + 9], 0xc5
mov byte [rcx + 0xa], 0
mov rdx, rsi
call fcn.140063900
mov rax, qword [0x1400884e0]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax + 0x98], xmm0
mov qword [rax + 0xa8], rcx
jmp 0x140064822
mov r10, qword [0x1400884e0]
mov edx, dword [r10 + 0xa8]
mov ecx, dword [r10 + 0xa0]
mov eax, edx
sub eax, ecx
mov dword [r10 + 0xb0], eax
mov r9d, dword [r10 + 0xac]
mov r8d, dword [r10 + 0xa4]
mov eax, r9d
sub eax, r8d
mov dword [r10 + 0xb4], eax
lea eax, [rcx + rdx]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [r10 + 0xb8], eax
lea eax, [r8 + r9]
cdq
sub eax, edx
sar eax, 1
mov dword [r10 + 0xbc], eax
test ecx, ecx
je 0x1400646ae
test eax, eax
je 0x1400646ae
mov rdx, qword [r10 + 8]
call fcn.1400503b0
test al, al
jne 0x140064322
mov ecx, 0x1588
mov eax, dword [rcx + rbx]
mov edi, 0x1528
test al, 1
jne 0x140064261
or eax, 1
mov dword [rcx + rbx], eax
mov dword [rbx + rdi + 0xa], 0x1e3bc92
mov dword [rbx + rdi], 0xab80c2c7
mov dword [rbx + rdi + 4], 0xe891b3c3
mov word [rbx + rdi + 8], 0xc8c8
lea rcx, [0x140070870]
call fcn.1400684c0
nop
add rdi, rbx
cmp byte [rdi + 0xd], 0
je 0x1400642a1
xor byte [rdi], 0xab
xor byte [rdi + 1], 0xad
xor byte [rdi + 2], 0xe1
xor byte [rdi + 3], 0xcf
xor byte [rdi + 4], 0xe3
xor byte [rdi + 5], 0xc3
xor byte [rdi + 6], 0xe3
xor byte [rdi + 7], 0x87
xor byte [rdi + 8], 0xab
xor byte [rdi + 9], 0xad
xor byte [rdi + 0xa], 0xe1
xor byte [rdi + 0xb], 0xcf
xor byte [rdi + 0xc], 0xe3
mov byte [rdi + 0xd], 0
mov ecx, 0x1818
mov eax, dword [rcx + rbx]
mov esi, 0x16b0
test al, 1
jne 0x1400642e0
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rsi + 9], 0x1ad
mov dword [rbx + rsi], 0xa394c2e8
mov dword [rbx + rsi + 4], 0xe88de387
mov byte [rbx + rsi + 8], 0xdf
lea rcx, [0x140070890]
call fcn.1400684c0
nop
lea rcx, [rsi + rbx]
cmp byte [rcx + 0xa], 0
je 0x140064315
xor byte [rcx], 0xab
xor byte [rcx + 1], 0xad
xor byte [rcx + 2], 0xe1
xor byte [rcx + 3], 0xcf
xor byte [rcx + 4], 0xe3
xor byte [rcx + 5], 0xc3
xor byte [rcx + 6], 0xe3
xor byte [rcx + 7], 0x87
xor byte [rcx + 8], 0xab
xor byte [rcx + 9], 0xad
mov byte [rcx + 0xa], 0
mov rdx, rdi
call fcn.140063900
jmp 0x140064822
mov rax, qword [0x1400884e0]
mov rsi, qword [rax + 8]
mov rdi, qword [0x1400884d8]
cmp byte [rdi], 0
je 0x1400643d1
mov edx, dword [rdi + 4]
mov r14d, 0x18
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
test rax, rax
je 0x1400643c8
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1400643c8
mov rdx, rsi
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x1400644e0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1400643c8
nop dword [rax]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x1400644e0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1400643a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x1754
mov eax, dword [rcx + rbx]
mov edi, 0x1648
test al, 1
jne 0x140064423
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rdi + 0xb], 0x145
mov dword [rbx + rdi], 0x21e0460f
mov dword [rbx + rdi + 4], 0x954ed261
mov word [rbx + rdi + 8], 0x4516
mov byte [rbx + rdi + 0xa], 0xe4
lea rcx, [0x140070830]
call fcn.1400684c0
nop
add rdi, rbx
cmp byte [rdi + 0xc], 0
je 0x14006445f
xor byte [rdi], 0x63
xor byte [rdi + 1], 0x29
xor byte [rdi + 2], 0x81
xor byte [rdi + 3], 0x45
xor byte [rdi + 4], 0x41
xor byte [rdi + 5], 0xbf
xor byte [rdi + 6], 0x21
xor byte [rdi + 7], 0xf1
xor byte [rdi + 8], 0x63
xor byte [rdi + 9], 0x29
xor byte [rdi + 0xa], 0x81
xor byte [rdi + 0xb], 0x45
mov byte [rdi + 0xc], 0
mov ecx, 0x1674
mov eax, dword [rcx + rbx]
mov esi, 0x18f0
test al, 1
jne 0x14006449e
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rsi + 9], 0x129
mov dword [rbx + rsi], 0x29f44620
mov dword [rbx + rsi + 4], 0x9e4f9f25
mov byte [rbx + rsi + 8], 0x17
lea rcx, [0x140070850]
call fcn.1400684c0
nop
lea rcx, [rbx + rsi]
cmp byte [rcx + 0xa], 0
je 0x1400644d3
xor byte [rcx], 0x63
xor byte [rcx + 1], 0x29
xor byte [rcx + 2], 0x81
xor byte [rcx + 3], 0x45
xor byte [rcx + 4], 0x41
xor byte [rcx + 5], 0xbf
xor byte [rcx + 6], 0x21
xor byte [rcx + 7], 0xf1
xor byte [rcx + 8], 0x63
xor byte [rcx + 9], 0x29
mov byte [rcx + 0xa], 0
mov rdx, rdi
call fcn.140063900
jmp 0x140064822
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x48]
mov eax, dword [rsp + 0x50]
mov qword [rdi + 0x10], rsi
mov qword [rdi + r14], rax
test rsi, rsi
je 0x1400643d1
mov ecx, 0x130
call fcn.1400683a0
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x130
mov rcx, rax
call fcn.1400694a4
mov byte [rbx], 0
xor ecx, ecx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x28], rcx
mov qword [rbx + 0x30], rcx
xor eax, eax
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], rcx
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], rcx
mov qword [rbx + 0x60], rcx
mov qword [rbx + 0x68], rcx
mov qword [rbx + 0x70], rcx
mov qword [rbx + 0x78], rcx
mov qword [rbx + 0x110], rcx
mov qword [rbx + 0x118], rcx
mov qword [rbx + 0x120], rcx
mov qword [0x1400884e8], rbx
mov rdx, rsi
call fcn.14005c0c0
test al, al
jne 0x1400646a7
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x15a8
mov eax, dword [rcx + rbx]
mov edi, 0x1688
test al, 1
jne 0x1400645e6
or eax, 1
mov dword [rcx + rbx], eax
mov dword [rbx + rdi + 0xa], 0x173ae9f
mov dword [rbx + rdi], 0xb985b6f5
mov dword [rbx + rdi + 4], 0x1b41ce53
mov word [rbx + rdi + 8], 0xbae0
lea rcx, [0x1400707f0]
call fcn.1400684c0
nop
add rdi, rbx
cmp byte [rdi + 0xd], 0
je 0x140064626
xor byte [rdi], 0x93
xor byte [rdi + 1], 0xdf
xor byte [rdi + 2], 0xeb
xor byte [rdi + 3], 0xdd
xor byte [rdi + 4], 0x73
xor byte [rdi + 5], 0xa1
xor byte [rdi + 6], 0x27
xor byte [rdi + 7], 0x7d
xor byte [rdi + 8], 0x93
xor byte [rdi + 9], 0xdf
xor byte [rdi + 0xa], 0xeb
xor byte [rdi + 0xb], 0xdd
xor byte [rdi + 0xc], 0x73
mov byte [rdi + 0xd], 0
mov ecx, 0x18fc
mov eax, dword [rcx + rbx]
mov esi, 0x1758
test al, 1
jne 0x140064665
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rsi + 9], 0x1df
mov dword [rbx + rsi], 0xb19eb0d0
mov dword [rbx + rsi + 4], 0x12498117
mov byte [rbx + rsi + 8], 0xe7
lea rcx, [0x140070810]
call fcn.1400684c0
nop
lea rcx, [rbx + rsi]
cmp byte [rcx + 0xa], 0
je 0x14006469a
xor byte [rcx], 0x93
xor byte [rcx + 1], 0xdf
xor byte [rcx + 2], 0xeb
xor byte [rcx + 3], 0xdd
xor byte [rcx + 4], 0x73
xor byte [rcx + 5], 0xa1
xor byte [rcx + 6], 0x27
xor byte [rcx + 7], 0x7d
xor byte [rcx + 8], 0x93
xor byte [rcx + 9], 0xdf
mov byte [rcx + 0xa], 0
mov rdx, rdi
call fcn.140063900
jmp 0x140064822
mov al, 1
jmp 0x140064824
movdqa xmm0, xmmword [0x140079610]
mov word [rbp + 0x180], 0xe1f0
mov ecx, 0x1460
mov eax, dword [rcx + rbx]
mov edi, 0x1610
test al, 1
jne 0x14006472d
or eax, 1
mov dword [rcx + rbx], eax
lea rcx, [rbx + rdi]
mov byte [rcx + 0x13], 1
lea rax, [rcx + 0x12]
lea rdx, [rbp + 0x182]
cmp rcx, rdx
ja 0x14006470e
lea rdx, [rbp + 0x170]
cmp rax, rdx
jb 0x14006470e
movups xmmword [rcx], xmm0
movzx eax, word [rbp + 0x180]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], 0x75
jmp 0x140064720
movups xmmword [rcx], xmm0
movzx eax, word [rbp + 0x180]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], 0x75
lea rcx, [0x1400708b0]
call fcn.1400684c0
nop
add rdi, rbx
cmp byte [rdi + 0x13], 0
je 0x140064785
xor byte [rdi], 0x95
xor byte [rdi + 1], 0x93
xor byte [rdi + 2], 0x75
xor byte [rdi + 3], 0x97
xor byte [rdi + 4], 0xa3
xor byte [rdi + 5], 0xf3
xor byte [rdi + 6], 0x2b
xor byte [rdi + 7], 0x65
xor byte [rdi + 8], 0x95
xor byte [rdi + 9], 0x93
xor byte [rdi + 0xa], 0x75
xor byte [rdi + 0xb], 0x97
xor byte [rdi + 0xc], 0xa3
xor byte [rdi + 0xd], 0xf3
xor byte [rdi + 0xe], 0x2b
xor byte [rdi + 0xf], 0x65
xor byte [rdi + 0x10], 0x95
xor byte [rdi + 0x11], 0x93
xor byte [rdi + 0x12], 0x75
mov byte [rdi + 0x13], 0
mov ecx, 0x151c
mov eax, dword [rcx + rbx]
mov esi, 0x18b8
test al, 1
jne 0x1400647c4
or eax, 1
mov dword [rcx + rbx], eax
mov word [rbx + rsi + 9], 0x193
mov dword [rbx + rsi], 0xfb00fcd6
mov dword [rbx + rsi + 4], 0xa45d3c7
mov byte [rbx + rsi + 8], 0xe1
lea rcx, [0x1400708e0]
call fcn.1400684c0
nop
lea rcx, [rbx + rsi]
cmp byte [rcx + 0xa], 0
je 0x1400647f9
xor byte [rcx], 0x95
xor byte [rcx + 1], 0x93
xor byte [rcx + 2], 0x75
xor byte [rcx + 3], 0x97
xor byte [rcx + 4], 0xa3
xor byte [rcx + 5], 0xf3
xor byte [rcx + 6], 0x2b
xor byte [rcx + 7], 0x65
xor byte [rcx + 8], 0x95
xor byte [rcx + 9], 0x93
mov byte [rcx + 0xa], 0
mov rdx, rdi
call fcn.140063900
mov rax, qword [0x1400884e0]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax + 0x98], xmm0
mov qword [rax + 0xa8], rcx
mov qword [rax + 0xb8], rcx
xor al, al
mov rcx, qword [rbp + 0x188]
xor rcx, rsp
call fcn.140068380
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret