Function at 0x14006b540
Capabilities:
Encode data using xor
Enumerate process modules

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov edx, dword [0x1401a5ecc]
mov r14, rcx
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor r15d, r15d
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14006b57d
mov edx, r15d
jmp 0x14006b5f1
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
jne 0x14006b5b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r15
jmp 0x14006b5f1
lea rdx, str.gta_core_five.dll
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x14006b5e6
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x14006b5b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r15
jmp 0x14006b5f1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x58]
add rdx, qword [0x1401a6428]
lea r8, [rbp + 0x1d0]
mov rcx, qword [0x1401a6148]
mov r9d, 8
mov qword [rbp + 0x1d0], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp + 0x1d0]
lea r8, [rbp + 0x1d8]
mov rcx, qword [0x1401a6148]
mov r9d, 8
mov qword [rbp + 0x1d8], r15
mov qword [rsp + 0x20], r15
lea rdx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp qword [r14 + 0x18], 0xf
mov r9, r14
mov rbx, qword [rbp + 0x1d8]
jbe 0x14006b663
mov r9, qword [r14]
mov r11, qword [r14 + 0x10]
mov r10d, r15d
add r11, r9
cmp r9, r11
je 0x14006b6b4
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r9]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r9
movsx eax, cl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
cmp r9, r11
jne 0x14006b680
lea eax, [r10 + r10*8]
mov byte [rbp + 0x1c0], r15b
mov ecx, eax
mov qword [rsp + 0x20], r15
shr ecx, 0xb
lea rdx, [rbx + 0x19]
xor ecx, eax
lea r8, [rbp + 0x1c0]
imul esi, ecx, 0x8001
mov r9d, 1
mov rcx, qword [0x1401a6148]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp + 0x1c0], r15b
jne 0x14006b7b1
nop dword [rax]
mov rcx, qword [0x1401a6148]
lea rdx, [rbx + 0x20]
mov r9d, 4
mov dword [rbp + 0x1c8], r15d
lea r8, [rbp + 0x1c8]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r9d, 8
mov rcx, qword [0x1401a6148]
mov qword [rsp + 0x20], r15
cmp dword [rbp + 0x1c8], esi
jb 0x14006b761
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov rdx, rbx
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rsp + 0x30]
jmp 0x14006b77a
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [0x1401a6148]
lea rdx, [rbx + 0x19]
mov r9d, 1
mov byte [rbp + 0x1c0], r15b
lea r8, [rbp + 0x1c0]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp + 0x1c0], r15b
je 0x14006b700
mov rcx, qword [0x1401a6148]
lea rdx, [rdi + 0x19]
mov r9d, 1
mov byte [rbp + 0x1c8], r15b
lea r8, [rbp + 0x1c8]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp + 0x1c8], r15b
jne 0x14006b85f
mov rcx, qword [0x1401a6148]
lea rdx, [rdi + 0x20]
mov r9d, 4
mov dword [rbp + 0x1c0], r15d
lea r8, [rbp + 0x1c0]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp esi, dword [rbp + 0x1c0]
jb 0x14006b85f
mov rcx, qword [0x1401a6148]
lea rdx, [rdi + 0x28]
mov r9d, 8
mov qword [rbp + 0x1c8], r15
lea r8, [rbp + 0x1c8]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, r14
call fcn.140051760
mov rax, qword [rbp + 0x1c8]
add rsp, 0x288
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, r14
call fcn.140051760
xor eax, eax
add rsp, 0x288
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret