Function at 0x1400080d0
Capabilities:
Enumerate process modules

Disassembly:
push r12
push r15
sub rsp, 0x2b8
mov rax, qword [0x14000d008]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r15, rdx
mov qword [rsp + 0x28], rdx
mov edx, ecx
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140008117
xor al, al
jmp 0x1400083e6
mov qword [rsp + 0x2d8], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x2e0], rbp
mov rcx, rax
mov qword [rsp + 0x2e8], rsi
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2a0], r14
mov dword [rsp + 0x50], 0x238
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1400083ab
mov rdx, 0xffffffffffffffff
lea rax, [rsp + 0x180]
xorps xmm0, xmm0
mov rdi, rdx
movups xmmword [rsp + 0x30], xmm0
mov r8d, 0x16
movabs rcx, 0x7fffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x140008190
cmp rdi, rcx
ja 0x140008402
cmp rdi, 0x10
jae 0x1400081e4
mov r8, rdi
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x180]
mov qword [rsp + 0x48], 0xf
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x30], 0
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
jmp 0x140008274
mov rsi, rdi
or rsi, 0xf
cmp rsi, rcx
jbe 0x1400081f5
mov rsi, rcx
jmp 0x1400081fd
cmp rsi, 0x16
cmovb rsi, r8
mov rcx, rsi
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x14000823d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008408
mov rcx, rax
call fcn.140008df0
test rax, rax
je 0x1400083a4
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14000824e
test rcx, rcx
je 0x14000824c
call fcn.140008df0
mov rbx, rax
jmp 0x14000824e
xor ebx, ebx
mov r8, rdi
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x180]
mov qword [rsp + 0x40], rdi
mov rcx, rbx
mov qword [rsp + 0x48], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
cmp qword [r15 + 0x18], 0x10
mov r14, r15
mov rbp, qword [r15 + 0x10]
jb 0x140008285
mov r14, qword [r15]
cmp rsi, 0x10
lea r15, [rsp + 0x30]
cmovae r15, rbx
cmp rbp, rdi
ja 0x140008310
sub rdi, rbp
test rbp, rbp
je 0x140008364
movsx r13d, byte [r14]
lea r12, [rdi + r15]
lea r8, [r12 + 1]
mov edx, r13d
sub r8, r15
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x14000830b
nop word [rax + rax]
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008302
inc rdi
lea r8, [r12 + 1]
sub r8, rdi
mov rcx, rdi
mov edx, r13d
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x1400082d0
jmp 0x14000830b
sub rdi, r15
cmp rdi, 0xffffffffffffffff
jne 0x14000835f
mov r12, qword [rsp + 0x20]
cmp rsi, 0x10
jb 0x140008343
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000833b
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400083a4
mov rcx, rbx
call fcn.140008e34
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1400083ab
mov r15, qword [rsp + 0x28]
jmp 0x140008165
mov r12, qword [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, 0x10
jb 0x1400083a0
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140008398
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400083a4
mov rcx, rbx
call fcn.140008e34
mov al, 1
jmp 0x1400083b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov r13, qword [rsp + 0x2a8]
mov rdi, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2e8]
mov rbp, qword [rsp + 0x2e0]
mov rbx, qword [rsp + 0x2d8]
mov r14, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140008dd0
add rsp, 0x2b8
pop r15
pop r12
ret
call fcn.140001340
int3
call fcn.1400012a0
int3