Function at 0x140088650
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11f0]
mov eax, 0x12f0
call fcn.1400cfbe0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x1340], rbx
mov rax, qword [0x1401a3008]
xor rax, rsp
mov qword [rbp + 0x11e0], rax
mov r13, rdx
mov r14, rcx
mov qword [rsp + 0x70], rdx
xor r15d, r15d
mov dword [rsp + 0x24], r15d
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140022800
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp - 0x58]
call fcn.140022aa0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x58]
call fcn.1400cc0c0
nop
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.1400cc750
nop
cmp r13, rax
je 0x140088704
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, r13
call fcn.140022aa0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x80]
call fcn.140022800
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140022800
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
lea r8, [rsp + 0x7c]
mov edx, 0x1000
lea rcx, [rbp - 0x30]
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x140088756
mov qword [r14], r15
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], r15
jmp 0x1400888cf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov dword [rsp + 0x20], eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xfd0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x78], 0x103
mov r12d, dword [rsp + 0x7c]
shr r12d, 2
mov esi, r15d
test r12d, r12d
je 0x1400888b8
mov rdi, r15
nop word [rax + rax]
mov r8d, dword [rbp + rdi*4 - 0x30]
cmp r8d, ebx
je 0x140088892
mov word [rbp + 0xfd0], r15w
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140088832
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400887e7
mov dword [rsp + 0x78], 0x103
jmp 0x1400887f1
cmp dword [rsp + 0x78], 0x103
jne 0x140088828
lea r9, [rbp - 0x60]
mov r8d, 8
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x140088828
mov r9d, 0x104
lea r8, [rbp + 0xfd0]
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.WS2_32.dll_htonl]
nop
lea r8, [rsp + 0x28]
lea rdx, [rbp + 0xfd0]
mov rcx, r13
call fcn.1400924c0
movzx r15d, al
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + select]
test rax, rax
je 0x140088886
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
test r15b, r15b
jne 0x1400888a1
mov ebx, dword [rsp + 0x20]
xor r15d, r15d
inc esi
inc rdi
cmp esi, r12d
jae 0x1400888b8
jmp 0x1400887a0
mov eax, dword [rbp + rdi*4 - 0x30]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call fcn.14008f230
mov rax, qword [rbp - 0x80]
mov qword [r14], rax
mov rax, qword [rbp - 0x78]
mov qword [r14 + 8], rax
mov rax, qword [rbp - 0x70]
mov qword [r14 + 0x10], rax
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x58]
call fcn.140022800
nop
xor r8d, r8d
mov dl, 1
mov rcx, r13
call fcn.140022800
mov rax, r14
mov rcx, qword [rbp + 0x11e0]
xor rcx, rsp
call fcn.1400ca980
mov rbx, qword [rsp + 0x1340]
add rsp, 0x12f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret