Function at 0x14007d240
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rbx
push rdi
push r12
push r15
lea rbp, [rsp - 0x940]
sub rsp, 0xa40
mov rax, qword [0x14010b100]
xor rax, rsp
mov qword [rbp + 0x930], rax
mov r12, rcx
xor edx, edx
mov ecx, 2
mov r15d, r9d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, qword [rbp + 0x800]
mov rbx, rax
mov dword [rbp - 0x80], 0x238
nop dword [rax]
lea rdx, [0x1400f40e8]
lea rcx, [rbp - 0x54]
call fcn.14009d198
test eax, eax
jne 0x14007d2c7
mov edi, dword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14010e688], rax
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14007d290
test edi, edi
je 0x14007d8ec
mov qword [rsp + 0xa70], rsi
mov edx, edi
mov qword [rsp + 0xa78], r13
mov ecx, 0x18
mov qword [rsp + 0xa80], r14
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x3c0], 0x438
lea rdx, str.client.dll
lea rcx, [rbp + 0x3f0]
call fcn.14009d198
xor r13d, r13d
mov rcx, rbx
test eax, eax
je 0x14007d345
lea rdx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14007d312
mov r14d, r13d
jmp 0x14007d352
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rbp + 0x3e8]
mov edx, edi
mov qword [rsp + 0x60], r14
mov ecx, 0x18
mov rbx, r13
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x438
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14007d3b8
nop dword [rax]
nop word [rax + rax]
lea rdx, str.client.dll
lea rcx, [rbp - 0x50]
call fcn.14009d198
test eax, eax
lea rdx, [rbp - 0x80]
mov rcx, rsi
cmove rbx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14007d390
mov rsi, qword [rsp + 0xa70]
mov qword [rsp + 0x68], rbx
test r14, r14
je 0x14007d912
test rbx, rbx
je 0x14007d912
lea rdx, str.Process_ID:
lea rcx, [0x14010cfd0]
call fcn.14007df50
mov edx, edi
mov rcx, rax
call fcn.14007dd40
mov rcx, rax
call fcn.14007e200
lea rdx, str.client.dll_Module:
lea rcx, [0x14010cfd0]
call fcn.14007df50
mov rcx, qword [rax]
movsxd r8, dword [rcx + 4]
mov rcx, rax
mov edx, dword [r8 + rax + 0x18]
and edx, 0xfffff9ff
bts edx, 0xb
mov dword [r8 + rax + 0x18], edx
mov rdx, r14
call fcn.14007d940
mov rcx, rax
call fcn.14007e200
lea rdx, str.client.dll_Base_Address:
lea rcx, [0x14010cfd0]
call fcn.14007df50
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, rbx
mov rcx, rax
call fcn.14007db40
mov rcx, rax
call fcn.14007e200
xorps xmm0, xmm0
mov dword [rbp + 0x8c8], 0xb000
xor eax, eax
mov dword [rbp + 0x8cc], 0xa000
mov qword [rbp + 0x838], rax
xorps xmm1, xmm1
mov qword [rbp + 0x8f0], rax
mov ecx, 1
mov qword [rbp + 0x8c0], rax
lea rax, [0x14007d1c0]
mov qword [rbp + 0x830], rax
lea rax, str.Kerose_CS_v1
mov qword [rbp + 0x868], rax
movups xmmword [rbp + 0x848], xmm0
mov qword [rbp + 0x8f8], r13
movups xmmword [rbp + 0x858], xmm0
mov qword [rbp + 0x820], r12
movaps xmmword [rbp + 0x870], xmm1
movups xmmword [rbp + 0x880], xmm0
mov dword [rbp + 0x828], 0x50
movups xmmword [rbp + 0x890], xmm0
mov qword [rbp + 0x840], r12
movups xmmword [rbp + 0x8a0], xmm0
mov dword [rbp + 0x82c], 3
movups xmmword [rbp + 0x8b0], xmm0
movdqa xmmword [rbp + 0x8d0], xmm0
movdqa xmmword [rbp + 0x8e0], xmm1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea rcx, [rbp + 0x828]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rbp + 0x840]
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x868]
mov ecx, 0x80028
mov qword [rsp + 0x58], r13
mov r8, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 0x438
mov dword [rsp + 0x30], 0x780
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r9d, 2
mov r8b, 0xff
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xorps xmm0, xmm0
mov qword [rbp + 0x878], rbx
lea rdx, [rbp + 0x900]
mov rcx, rbx
movups xmmword [rbp + 0x900], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rbp + 0x878]
lea rdx, [rbp + 0x910]
xorps xmm0, xmm0
movups xmmword [rbp + 0x910], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rbp + 0x878]
lea rdx, [rbp + 0x800]
mov qword [rbp + 0x800], r13
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x800]
lea rdx, [rbp + 0x808]
mov rcx, qword [rbp + 0x878]
mov dword [rbp + 0x808], eax
mov eax, dword [rbp + 0x804]
mov dword [rbp + 0x80c], eax
mov eax, dword [rbp + 0x908]
mov dword [rbp + 0x810], eax
mov eax, dword [rbp + 0x90c]
mov dword [rbp + 0x814], eax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rax, qword [rbp + 0x878]
xor r9d, r9d
mov qword [rbp + 0x8b0], rax
xor r8d, r8d
lea rax, [rbp + 0x8d8]
mov dword [rbp + 0x888], 0x90
mov qword [rsp + 0x58], rax
mov edx, 1
lea rax, [rbp + 0x8f0]
mov dword [rbp + 0x88c], 1
mov qword [rsp + 0x50], rax
xor ecx, ecx
lea rax, [rbp + 0x8d0]
mov dword [rbp + 0x890], 0x1c
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x8e0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x880]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x8c8]
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x89c], 1
mov dword [rbp + 0x8a4], 0x20
mov dword [rbp + 0x8a8], 2
mov qword [rbp + 0x8b8], 1
mov dword [rbp + 0x8c0], 2
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
mov rcx, qword [rbp + 0x8e0]
lea r9, [rbp + 0x8f8]
lea r8, [0x1400f1540]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rdx, qword [rbp + 0x8f8]
test rdx, rdx
je 0x14007d76f
mov rcx, qword [rbp + 0x8d0]
lea r9, [rbp + 0x8e8]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x8f8]
mov rax, qword [rcx]
call qword [rax + 0x10]
call fcn.140082230
mov rcx, qword [rbp + 0x878]
mov edx, r15d
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbp + 0x878]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.14002fad0
mov rbx, qword [0x14010e730]
mov rcx, qword [rbx + 0x38]
call fcn.140053ae0
movss xmm2, dword [0x1400f5128]
lea rdx, str.C:WindowsFontsVerdana.ttf
mov rcx, qword [rbx + 0x38]
call fcn.140053c50
movss xmm2, dword [0x1400f512c]
lea rdx, str.C:WindowsFonts_verdanab.ttf
mov rcx, qword [rbx + 0x38]
mov qword [0x14010e878], rax
call fcn.140053c50
movss xmm2, dword [0x1400f5128]
lea rdx, str.C:WindowsFonts_verdanab.ttf
mov rcx, qword [rbx + 0x38]
mov qword [0x14010e880], rax
call fcn.140053c50
movss xmm2, dword [0x1400f5124]
lea rdx, str.C:WindowsFonts_verdanai.ttf
mov rcx, qword [rbx + 0x38]
mov qword [0x14010e870], rax
call fcn.140053c50
movss xmm2, dword [0x1400f5128]
lea rdx, str.C:WindowsFonts_verdanab.ttf
mov rcx, qword [rbx + 0x38]
call fcn.140053c50
cmp qword [0x14010eb50], 0xf
lea rdx, [0x14010eb38]
movss xmm2, dword [0x1400f5130]
cmova rdx, qword [0x14010eb38]
mov rcx, qword [rbx + 0x38]
mov qword [0x14010e838], rax
call fcn.140053c50
xor ecx, ecx
mov qword [0x14010e830], rax
call fcn.14004ee40
mov rcx, qword [rbp + 0x878]
call fcn.140059b00
mov rdx, qword [rbp + 0x8d8]
mov rcx, qword [rbp + 0x8d0]
call fcn.140059940
movups xmm0, xmmword [rsp + 0x60]
lea rdx, [rbp + 0x910]
movsd xmm1, qword [rsp + 0x70]
lea rcx, [rbp + 0x820]
movaps xmmword [rbp + 0x910], xmm0
movsd qword [rbp + 0x920], xmm1
call fcn.14002a9d0
mov r13, qword [rsp + 0xa78]
xor eax, eax
mov r14, qword [rsp + 0xa80]
mov rcx, qword [rbp + 0x930]
xor rcx, rsp
call fcn.140089aa0
add rsp, 0xa40
pop r15
pop r12
pop rdi
pop rbx
pop rbp
ret
lea rdx, str.Failed_to_find_process_ID.
lea rcx, [0x14010d0f0]
call fcn.14007df50
mov rcx, rax
call fcn.14007df40
mov ecx, 0xffffffff
call fcn.1400939dc
int3
lea rdx, str.Failed_to_get_client.dll_module_or_base_address.
lea rcx, [0x14010d0f0]
call fcn.14007df50
mov rcx, rax
call fcn.14007df40
mov ecx, 0xffffffff
call fcn.1400939dc
int3