Function at 0x180001ee0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1328
call fcn.180006480
sub rsp, rax
mov rax, qword [0x18000a128]
xor rax, rsp
mov qword [rsp + 0x1320], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x98], 0
lea rax, [rsp + 0x1110]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
lea rax, [rsp + 0x94]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x94], 0
mov eax, 0xbcc5eb2a
mov r13d, 0x8bee2cc4
mov r14d, 0x3fd27221
mov r15d, 0x6aafb682
mov edi, 0x176b27a8
mov esi, 0x5ef36a16
jmp 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4e823b1
mov ecx, 0x941f0870
nop word cs:[rax + rax]
cmove eax, ecx
cmp dword [0x18000a170], 0xa
cmovl eax, ecx
cmp eax, 0x3410248
jg 0x180002030
cmp eax, 0xc7e6a486
jle 0x1800020a0
cmp eax, 0xe4cfeab8
jle 0x180002136
cmp eax, 0xf32323de
jle 0x180002236
cmp eax, 0xfd114a54
jle 0x180002443
cmp eax, 0xfd114a55
je 0x1800027ba
cmp eax, 0xffbc1c22
je 0x1800027c4
cmp eax, 0x46d5e9
jne 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa88c5ccc
mov ecx, 0xffbc1c22
jmp 0x180001fb0
cmp eax, 0x355910a8
jle 0x1800020f0
cmp eax, 0x5ef36a15
jle 0x18000216c
cmp eax, 0x6786e816
jle 0x180002275
cmp eax, 0x6aafb681
jle 0x180002465
cmp eax, 0x6aafb682
je 0x1800027e2
cmp eax, 0x6cbc59b0
je 0x180002829
cmp eax, 0x75498543
jne 0x180001fbd
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x80], rax
mov eax, 0xc4166e5
jmp 0x180001fbd
cmp eax, 0xaad02b11
jg 0x1800021b6
cmp eax, 0x977d29db
jg 0x1800022ab
cmp eax, 0x8efbdf99
jle 0x1800024a1
cmp eax, 0x8efbdf9a
je 0x180002836
cmp eax, 0x941f0870
jne 0x180002aaa
mov eax, 0x63c8f016
jmp 0x180001fbd
cmp eax, 0x241e4d89
jg 0x1800021f0
cmp eax, 0x160dd8d1
jg 0x1800022ed
cmp eax, 0x4e823b0
jg 0x1800024c6
cmp eax, 0x3410249
je 0x18000284d
cmp eax, 0x406d1ce
jne 0x180001fbd
mov rax, qword [rsp + 0x78]
mov eax, 0x176b27a8
jmp 0x180001fbd
cmp eax, 0xcf35af2f
jg 0x180002335
cmp eax, 0xc976bd9d
jg 0x1800024fa
cmp eax, 0xc7e6a487
je 0x180002864
cmp eax, 0xc96f2a73
jne 0x180001fbd
mov eax, 0xc5ece97b
jmp 0x180001fbd
cmp eax, 0x49f03318
jg 0x18000237d
cmp eax, 0x3fd27220
jg 0x18000251a
cmp eax, 0x355910a9
je 0x18000286e
cmp eax, 0x3b4158d9
jne 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfd114a55
mov ecx, 0x2ceeded3
jmp 0x180001fb0
cmp eax, 0xbb663df6
jg 0x1800023cc
cmp eax, 0xb2669b58
jg 0x18000254e
cmp eax, 0xaad02b12
je 0x18000288c
cmp eax, 0xabee27db
jne 0x180001fbd
mov eax, dword [rsp + 0x34]
mov eax, 0x241e4d8a
jmp 0x180001fbd
cmp eax, 0x2ceeded2
jg 0x180002404
cmp eax, 0x2651d75b
jg 0x18000258e
cmp eax, 0x241e4d8a
je 0x1800028ae
cmp eax, 0x259ac871
jne 0x180001fbd
mov eax, dword [rsp + 0x94]
shr rax, 2
mov qword [rsp + 0x78], rax
mov eax, 0x68d0da39
jmp 0x180001fbd
cmp eax, 0xeffdae54
jg 0x180002628
cmp eax, 0xe4cfeab9
je 0x1800028d6
cmp eax, 0xe53e6da9
jne 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1ada68a0
mov ecx, 0x3410249
jmp 0x180001fb0
cmp eax, 0x63c8f015
jg 0x180002648
cmp eax, 0x5ef36a16
je 0x1800028f7
cmp eax, 0x5f6eccef
jne 0x180001fbd
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe0c224f5
jmp 0x180001fbd
cmp eax, 0xa510b64b
jg 0x1800026a2
cmp eax, 0x977d29dc
je 0x180002901
cmp eax, 0x9991f7bd
jne 0x180001fbd
mov r8d, dword [rsp + 0x30]
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
mov eax, 0x355910a9
jmp 0x180001fbd
cmp eax, 0x1ada689f
jg 0x1800026c2
cmp eax, 0x160dd8d2
je 0x18000290b
cmp eax, 0x176b27a8
jne 0x180001fbd
mov rax, qword [rsp + 0x78]
mov dword [rsp + 0x48], eax
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x406d1ce
mov ecx, 0xce7d81bd
jmp 0x180001fb0
cmp eax, 0xe0c224f4
jg 0x1800026e7
cmp eax, 0xcf35af30
je 0x18000291a
cmp eax, 0xd6671e04
jne 0x180001fbd
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov eax, 0x6aafb682
jmp 0x180001fbd
cmp eax, 0x4e800f7b
jg 0x180002709
cmp eax, 0x49f03319
je 0x180002931
cmp eax, 0x4cc37c38
jne 0x180001fbd
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x98]
mov r8d, 8
lea r9, [rsp + 0x94]
call sub.KERNEL32.dll_K32EnumProcessModules
mov dword [rsp + 0x34], eax
mov eax, 0x2d73f895
jmp 0x180001fbd
cmp eax, 0xc4247eb0
jg 0x180002752
cmp eax, 0xbb663df7
je 0x180002940
cmp eax, 0xbcc5eb2a
jne 0x180001fbd
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov eax, 0x2c9402d3
jmp 0x180001fbd
cmp eax, 0x30246411
jg 0x180002786
cmp eax, 0x2ceeded3
je 0x18000295e
cmp eax, 0x2d73f895
jne 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xabee27db
mov ecx, 0x241e4d8a
jmp 0x180001fb0
cmp eax, 0xf32323df
je 0x180002975
cmp eax, 0xf75712fb
jne 0x180001fbd
mov eax, 0xc4247eb1
xor ebp, ebp
jmp 0x180001fbd
cmp eax, 0x6786e817
je 0x180002993
cmp eax, 0x68d0da39
jne 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x406d1ce
cmove eax, edi
cmp dword [0x18000a170], 0xa
cmovl eax, edi
jmp 0x180001fbd
cmp eax, 0x8bee2cc4
je 0x1800029bb
cmp eax, 0x8d814242
jne 0x180001fbd
cmp dword [rsp + 0x4c], 0
mov eax, 0x75498543
jmp 0x180002924
cmp eax, 0x4e823b1
je 0x1800029c5
cmp eax, 0xc4166e5
jne 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaad02b12
mov ecx, 0x66ab13c0
jmp 0x180001fb0
cmp eax, 0xc976bd9e
je 0x180001f8d
cmp eax, 0xce7d81bd
jne 0x180001fbd
mov eax, 0xf32323df
jmp 0x180001fbd
cmp eax, 0x3fd27221
je 0x1800029cf
cmp eax, 0x46fd29c9
jne 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1ada68a0
mov ecx, 0xe53e6da9
jmp 0x180001fb0
cmp eax, 0xb2669b59
je 0x1800029d9
cmp eax, 0xbb274878
jne 0x180001fbd
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x88], rax
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa510b64c
mov ecx, 0x977d29dc
jmp 0x180001fb0
cmp eax, 0x2651d75c
je 0x1800029f6
cmp eax, 0x2c9402d3
jne 0x180001fbd
mov rax, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movaps xmm0, xmmword [str.df5serv.exe]
movaps xmmword [rax + 0x60], xmm0
movaps xmm0, xmmword [str.vmrawdsk.sys.]
movaps xmmword [rax + 0x50], xmm0
movaps xmm0, xmmword [str.vboxtray.exe]
movaps xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [str.procexp.exe]
movaps xmmword [rax + 0x30], xmm0
movaps xmm0, xmmword [str.vmware.exe]
movaps xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [str.wireshark.exe]
movaps xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [str.vmsrvc.exe]
movaps xmmword [rax], xmm0
lea rcx, [rsp + 0x110]
mov edx, 0x1000
lea r8, [rsp + 0x94]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
mov eax, 0x259ac871
mov ecx, 0x46d5e9
cmove eax, ecx
jmp 0x180001fbd
cmp eax, 0xeffdae55
je 0x180002a14
cmp eax, 0xf1c300f5
jne 0x180001fbd
mov eax, 0x46fd29c9
jmp 0x180001fbd
cmp eax, 0x63c8f016
je 0x180002a1e
cmp eax, 0x66ab13c0
jne 0x180001fbd
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x80]
mov r8d, 0xe
call fcn.180001aa0
mov dword [rsp + 0x50], eax
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaad02b12
cmove eax, r14d
cmp dword [0x18000a170], 0xa
cmovl eax, r14d
jmp 0x180001fbd
cmp eax, 0xa510b64c
je 0x180002a33
cmp eax, 0xa88c5ccc
jne 0x180001fbd
mov eax, 0xffbc1c22
jmp 0x180001fbd
cmp eax, 0x1ada68a0
je 0x180002a41
cmp eax, 0x240bc49f
jne 0x180001fbd
mov rax, qword [rsp + 0x28]
mov eax, 0x5a13aa63
jmp 0x180001fbd
cmp eax, 0xe0c224f5
je 0x180002a4b
cmp eax, 0xe1219af5
jne 0x180001fbd
mov eax, 0x923efc82
xor ebx, ebx
jmp 0x180001fbd
cmp eax, 0x4e800f7c
je 0x180002a69
cmp eax, 0x5a13aa63
jne 0x180001fbd
cmp qword [rsp + 0x28], 0
setne byte [rsp + 0x22]
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x240bc49f
cmove eax, r13d
cmp dword [0x18000a170], 0xa
cmovl eax, r13d
jmp 0x180001fbd
cmp eax, 0xc4247eb1
je 0x180002a87
cmp eax, 0xc5ece97b
jne 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc96f2a73
mov ecx, 0x6cbc59b0
jmp 0x180001fb0
cmp eax, 0x30246412
je 0x180002a93
cmp eax, 0x340bafe6
jne 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc7e6a487
mov ecx, 0x49f03319
jmp 0x180001fb0
mov eax, 0x3b4158d9
jmp 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa88c5ccc
mov ecx, 0xe1219af5
jmp 0x180001fb0
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov dword [rsp + 0x4c], eax
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd6671e04
cmove eax, esi
cmp dword [0x18000a170], 0xa
cmovl eax, esi
jmp 0x180001fbd
mov eax, 0xe4cfeab9
xor r12d, r12d
jmp 0x180001fbd
cmp dword [rsp + 0x30], 0
mov eax, 0x9991f7bd
mov ecx, 0x63c8f016
cmove eax, ecx
jmp 0x180001fbd
cmp byte [rsp + 0x23], 0
mov eax, 0x5f6eccef
mov ecx, 0x30246412
cmovne eax, ecx
jmp 0x180001fbd
mov eax, 0x340bafe6
jmp 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x240bc49f
mov ecx, 0x5a13aa63
jmp 0x180001fb0
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x80]
mov r8d, 0xe
call fcn.180001aa0
mov eax, 0x66ab13c0
jmp 0x180001fbd
cmp dword [rsp + 0x34], 0
setne byte [rsp + 0x23]
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xabee27db
mov ecx, 0xf1c300f5
jmp 0x180001fb0
mov dword [rsp + 0x24], r12d
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x24]
cmp ecx, eax
mov eax, 0xf75712fb
mov ecx, 0x4e800f7c
cmovb eax, ecx
jmp 0x180001fbd
mov eax, 0x8d814242
jmp 0x180001fbd
mov eax, 0xb2669b59
jmp 0x180001fbd
mov eax, 0xe4cfeab9
mov r12d, dword [rsp + 0x54]
jmp 0x180001fbd
cmp dword [rsp + 0x50], 0
mov eax, 0xeffdae55
mov ecx, 0x5f6eccef
cmove eax, ecx
jmp 0x180001fbd
mov eax, 0xc4247eb1
mov ebp, 1
jmp 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc7e6a487
mov ecx, 0x340bafe6
jmp 0x180001fb0
cmp byte [rsp + 0x22], 0
mov eax, 0x63c8f016
mov ecx, 0x4cc37c38
cmovne eax, ecx
jmp 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc96f2a73
mov ecx, 0xc5ece97b
jmp 0x180001fb0
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd6671e04
cmove eax, r15d
cmp dword [0x18000a170], 0xa
cmovl eax, r15d
jmp 0x180001fbd
mov eax, 0x2651d75c
jmp 0x180001fbd
mov eax, 0xc976bd9e
jmp 0x180001fbd
mov eax, 0xcf35af30
jmp 0x180001fbd
mov rax, qword [rsp + 0x88]
mov eax, dword [rsp + rax*4 + 0x110]
mov dword [rsp + 0x30], eax
mov eax, 0x8efbdf9a
jmp 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfd114a55
mov ecx, 0x3b4158d9
jmp 0x180001fb0
mov eax, 0xbb663df7
jmp 0x180001fbd
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x54], eax
mov eax, 0x160dd8d2
jmp 0x180001fbd
mov eax, dword [rsp + 0x24]
mov eax, 0xbb274878
jmp 0x180001fbd
mov eax, 0xe53e6da9
jmp 0x180001fbd
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4e823b1
mov ecx, 0xc976bd9e
jmp 0x180001fb0
mov eax, dword [0x18000a16c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa510b64c
mov ecx, 0xbb274878
jmp 0x180001fb0
mov eax, 0x923efc82
mov ebx, ebp
jmp 0x180001fbd
lea rax, [rsp + 0x1110]
mov qword [rsp + 0x38], rax
mov eax, 0x6786e817
jmp 0x180001fbd
cmp eax, 0x923efc82
jne 0x180001fbd
mov rax, qword [rsp + 0x40]
mov rax, qword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x1320]
xor rcx, rsp
call fcn.1800064e0
mov eax, ebx
add rsp, 0x1328
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret