Function at 0x140047e10
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14005d040]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor r12d, r12d
mov edx, dword [0x14005da58]
lea ecx, [r12 + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140047eac
lea rdx, str.client.dll
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x140047f21
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140047e81
lea rdx, str.Failed_to_get_process_base_address
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400442e0
lea rdx, [0x1400445a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov ebx, 0xf
mov qword [rsi + 0x18], rbx
mov byte [rsi], r12b
mov rax, rsi
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140048820
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rax, [rbp + 0x1a0]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140047f50
movabs r14, 0x7ffffffffffffffe
cmp rbx, r14
ja 0x14004820d
movabs r13, 0x7fffffffffffffff
mov qword [rsp + 0x48], 7
cmp rbx, 7
ja 0x140047fad
mov qword [rsp + 0x40], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x30], r12w
jmp 0x140048052
mov rax, rbx
or rax, 7
cmp rax, r14
jbe 0x140047fc3
lea rcx, [r13*2]
jmp 0x140047feb
mov r14, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, r13
ja 0x140048207
add rcx, rcx
cmp rcx, 0x1000
jb 0x140048017
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140048207
mov rcx, rax
call fcn.140048cf0
test rax, rax
je 0x1400481e7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140048029
test rcx, rcx
je 0x140048026
call fcn.140048cf0
mov rdi, rax
jmp 0x140048029
mov rdi, r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
lea rcx, [rsp + 0x30]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
cmova rcx, r8
mov rax, qword [rsp + 0x40]
lea r15, [rcx + rax*2]
lea rdi, [rsp + 0x30]
cmova rdi, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov ebx, 0xf
mov qword [rsp + 0x68], rbx
cmp rdi, r15
jne 0x1400480a1
mov byte [rsp + 0x50], 0
jmp 0x1400481a3
mov rax, r15
sub rax, rdi
sar rax, 1
mov r14, r12
cmp rax, r13
ja 0x1400481fb
cmp rax, rbx
jbe 0x140048150
mov rbx, rax
or rbx, 0xf
cmp rbx, r13
jbe 0x1400480fa
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140048cf0
mov rcx, rax
test rax, rax
je 0x140048122
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140048138
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140048129
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140048201
jmp 0x1400480dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140048135
call fcn.140048cf0
jmp 0x140048138
mov rax, r12
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rbx
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x50]
cmp rbx, 0xf
cmova rcx, qword [rsp + 0x50]
movzx eax, byte [rdi]
mov byte [r14 + rcx], al
mov r14, qword [rsp + 0x60]
inc r14
mov qword [rsp + 0x60], r14
add rdi, 2
cmp rdi, r15
je 0x140048183
mov rbx, qword [rsp + 0x68]
jmp 0x140048150
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rax, qword [rsp + 0x50]
mov byte [r14 + rax], 0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x10], xmm1
cmp rdx, 7
jbe 0x140047eee
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400481ee
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400481ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.1400489bc
jmp 0x140047eee
call fcn.14003cd20
int3
call fcn.14003cc80
nop
call fcn.14003cc80
int3
call fcn.14003cd20
int3