Function at 0x140001270
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2180
call fcn.1400025a0
sub rsp, rax
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x2170], rax
mov r8d, dword [0x140005050]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r9, [rsp + 0x30]
mov r8d, 0x2000
lea rdx, [rsp + 0x60]
mov qword [0x140005058], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14000155d
xor r12d, r12d
test dword [rsp + 0x30], 0xfffffff8
mov dword [rsp + 0x20], r12d
jbe 0x14000155d
movabs rsi, 0x7fffffffffffffff
lea r14d, [r12 + 0x16]
movabs rbp, 0x8000000000000000
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x60]
mov r9d, 0x104
mov rdx, qword [rcx + r12*8]
lea rax, [rcx + r12*8]
mov rcx, qword [0x140005058]
lea r8, [rsp + 0x2060]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x140001545
xorps xmm0, xmm0
lea rax, [rsp + 0x2060]
movups xmmword [rsp + 0x38], xmm0
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001370
cmp rbx, rsi
ja 0x1400015e4
cmp rbx, 0x10
jae 0x1400013c4
mov r8, rbx
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x2060]
mov qword [rsp + 0x50], 0xf
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x38], 0
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
jmp 0x140001451
mov rdi, rbx
or rdi, 0xf
cmp rdi, rsi
jbe 0x1400013d9
mov rdi, rsi
lea rax, [rbp + 0x27]
jmp 0x1400013fb
cmp rdi, 0x16
cmovb rdi, r14
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000141a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400015de
mov rcx, rax
call fcn.140001770
test rax, rax
je 0x1400015d7
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000142b
test rcx, rcx
je 0x140001429
call fcn.140001770
mov rsi, rax
jmp 0x14000142b
xor esi, esi
mov r8, rbx
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x2060]
mov qword [rsp + 0x48], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
cmp qword [0x140005078], 0x10
lea r14, [0x140005060]
mov rbp, qword [0x140005070]
lea r15, [rsp + 0x38]
cmovae r14, qword [0x140005060]
cmp rdi, 0x10
cmovae r15, rsi
cmp rbp, rbx
ja 0x1400014f4
sub rbx, rbp
test rbp, rbp
je 0x140001590
movsx r13d, byte [r14]
lea r12, [rbx + r15]
lea r8, [r12 + 1]
mov edx, r13d
sub r8, r15
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400014ef
mov r8, rbp
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400014e2
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov rcx, rbx
mov edx, r13d
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x1400014b0
jmp 0x1400014ef
sub rbx, r15
cmp rbx, 0xffffffffffffffff
jne 0x140001590
mov r12d, dword [rsp + 0x20]
cmp rdi, 0x10
jb 0x14000152b
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001523
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015d7
mov rcx, rsi
call fcn.1400019fc
mov r14d, 0x16
movabs rbp, 0x8000000000000000
movabs rsi, 0x7fffffffffffffff
mov eax, dword [rsp + 0x30]
inc r12d
shr eax, 3
mov dword [rsp + 0x20], r12d
cmp r12d, eax
jb 0x140001320
xor eax, eax
mov rcx, qword [rsp + 0x2170]
xor rcx, rsp
call fcn.140001750
lea r11, [rsp + 0x2180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
mov qword [0x140005048], rbx
cmp rdi, 0x10
jb 0x1400015d2
lea rdx, [rdi + 1]
mov r8, rsi
cmp rdx, 0x1000
jb 0x1400015ca
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub r8, rsi
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400015d7
mov rcx, rsi
call fcn.1400019fc
mov rax, rbx
jmp 0x14000155f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400011b0
int3
call fcn.140001250
int3