Function at 0x18000e1e0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2210]
mov eax, 0x2310
call fcn.1800e8f90
sub rsp, rax
mov rax, qword [0x1801253c0]
xor rax, rsp
mov qword [rbp + 0x2200], rax
xor edi, edi
mov r13d, edi
mov dword [rbp - 0x80], edi
mov rax, qword gs:[0x60]
cmp byte [rax + 2], dil
je 0x18000e23c
mov al, 1
jmp 0x18000e98b
mov ecx, dword [0x180148994]
mov rax, qword gs:[0x58]
mov edx, 8
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x180148ba0], eax
jg 0x18000e9c1
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
mov qword [rbp - 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rbp - 0x40]
mov r8d, 0x2000
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x18000e922
mov r12d, edi
test dword [rbp - 0x40], 0xfffffff8
jbe 0x18000e64f
nop dword [rax]
nop dword [rax + rax]
mov eax, r12d
mov rbx, qword [rbp + rax*8 - 0x10]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rbp + 0x1ff0]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x18000e922
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xffffffff
lea r8, [rbp + 0x1ff0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
xor r8d, r8d
lea rcx, [rbp - 0x38]
call fcn.180033de0
or r13d, 2
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rcx, qword [rbp - 0x38]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
lea r8, [rbp + 0x1ff0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
mov rsi, qword [0x1801496e0]
mov r15, qword [0x1801496e8]
cmp rsi, r15
je 0x18000e5d2
nop word [rax + rax]
lea rax, [rsp + 0x60]
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor edx, edx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rdx
mov rdi, qword [rsi + 0x10]
mov r14, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x18000e3ae
mov r14, qword [rsi]
movabs rcx, 0x7fffffffffffffff
cmp rdi, rcx
ja 0x18000ea09
cmp rdi, 0xf
ja 0x18000e3e3
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], send
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x60], xmm0
jmp 0x18000e484
mov rbx, rdi
or rbx, 0xf
cmp rbx, rcx
jbe 0x18000e402
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x18000e429
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000e44b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000e9f7
mov rcx, rax
call fcn.180093cbc
mov rcx, rax
test rax, rax
je 0x18000e6fb
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000e45a
test rcx, rcx
je 0x18000e457
call fcn.180093cbc
jmp 0x18000e45a
mov rax, rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
movabs rcx, 0x7fffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
mov rdi, qword [rbp - 0x28]
lea r14, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova r14, qword [rbp - 0x38]
cmp rdi, rcx
ja 0x18000ea03
cmp rdi, 0xf
ja 0x18000e4d4
mov qword [rsp + 0x50], rdi
mov eax, send
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
jmp 0x18000e573
mov rbx, rdi
or rbx, 0xf
cmp rbx, rcx
jbe 0x18000e4f3
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x18000e51a
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000e53c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000e9fd
mov rcx, rax
call fcn.180093cbc
mov rcx, rax
test rax, rax
je 0x18000e702
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000e54b
test rcx, rcx
je 0x18000e548
call fcn.180093cbc
jmp 0x18000e54b
mov rax, rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r9, qword [rsp + 0x60]
lea rcx, [rsp + 0x40]
cmp rax, 0xf
cmova rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call fcn.18003e1b0
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.180005610
lea rcx, [rsp + 0x60]
call fcn.180005610
cmp rbx, 0xffffffffffffffff
jne 0x18000e600
add rsi, 0x20
cmp rsi, r15
jne 0x18000e380
mov rax, qword [rbp - 0x50]
cmp rax, qword [rbp - 0x48]
je 0x18000e5ef
lea rdx, [rbp - 0x38]
mov rcx, rax
call fcn.18000d920
add qword [rbp - 0x50], 0x20
jmp 0x18000e600
lea r8, [rbp - 0x38]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.180044b00
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x18000e63b
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000e636
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e709
call fcn.180093b94
inc r12d
mov eax, dword [rbp - 0x40]
shr eax, 3
xor edi, edi
cmp r12d, eax
jb 0x18000e2b0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x60], rdi
mov rdx, qword [rbp - 0x50]
mov r8, rdx
mov rcx, qword [rbp - 0x58]
sub r8, rcx
sar r8, 5
xor r9d, r9d
call fcn.180048620
mov rdx, qword [0x180148ac8]
mov rcx, qword [0x180148ac0]
mov r8, rdx
sub r8, rcx
sar r8, 5
xor r9d, r9d
call fcn.180048620
mov rsi, qword [0x180148ac0]
mov r14, qword [rbp - 0x50]
mov r15, qword [0x180148ac8]
mov rdx, qword [rbp - 0x58]
mov rdi, rdx
mov rbx, qword [rbp - 0x68]
cmp rdx, r14
je 0x18000e74d
nop dword [rax + rax]
cmp rsi, r15
je 0x18000e749
mov rdx, rsi
mov rcx, rdi
call fcn.18003b760
test al, al
jns 0x18000e729
cmp rbx, qword [rbp - 0x60]
je 0x18000e710
mov rdx, rdi
mov rcx, rbx
call fcn.18000d920
mov rbx, qword [rbp - 0x68]
add rbx, 0x20
mov qword [rbp - 0x68], rbx
add rdi, 0x20
jmp 0x18000e740
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.180044b00
mov rbx, qword [rbp - 0x68]
add rdi, 0x20
jmp 0x18000e740
mov rdx, rdi
mov rcx, rsi
call fcn.18003b760
test al, al
js 0x18000e73c
add rdi, 0x20
add rsi, 0x20
cmp rdi, r14
jne 0x18000e6c0
mov rdx, qword [rbp - 0x58]
cmp rdi, r14
je 0x18000e791
cmp rbx, qword [rbp - 0x60]
je 0x18000e771
mov rdx, rdi
mov rcx, rbx
call fcn.18000d920
mov rbx, qword [rbp - 0x68]
add rbx, 0x20
mov qword [rbp - 0x68], rbx
jmp 0x18000e784
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.180044b00
mov rbx, qword [rbp - 0x68]
add rdi, 0x20
cmp rdi, r14
jne 0x18000e752
mov rdx, qword [rbp - 0x58]
cmp qword [rbp - 0x70], rbx
je 0x18000e79d
inc dword [0x180148f90]
mov r8, qword [rbp - 0x50]
sub r8, rdx
sar r8, 5
call fcn.18003da80
mov rbx, qword [rbp - 0x70]
cmp dword [0x180148f90], 1
jle 0x18000e8ab
mov rsi, qword [rbp - 0x68]
cmp rbx, rsi
je 0x18000e89f
movabs r14, 0x7fffffffffffffff
nop word [rax + rax]
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rcx, qword [rbx + 0x10]
mov rax, r14
sub rax, rcx
cmp rax, 9
jb 0x18000e9bb
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18000e808
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.NEW_DLL:
lea rcx, [rbp - 0x38]
call fcn.180033cc0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
mov rcx, rdi
call fcn.1800431f0
lea rdx, [0x18003afb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x18000e88e
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000e889
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e8a4
call fcn.180093b94
add rbx, 0x20
cmp rbx, rsi
jne 0x18000e7e0
mov rbx, qword [rbp - 0x70]
mov sil, 1
jmp 0x18000e8ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor sil, sil
test rbx, rbx
je 0x18000e925
mov rdi, qword [rbp - 0x68]
cmp rbx, rdi
je 0x18000e8d5
nop dword [rax]
mov rcx, rbx
call fcn.180005610
add rbx, 0x20
cmp rbx, rdi
jne 0x18000e8c0
mov rbx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x60]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000e908
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000e908
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180093b94
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], 0
jmp 0x18000e925
mov sil, 1
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x18000e987
mov rdi, qword [rbp - 0x50]
cmp rbx, rdi
je 0x18000e94c
mov rcx, rbx
call fcn.180005610
add rbx, 0x20
cmp rbx, rdi
jne 0x18000e937
mov rbx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x48]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x18000e97f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000e97f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180093b94
movzx eax, sil
mov rcx, qword [rbp + 0x2200]
xor rcx, rsp
call fcn.1800935b0
lea r11, [rsp + 0x2310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180006090
nop
lea rcx, [0x180148ba0]
call fcn.180093c44
cmp dword [0x180148ba0], 0xffffffff
jne 0x18000e263
lea rcx, [0x1800ee690]
call fcn.180093b74
lea rcx, [0x180148ba0]
call fcn.180093bd8
jmp 0x18000e263
call fcn.180005ff0
nop
call fcn.180005ff0
int3
call fcn.180006090
nop
call fcn.180006090
int3