Function at 0x180009410
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2450]
mov eax, 0x2550
call fcn.180035e50
sub rsp, rax
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rbp + 0x2440], rax
mov rdi, r8
mov ebx, edx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x50], edx
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], shutdown
mov byte [rsp + 0x58], r15b
lea r8d, [r15 + 4]
lea rdx, str.None
lea rcx, [rsp + 0x58]
call fcn.180011350
nop
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], shutdown
mov byte [rsp + 0x78], r15b
lea r8d, [r15 + 4]
lea rdx, str.None
lea rcx, [rsp + 0x78]
call fcn.180011350
nop
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], shutdown
mov byte [rbp - 0x68], r15b
lea r8d, [r15 + 4]
lea rdx, str.None
lea rcx, [rbp - 0x68]
call fcn.180011350
nop
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], shutdown
mov byte [rbp - 0x48], r15b
lea r8d, [r15 + 4]
lea rdx, str.None
lea rcx, [rbp - 0x48]
call fcn.180011350
nop
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
jne 0x1800095b4
mov eax, dword [rsp + 0x50]
mov dword [rsi], eax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi + 8], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x18], xmm1
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], shutdown
mov byte [rsp + 0x58], r12b
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rsi + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rsi + 0x38], xmm1
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], shutdown
mov byte [rsp + 0x78], r12b
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [rsi + 0x48], xmm0
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [rsi + 0x58], xmm1
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], shutdown
mov byte [rbp - 0x68], r12b
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rsi + 0x68], xmm0
movups xmm1, xmmword [rbp - 0x38]
movups xmmword [rsi + 0x78], xmm1
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], shutdown
mov byte [rbp - 0x48], r12b
jmp 0x180009d11
mov r9d, 0x104
lea r8, [rbp + 0x2020]
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x180009731
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], 7
mov word [rbp], r15w
lea rax, [rbp + 0x2020]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180009600
lea rdx, [rbp + 0x2020]
lea rcx, [rbp]
call fcn.1800111b0
nop
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.180008320
mov rbx, rax
lea rax, [rsp + 0x58]
cmp rax, rbx
je 0x1800096a6
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x180009673
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000966e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d4e
call fcn.180035588
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], shutdown
mov byte [rsp + 0x58], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], shutdown
mov byte [rbx], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1800096e1
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800096dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d4e
call fcn.180035588
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], shutdown
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x180009731
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000972c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d54
call fcn.180035588
lea rcx, [rbp + 0x2020]
call fcn.180008900
cdq
and edx, 7
add eax, edx
sar eax, 3
cdqe
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r9, qword [rsp + 0x58]
lea rdx, [rsp + 0x58]
cmovae rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
add r8, r9
mov rcx, rdi
call fcn.18001eed0
test rax, rax
cmove rax, qword [0x180075978]
mov rdx, rax
lea rcx, [rbp]
call fcn.18001e250
nop
mov r13d, dword [rbp + 8]
test r13b, r13b
je 0x180009921
lea r9, [rsp + 0x30]
mov r8d, 0x2000
lea rdx, [rbp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x180009921
mov r14d, r15d
mov eax, dword [rsp + 0x30]
test rax, 0xfffffffffffffff8
jbe 0x180009921
lea r15, [rbp + 0x20]
nop word [rax + rax]
mov r9d, 0x104
lea r8, [rbp + 0x2230]
mov rdx, qword [r15]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x180009903
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 7
lea rax, [rbp + 0x2230]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180009821
lea rdx, [rbp + 0x2230]
lea rcx, [rbp - 0x20]
call fcn.1800111b0
lea r10, [rbp - 0x20]
mov r9, qword [rbp - 0x20]
mov rdi, qword [rbp - 8]
cmp rdi, 8
cmovae r10, r9
mov rax, qword [rbp - 0x10]
cmp rax, 0xd
jb 0x1800098b7
lea r11, [rax - 0xc]
lea r11, [r10 + r11*2]
mov rbx, r10
mov rax, r11
sub rax, rbx
sar rax, 1
je 0x1800098b7
cmp word [rbx], 0x57
je 0x180009880
add rbx, 2
sub rax, 1
jmp 0x18000986e
mov edx, recv
lea rax, [0x1800772e0]
mov rcx, rax
mov r8, rbx
sub r8, rax
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x1800098b1
add rcx, 2
sub rdx, 1
jne 0x180009895
sub rbx, r10
sar rbx, 1
jmp 0x1800098be
add rbx, 2
jmp 0x180009865
mov rbx, 0xffffffffffffffff
cmp rdi, 8
jb 0x1800098f9
lea rdx, [rdi*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x1800098f1
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d5a
mov rcx, r9
call fcn.180035588
cmp rbx, 0xffffffffffffffff
jne 0x180009a10
inc r14d
add r15, 8
mov ecx, dword [rsp + 0x30]
shr rcx, 3
movsxd rax, r14d
cmp rax, rcx
jb 0x1800097e0
xor r15d, r15d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
mov dword [rsi], eax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi + 8], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x18], xmm1
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], shutdown
mov byte [rsp + 0x58], 0
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rsi + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rsi + 0x38], xmm1
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], shutdown
mov byte [rsp + 0x78], 0
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [rsi + 0x48], xmm0
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [rsi + 0x58], xmm1
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], shutdown
mov byte [rbp - 0x68], 0
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rsi + 0x68], xmm0
movups xmm1, xmmword [rbp - 0x38]
movups xmmword [rsi + 0x78], xmm1
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], shutdown
mov byte [rbp - 0x48], 0
movsx ecx, r13b
sub ecx, 4
je 0x180009ccc
sub ecx, 2
je 0x1800099d2
cmp ecx, 1
jne 0x180009cdc
mov rbx, qword [rbp]
test rbx, rbx
je 0x180009cdc
mov r8, qword [rbx]
mov r8, qword [r8 + 8]
mov rdx, rbx
mov rcx, rbx
call fcn.18001f640
mov edx, 0x48
mov rcx, qword [rbx]
call fcn.180035588
mov edx, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180035588
jmp 0x180009cdc
movsxd rax, r14d
mov rdi, qword [rbp + rax*8 + 0x20]
test rdi, rdi
je 0x18000991e
mov edx, 1
lea rcx, [rbp]
call fcn.18001ea80
mov rcx, rax
call fcn.18001e7e0
mov r8d, eax
add r8, rdi
mov r9d, 0x20
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.180008a40
mov rbx, rax
lea rax, [rsp + 0x78]
cmp rax, rbx
je 0x180009acd
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x180009a98
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009a93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d60
call fcn.180035588
xor r15d, r15d
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], shutdown
mov byte [rsp + 0x78], r15b
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], shutdown
mov byte [rbx], r15b
jmp 0x180009ad0
xor r15d, r15d
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180009b0b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009b06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d60
call fcn.180035588
mov edx, 2
lea rcx, [rbp]
call fcn.18001ea80
mov rcx, rax
call fcn.18001e7e0
mov r8d, eax
add r8, rdi
mov r9d, 0x40
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.180008a40
mov rbx, rax
lea rax, [rbp - 0x68]
cmp rax, rbx
je 0x180009bae
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x180009b80
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009b7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d66
call fcn.180035588
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], shutdown
mov byte [rbp - 0x68], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], shutdown
mov byte [rbx], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180009be9
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009be4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d66
call fcn.180035588
xor edx, edx
lea rcx, [rbp]
call fcn.18001ea80
mov rcx, rax
call fcn.18001e7e0
mov r8d, eax
add r8, rdi
mov r9, qword [rsp + 0x40]
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.180008f20
mov rbx, rax
lea rax, [rbp - 0x48]
cmp rax, rbx
je 0x180009c88
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x180009c5a
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009c55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d48
call fcn.180035588
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], shutdown
mov byte [rbp - 0x48], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], shutdown
mov byte [rbx], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180009cc3
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009cbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009d48
call fcn.180035588
mov r13d, dword [rbp + 8]
jmp 0x180009921
bt r13d, 8
jae 0x180009cdc
mov rcx, qword [rbp]
call fcn.18003eac8
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x180009d11
lea rbx, [rcx - 8]
lea r9, [0x18001e150]
mov r8, qword [rbx]
mov edx, 8
call fcn.1800358a4
mov rdx, qword [rbx]
lea rdx, [rdx*8 + 8]
mov rcx, rbx
call fcn.18003589c
nop
lea rcx, [rsp + 0x50]
call fcn.180009d70
mov rax, rsi
mov rcx, qword [rbp + 0x2440]
xor rcx, rsp
call fcn.180034f80
mov rbx, qword [rsp + 0x25a8]
add rsp, 0x2550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18003ed10
nop
call fcn.18003ed10
nop
call fcn.18003ed10
nop
call fcn.18003ed10
int3
call fcn.18003ed10
int3
call fcn.18003ed10
int3