Function at 0x1400cb8de
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
xor esi, esi
mov ecx, 0x400
xor edx, edx
call fcn.1400cb0f4
lea rdi, [rsp + 0x30]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
and qword [rdi + 0x10], 0
mov ebx, 0x400
sub ebx, 1
jb 0x1400cb949
cmp rsi, qword [rsp + 0x38]
jne 0x1400cb931
mov rcx, rdi
mov rdx, rsi
call fcn.1400cb435
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
and dword [rax + rsi*4], 0
mov rsi, qword [rsp + 0x40]
inc rsi
mov qword [rsp + 0x40], rsi
jmp 0x1400cb915
lea r8, [rsp + 0x2c]
and dword [r8], 0
mov rcx, qword [rsp + 0x30]
mov edx, 0x1000
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
setne sil
je 0x1400cbbc6
mov ebp, dword [rsp + 0x2c]
shr ebp, 2
lea rdi, [rsp + 0x48]
mov qword [rdi], 8
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
xor ebx, ebx
lea r14, str.common_srclib.rs
lea r15, [rsp + 0x30]
lea r12, str.common_srclib.rs
lea r13, [rsp + 0x90]
cmp rbp, rbx
je 0x1400cba4d
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1400cb4fe
cmp dword [rax], 0
je 0x1400cba45
mov rcx, r15
mov rdx, rbx
mov r8, r12
call fcn.1400cb4fe
mov edx, dword [rax]
mov rcx, r13
call fcn.1400cb70e
cmp qword [rsp + 0xa0], 0
je 0x1400cba3d
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x60], xmm0
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x50]
jne 0x1400cba1a
mov rcx, rdi
call fcn.1400cb46b
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x48]
imul rcx, rdx, 0x18
mov rdx, qword [rsp + 0x70]
mov qword [rax + rcx + 0x10], rdx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + rcx], xmm0
inc qword [rsp + 0x58]
jmp 0x1400cba45
mov rcx, r13
call fcn.14003584d
inc rbx
jmp 0x1400cb9a4
mov dword [rsp + 0x28], esi
mov ecx, recv
xor edx, edx
call fcn.1400b2a1b
mov rdi, rax
mov rbx, rdx
lea rdx, str.vmsrvc.exetcpview.exewireshark.exefiddler.exevmware.exeVirtualBox.exeprocexp.exeautoit.exevboxtray.exevmtoolsd.exevmrawdsk.sys.vmusbmouse.sys.df5serv.exevboxservice.exe
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], recv
lea rbx, [rsp + 0x78]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
imul rax, qword [rsp + 0x58], 0x18
mov r13, qword [rsp + 0x48]
add rax, r13
mov qword [rsp + 0xa8], rax
lea r14, [rsp + 0x90]
lea r15, [rsp + 0x60]
cmp r13, qword [rsp + 0xa8]
je 0x1400cbb98
mov esi, 8
cmp rsi, 0xe8
je 0x1400cbb8f
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
mov rcx, r14
call fcn.140031ea0
mov rdx, qword [rdi + rsi - 8]
mov r8, qword [rdi + rsi]
mov rcx, r15
call fcn.140031ea0
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x70]
call fcn.140054712
mov ebp, eax
mov rcx, r15
call fcn.14003584d
mov rcx, r14
call fcn.14003584d
test bpl, bpl
je 0x1400cbb86
mov rbp, qword [rdi + rsi - 8]
mov r12, qword [rdi + rsi]
mov rdx, qword [rsp + 0x88]
cmp rdx, qword [rsp + 0x80]
jne 0x1400cbb6c
mov rcx, rbx
call fcn.1400cb41a
mov rdx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x78]
shl rdx, 4
mov qword [rax + rdx], rbp
mov qword [rax + rdx + 8], r12
inc qword [rsp + 0x88]
add rsi, 0x10
jmp 0x1400cbadd
add r13, 0x18
jmp 0x1400cbaca
lea rcx, [rsp + 0x78]
mov rsi, qword [rcx + 0x10]
call fcn.1400b2d54
lea rcx, [rsp + 0xb0]
call fcn.1400b2d54
lea rcx, [rsp + 0x48]
call fcn.1400cb09c
test rsi, rsi
mov esi, dword [rsp + 0x28]
je 0x1400cbbd2
lea rcx, [rsp + 0x30]
call fcn.1400cb4c9
jmp 0x1400cbbde
lea rcx, [rsp + 0x30]
call fcn.1400cb4c9
xor esi, esi
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret