Function at 0x4067b0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
sub rsp, 0x520
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x18], r8
mov rax, rdx
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rcx
mov rax, qword [rax]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x40]
call fcn.00406c20
mov r8, qword [rbp - 0x18]
mov rax, qword [r8]
mov qword [rbp + 0x60], rax
mov rax, qword [r8 + 8]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x88], rax
mov rax, qword [0x00485280]
mov qword [rbp + 0x90], rax
mov rax, qword [0x00485288]
mov qword [rbp + 0x98], rax
mov rax, qword [0x00485290]
mov qword [rbp + 0xa0], rax
lea rcx, [rbp - 8]
lea rdx, [rbp + 0x60]
mov r8d, 0x48
call fcn.004801f0
mov ecx, 0x18
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp - 0x10], rax
mov qword [rbp + 0xa8], rax
mov rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x406925
jmp 0x406981
lea rcx, [rbp + 0x108]
mov edx, 0xaa
mov r8d, 0x238
call fcn.004805e0
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x108]
mov qword [rbp + 0x340], 0x4d430001
mov qword [rbp + 0x348], rax
mov qword [rbp + 0x350], 0x238
mov qword [rbp + 0x358], 0
mov qword [rbp + 0x360], 0
mov qword [rbp + 0x368], 0
lea rax, [rbp + 0x340]
xor edx, edx
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov dword [rbp + 0x108], 0x238
lea rdx, [rbp + 0x108]
call sub.KERNEL32.dll_Module32First
cmp eax, 0
je 0x406992
jmp 0x4069d8
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x38]
mov dx, ax
mov word [rbp + 0xb6], dx
call fcn.00406c50
mov rdx, qword [rbp - 0x18]
mov word [rbp + 0x100], ax
lea rcx, [rbp - 8]
add rcx, 0x30
call fcn.00406f60
mov rcx, qword [rbp - 0x38]
call fcn.00401b90
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0xb8]
mov r8d, 0x50
call fcn.004801f0
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
jmp 0x406889
mov byte [rbp + 0x377], 1
jmp 0x406a25
mov rcx, qword [rbp - 0x10]
call fcn.00407020
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
add rcx, 0x30
call fcn.00406f60
mov rcx, qword [rbp - 0x38]
call fcn.00401b90
mov rcx, qword [rbp - 0x30]
lea rdx, [0x00485298]
mov r8d, 0x50
call fcn.004801f0
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
jmp 0x406986
mov rcx, qword [rbp - 0x10]
call fcn.00407020
mov word [rbp + 0x498], 0
lea rcx, [rbp + 0x450]
lea rdx, [rbp - 8]
mov r8d, 0x48
call fcn.004801f0
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x450]
mov r8d, 0x50
call fcn.004801f0
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
test byte [rbp + 0x377], 1
jne 0x406a32
jmp 0x406a5a
jmp 0x406a25
mov r9, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x38]
lea r8, [rbp - 8]
add r8, 0x30
lea rcx, [rbp + 0x378]
call fcn.00407050
cmp word [rbp + 0x380], 0
jne 0x406a5f
jmp 0x406abb
jmp 0x4069da
mov rcx, qword [rbp - 0x10]
mov ax, word [rbp + 0x380]
mov word [rbp - 0x3a], ax
call fcn.00407020
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
add rcx, 0x30
call fcn.00406f60
mov ax, word [rbp - 0x3a]
mov rcx, qword [rbp - 0x38]
mov word [rbp + 0x3d0], ax
call fcn.00401b90
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x388]
mov r8d, 0x50
call fcn.004801f0
mov rax, qword [rbp - 0x28]
add rsp, 0x520
pop rbp
ret
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x378]
mov qword [rbp - 0x48], rcx
mov qword [rbp + 0x3d8], rcx
vmovdqu xmm0, xmmword [rax]
vmovdqa xmmword [rbp + 0x3e0], xmm0
vmovdqa xmm0, xmmword [rbp + 0x3e0]
vmovdqa xmmword [rbp + 0x3f0], xmm0
lea rcx, [rbp + 0x138]
call fcn.00407150
mov rcx, rdx
mov rdx, qword [rbp - 0x38]
mov qword [rbp + 0x410], rcx
mov qword [rbp + 0x408], rax
mov r9, qword [rbp + 0x408]
mov rax, qword [rbp + 0x410]
lea rcx, [rbp + 0x418]
lea r8, [rbp + 0x3f0]
mov qword [rsp + 0x20], rax
call fcn.004071f0
cmp word [rbp + 0x428], 0
je 0x406bc2
jmp 0x406bf9
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov qword [rbp + 0x440], rax
mov qword [rbp + 0x448], rdx
mov r8, qword [rbp + 0x120]
mov qword [rcx], r8
mov r8d, dword [rbp + 0x128]
mov dword [rcx + 0x48], r8d
mov qword [rcx + 0x10], rdx
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x130]
mov qword [rcx + 0x18], rax
add rcx, 0x20
lea rdx, [0x004852e8]
mov r8d, 0x28
call fcn.004801f0
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0x108]
call sub.KERNEL32.dll_Module32Next
cmp eax, 1
sete al
and al, 1
mov byte [rbp + 0x377], al
jmp 0x406a30
mov rax, qword [rbp + 0x418]
mov rcx, qword [rbp + 0x420]
mov qword [rbp + 0x438], rcx
mov qword [rbp + 0x430], rax
mov rcx, qword [rbp + 0x430]
mov rax, qword [rbp + 0x438]
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x58], rax
jmp 0x406b47
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
mov qword [rax], rcx
mov ecx, 1
xor eax, eax
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x58], rax
jmp 0x406b47