Function at 0x140001875
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rdi
sub rsp, 0xa78
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xa10], ecx
mov dword [rbp + 0xa18], edx
mov qword [rbp + 0xa20], r8
mov qword [rbp + 0xa28], r9
mov byte [rbp + 0x9ef], 0
mov dword [rbp + 0x9a4], 0
mov dword [rbp + 0x9c4], 0
mov qword [rbp + 0x998], 0
mov qword [rbp + 0x990], 0
mov qword [rbp + 0x9b8], 0
mov qword [rbp + 0x9e0], 0
mov qword [rbp + 0x9b0], 0
mov qword [rbp + 0x9d8], 0
mov qword [rbp + 0x9d0], 0
lea rdx, [rbp + 0x4c0]
mov eax, 0
mov ecx, 0x9a
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0xc0]
mov eax, 0
mov ecx, pe_nt_image_headers64
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp + 0x9a8], 0
mov dword [rbp + 0x4f0], 0x10000b
mov r8d, dword [rbp + 0xa10]
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x9b8], rax
cmp qword [rbp + 0x9b8], 0
je 0x140001bff
lea rcx, [rbp + 0x9a4]
lea rdx, [rbp + 0xc0]
mov rax, qword [rbp + 0x9b8]
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
mov byte [rbp + 0x9ef], al
cmp byte [rbp + 0x9ef], 0
je 0x140001c02
mov dword [rbp + 0x9cc], 0
jmp 0x140001a65
mov eax, dword [rbp + 0x9cc]
cdqe
mov rdx, qword [rbp + rax*8 + 0xc0]
lea rcx, [rbp - 0x50]
mov rax, qword [rbp + 0x9b8]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x140001a5e
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.1400031d2
mov rdx, rax
lea rcx, str.c:windows_system32_ntdll.dll
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpA]
call rax
test eax, eax
jne 0x140001a5e
mov eax, dword [rbp + 0x9cc]
cdqe
mov rax, qword [rbp + rax*8 + 0xc0]
mov qword [rbp + 0x9a8], rax
mov rdx, qword [rbp + 0x9a8]
mov rax, qword [rbp + 0xa20]
add rax, rdx
mov qword [rbp + 0x9d8], rax
mov rdx, qword [rbp + 0x9a8]
mov rax, qword [rbp + 0xa28]
add rax, rdx
mov qword [rbp + 0x9d0], rax
jmp 0x140001a81
add dword [rbp + 0x9cc], 1
mov eax, dword [rbp + 0x9cc]
cdqe
mov edx, dword [rbp + 0x9a4]
shr edx, 3
mov edx, edx
cmp rax, rdx
jb 0x1400019c2
mov eax, dword [rbp + 0xa18]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f03ff
mov rax, qword [sym.imp.KERNEL32.dll_OpenThread]
call rax
mov qword [rbp + 0x9e0], rax
cmp qword [rbp + 0x9e0], 0
je 0x140001c05
lea rdx, [rbp + 0x4c0]
mov rax, qword [rbp + 0x9e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
mov byte [rbp + 0x9ef], al
cmp byte [rbp + 0x9ef], 0
je 0x140001c08
mov dword [rbp + 0x9c8], 0
jmp 0x140001be3
mov rdx, qword [rbp + 0x558]
mov eax, dword [rbp + 0x9c8]
shl eax, 3
cdqe
add rax, rdx
mov qword [rbp + 0x9b0], rax
lea r8, [rbp + 0x998]
mov rdx, qword [rbp + 0x9b0]
mov rax, qword [rbp + 0x9b8]
lea rcx, [rbp + 0x990]
mov qword [rsp + 0x20], rcx
mov r9d, 8
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
mov byte [rbp + 0x9ef], al
cmp byte [rbp + 0x9ef], 0
je 0x140001bf5
mov rdx, qword [rbp + 0x998]
mov rax, qword [rbp + 0x9d8]
cmp rdx, rax
jb 0x140001ba3
mov rax, qword [rbp + 0x9d8]
add rax, 0x78
mov rdx, rax
mov rax, qword [rbp + 0x998]
cmp rdx, rax
jbe 0x140001ba3
mov edx, dword [rbp + 0xa10]
lea rcx, str.__Possible_Foliage_identified_in_process:__d_n
call fcn.140001550
mov eax, dword [rbp + 0xa18]
mov edx, eax
lea rcx, str._t_Thread__d_state_Wait:UserRequest_seems_to_be_triggered_by_KiUserApcDispatcher_n
call fcn.140001550
mov rdx, qword [rbp + 0x998]
mov rax, qword [rbp + 0x9d0]
cmp rdx, rax
jne 0x140001bdc
mov edx, dword [rbp + 0xa10]
lea rcx, str.__Possible_Ekko_Nighthawk_identified_in_process:__d_n
call fcn.140001550
mov eax, dword [rbp + 0xa18]
mov edx, eax
lea rcx, str._t_Thread__d_state_Wait:UserRequest_seems_to_be_triggered_by_Callback_of_waitable_Timer_n
call fcn.140001550
add dword [rbp + 0x9c8], 1
cmp dword [rbp + 0x9c8], 0x1fff
jle 0x140001aee
jmp 0x140001bf6
nop
mov byte [rbp + 0x9ef], 1
jmp 0x140001c09
nop
jmp 0x140001c09
nop
jmp 0x140001c09
nop
jmp 0x140001c09
nop
cmp qword [rbp + 0x9b8], 0
je 0x140001c26
mov rax, qword [rbp + 0x9b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp + 0x9e0], 0
je 0x140001c43
mov rax, qword [rbp + 0x9e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
movzx eax, byte [rbp + 0x9ef]
add rsp, 0xa78
pop rdi
pop rbp
ret