Function at 0x14008b380
Capabilities:
Enumerate process modules

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
nop
push r11
mov qword [rsp], rbp
nop
jmp 0x14008b7db
je 0x14008b6b1
sub rdi, rbx
mov rbx, rbx
movsx ecx, byte [rbx]
call fcn.1400b56c0
mov byte [rbx + rdi], al
jmp 0x14008b3b4
inc rbx
mov dword [rsp - 0x18], 0x1893ecc8
cmp rbx, rsi
jmp 0x14008b43d
sub qword [rbp - 0x80], 0x27f8f920
add qword [rbp - 0x80], 0x6f304613
sub qword [rbp - 0x80], 0xa9beb74
xor qword [rbp - 0x80], 0x79b6a1d7
jmp 0x14008b514
sub edi, 0x3b9d65e4
add edi, 0x4e76a6de
sub edi, 0x33499a95
jmp 0x14008b4ed
mov qword [rsp + 0x38], r9
xchg r9, rax
xor edx, edx
mov r8d, 0xf4f4c57
xor r8d, 0x29c9f86e
sub r8d, 0x9fa8e27
jmp 0x14008b718
je 0x14008bb75
mov qword [rsp + 0x48], rdi
xchg rdx, rdi
mov qword [rsp + 0x58], rdx
jmp 0x14008b674
jne 0x14008b3a4
mov r13, qword [rsp + 0x60]
mov dword [rsp - 0x44], 0x63311444
xchg r13, r15
mov r13, qword [rsp + 0x48]
xchg r15, r13
jmp 0x14008b6b1
xchg r8, r11
mov qword [rsp + 0x30], r8
mov dword [rsp - 0x40], ebx
xchg r12, r8
mov qword [rsp + 0x40], r12
xchg r12, r8
mov ecx, 0x22dc75fa
jmp 0x14008b6f5
sub rsp, 8
push r15
lea rbp, [rsp - 0x1e0]
mov dword [rsp - 0xc], 0x2e527808
add rsp, 0xfffffffffffffd20
jmp 0x14008b648
sub byte [rsp + 0x48], 0x2e
add byte [rsp + 0x48], 0x2e
xor byte [rsp + 0x48], 0x71
jmp 0x14008b5b5
nop word [rax + rax]
inc r8
mov dword [rsp - 0x30], 0x34cfcc9f
jmp 0x14008b5c7
sub ecx, 0x39265268
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rsp - 0x18], 0xe54a076
mov rbx, rax
xchg r9, rax
jmp 0x14008b403
xor edi, 0x16c9e74b
sub edi, 0x1448c265
xor edi, 0x3de89056
sub edi, 0x336c22ee
lea rdx, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
jmp 0x14008b972
add qword [rbp - 0x80], 0x47e4c05c
sub qword [rbp - 0x80], 0x531dee86
xchg rcx, r14
mov rcx, qword [rsi + 0x10]
xchg r14, rcx
xchg r8, r12
mov r8, rsi
jmp 0x14008b6bf
mov rbp, qword [r12 + 8]
xchg rbp, rax
mov qword [rsp + 0x28], rax
cmp rsi, rax
je 0x14008bad3
xchg rcx, rcx
nop word [rax + rax]
jmp 0x14008b7be
sub r8, 0x21f41882
add r8, 0x11c7244a
xor r8, 0x3a22dedc
sub r8, 0x2ed27336
add r8, 0x7fffffff
add r8, 0x49197a2a
jmp 0x14008b4b7
mov r12, qword [rsi]
mov r12, r12
cmp r14, 0x10
jae 0x14008b818
xchg r12, rsp
jmp 0x14008b809
xor edi, edi
mov r14d, edi
mov dword [rsp + 0x20], edi
mov dword [rsp - 0x3c], esi
jmp 0x14008b740
sub byte [rsp + 0x48], 0x32
lea rax, [rbp - 0x40]
xchg r12, r12
nop
jmp 0x14008b5db
cmp byte [rax + r8], 0
jne 0x14008b4c0
lea rdx, [rbp - 0x40]
jmp 0x14008b75c
movabs r8, 0xffffffff4e53d6d6
add r8, 0x85d2cd4
sub r8, 0x484e8ccc
xor r8, 0x61a56ad6
jmp 0x14008b55c
add qword [rsp + 0x60], 0x51753ff6
sub qword [rsp + 0x60], 0x12f30f4a
sub qword [rsp + 0x60], 0x63539837
mov byte [rsp + 0x48], 0x52
sub byte [rsp + 0x48], 0xf
jmp 0x14008b4a3
xchg rcx, r15
mov rcx, qword [rsp + 0x48]
xchg r15, rcx
xchg r13, rdx
mov rdx, qword [rsp + 0x60]
xchg rdx, r13
cmp r13, 0x10
jmp 0x14008b697
mov rax, qword [0x1402557f0]
xor rax, rsp
mov dword [rsp - 0x34], edi
jmp 0x14008b7a8
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
jmp 0x14008b481
xchg rdx, rdi
mov qword [rsp + 0x60], 0x46099e56
xor qword [rsp + 0x60], 0x54713fe3
add qword [rsp + 0x60], 0x1258c5e5
jmp 0x14008b5ff
cmovae rdi, r15
mov rbx, rbx
lea rcx, [rsp + 0x48]
cmovae rcx, r15
mov rsi, qword [rsp + 0x58]
jmp 0x14008b6d2
mov rsi, qword [r12]
xchg rbp, rbp
xchg rbp, rax
jmp 0x14008b539
xchg r12, r8
cmp qword [rsi + 0x18], 0x10
jb 0x14008b591
jmp 0x14008b58b
add rsi, rcx
mov dword [rsp - 0x34], 0x32b94cce
lea rbx, [rsp + 0x48]
cmp r13, 0x10
cmovae rbx, r15
xchg rsp, rsp
cmp rbx, rsi
jmp 0x14008b398
add ecx, 0x316741b1
sub ecx, 0x41f5edf3
xor ecx, 0x2e9297d6
xor ecx, 0x47d602d7
xor ecx, 0x422f0ec9
jmp 0x14008b4d0
add r8d, 0x116d4980
xor r8d, 0x10aa561a
xor r8d, 0x467343f4
sub r8d, 0x7b207848
lea rcx, [rbp - 0x6c]
xchg r11, r11
jmp 0x14008b774
lea rdx, [rbp - 0x70]
xchg rcx, r13
mov r13, rbx
xchg r13, rcx
call sub.KERNEL32.dll_Module32First
test eax, eax
mov rdx, rdx
jmp 0x14008b425
lea rcx, [rsp + 0x48]
xchg rcx, rcx
call fcn.140019590
nop
lea rdi, [rsp + 0x48]
jmp 0x14008b629
call fcn.1400eb440
mov dword [rbp - 0x70], 0x1bd1f096
add dword [rbp - 0x70], 0x401df8fb
add dword [rbp - 0x70], 0x11d35b49
sub dword [rbp - 0x70], 0x24641d4f
xor dword [rbp - 0x70], 0x14428f63
xor dword [rbp - 0x70], 0x5d1daad0
jmp 0x14008b5a3
xchg r13, rax
mov qword [rbp + 0x1d0], r13
xchg r13, rax
xchg r8, r11
mov r12, r11
jmp 0x14008b460
mov qword [rbp - 0x80], 0xb7e9341
add qword [rbp - 0x80], 0x5bd29c93
sub qword [rbp - 0x80], 0x315d0156
jmp 0x14008b3c7
sub rsp, 8
mov qword [rsp], rsi
push rdi
mov dword [rsp - 0x30], 0x3dd49980
nop
mov qword [rsp - 8], r12
jmp 0x14008b65b
movups xmmword [r15 + 0x68], xmm0
xchg r15, rsp
mov edi, 0x5474ebf6
jmp 0x14008b3ec
movups xmm0, xmmword [rsp]
xchg r12, rsp
xchg rsp, r15
jmp 0x14008b7f7
xchg r13, r14
mov rdi, r13
xchg r14, r13
or rdi, 0xf
jmp 0x14008b82a
movabs rax, 0x7fffffff29a386a6
sub rax, 0x1729f3ea
add rax, 0x31c8dcae
jmp 0x14008b89d
cmova rdi, rax
mov dword [rsp - 0x1c], esp
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14008b8da
jmp 0x14008b8cb
test rax, rax
je 0x14008bc45
xchg rsp, rsp
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
jmp 0x14008b87c
xchg r15, rax
mov qword [rbx - 8], r15
xchg r15, rax
jmp 0x14008b901
add rax, 0x7fffffff
xor rax, 0x50cf79ed
cmp rdi, rax
jmp 0x14008b845
sub rax, 0x6fad01
add rax, 0x15a10fc2
xor rax, 0x76435438
jmp 0x14008b889
jbe 0x14008bc37
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400e8b94
jmp 0x14008b863
xchg r14, r14
lea rax, [rcx + 0x27]
cmp rax, rcx
jmp 0x14008b8b4
test rcx, rcx
je 0x14008b8ff
call fcn.1400e8b94
mov dword [rsp - 0x38], ecx
xchg r12, rbx
mov r12, rax
xchg rbx, r12
jmp 0x14008b8fa
jmp 0x14008b901
xor ebx, ebx
mov qword [rsp + 0x68], rbx
lea r8, [r14 + 1]
mov dword [rsp - 0x30], ebp
xchg r12, rdi
jmp 0x14008b916
mov rdx, rdi
xchg r12, rdi
mov rcx, rbx
xchg r8, r8
jmp 0x14008b927
call fcn.1400ead90
lea rdx, [rsp + 0x68]
cmp rdi, 0x10
cmovae rdx, rbx
jmp 0x14008b954
xchg rdi, rdi
mov cl, 0x27
xor cl, 0x13
add cl, 0x24
xor cl, 0x15
sub cl, 1
jmp 0x14008b9c0
xchg rsi, rsi
xchg r8, r13
mov r8, qword [rsp + 0x60]
xchg r13, r8
xchg r13, r15
mov r13, qword [rsp + 0x48]
xchg r13, r15
jmp 0x14008b972
mov qword [rbp - 0x80], rdi
mov dword [rsp - 0x40], 0x2a6637f3
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x48]
cmp r13, 0x10
cmovae rcx, r15
mov dword [rsp - 0x20], 0x6e3d3f61
jmp 0x14008b99d
mov r8, qword [rsp + 0x58]
cmp r8, r14
jne 0x14008b9c8
xchg r15, r15
call fcn.1400eb990
test eax, eax
jne 0x14008b9c8
jmp 0x14008b93e
sub cl, 0x4b
jmp 0x14008b9ce
xor cl, cl
mov dword [rsp - 0x20], ebp
mov r14d, dword [rsp + 0x20]
lea eax, [r14 + 1]
test cl, cl
mov rbx, rbx
jmp 0x14008ba1f
je 0x14008bb75
xor edi, edi
jmp 0x14008b42b
xchg rbx, r15
mov rcx, rbx
call sub.KERNEL32.dll_Module32Next
test eax, eax
mov dword [rsp - 0x1c], 0x507de36b
jmp 0x14008b9e1
xchg r12, r12
nop
add rdx, 0x791b136f
sub rdx, 0x791b1348
jmp 0x14008ba76
cmove eax, r14d
mov r14d, eax
mov dword [rsp + 0x20], eax
mov dword [rsp - 0x14], 0x70b6baa0
cmp rdi, 0x10
jb 0x14008bb6d
lea rdx, [rdi + 1]
jmp 0x14008baa1
ja 0x14008bc29
mov r15, r15
xchg r15, rbp
mov rcx, rbp
xchg r15, rbp
call fcn.1400e8bd0
jmp 0x14008bb50
mov rbx, qword [rbx - 8]
mov dword [rsp - 0x30], 0x5868e7ad
sub rax, rbx
nop
jmp 0x14008baf3
mov r15, qword [r15 - 8]
sub rax, r15
mov rdx, rdx
sub rax, 8
cmp rax, 0x1f
jmp 0x14008ba45
xchg rdi, rax
cmp rdx, 0x1000
jb 0x14008ba4e
jmp 0x14008ba08
mov rax, rbx
mov dword [rsp - 0x20], 0x2e75dc4a
cmp rdx, 0x1000
jb 0x14008bac2
sub rdx, 0xffffffffffffffd9
jmp 0x14008ba61
xchg rbx, r12
mov rcx, r12
xchg r12, rbx
jmp 0x14008bb38
xchg r12, rdx
cmp r13, 0x10
jb 0x14008bb54
mov dword [rsp - 0x10], 0x17479b71
lea rdx, [r13 + 1]
xchg rdi, rax
mov rdi, r15
jmp 0x14008ba8d
sub rax, 0xffffffff9bd39078
add rax, 0xffffffff9bd39070
cmp rax, 0x1f
ja 0x14008bc45
mov dword [rsp - 0x24], 0x7e05e703
jmp 0x14008bac2
add rsi, 0xffffffffffffffe0
neg rsi
cmp rsi, qword [rsp + 0x28]
xchg rsi, rsi
jne 0x14008b7be
xchg rdx, r12
mov rdx, qword [rsp + 0x30]
jmp 0x14008bad0
call fcn.1400e8bd0
xchg rbp, r13
mov rbp, qword [rsp + 0x60]
xchg rbp, r13
xchg r15, r13
jmp 0x14008bb65
mov dword [rsp - 0x3c], edx
lea rdx, [rbp - 0x70]
xchg rbx, r15
mov r15, qword [rsp + 0x38]
jmp 0x14008b9ee
mov r13, qword [rsp + 0x48]
xchg r15, r13
neg rsi
jmp 0x14008bb16
xchg r11, rbx
mov rcx, r11
xchg r11, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xchg r9, r9
xchg r12, rcx
jmp 0x14008bbb3
xchg r13, rcx
xor rcx, rsp
mov dword [rsp - 0x40], ebx
jmp 0x14008bbd0
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
xchg rcx, rcx
nop
jmp 0x14008bc11
mov r12, rcx
xchg r12, rcx
call fcn.140090810
mov eax, r14d
xchg rcx, r13
mov r13, qword [rbp + 0x1d0]
jmp 0x14008bb90
call fcn.1400e8cf0
xchg r10, rbx
mov r10, qword [rsp + 0x320]
xchg rbx, r10
sub rsp, 0xfffffffffffffd20
jmp 0x14008bb9f
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
add rsp, 8
mov rdi, qword [rsp - 8]
nop
mov rsi, qword [rsp]
jmp 0x14008bbef
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
jmp 0x14008bbfe
call fcn.1400ef88c
mov dword [rsp - 0x18], 0x15700fe9
nop
call fcn.14000e950
int3
call fcn.1400ef88c
int3