Function at 0x180002090
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2a8
lea rbp, [rsp + 0x80]
mov rax, qword [0x18000a128]
xor rax, rbp
mov qword [rbp + 0x220], rax
mov eax, 0x40540f96
lea rsi, [rbp + 8]
mov r12d, 0x7d5296f3
mov r13d, 0x471dae24
mov ebx, 0x24e26e6
jmp 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4afe1951
mov ecx, 0xaf92536f
nop word cs:[rax + rax]
nop dword [rax + rax]
cmove eax, ecx
cmp dword [0x18000a184], 0xa
cmovl eax, ecx
cmp eax, 0x5c63f2e
jg 0x180002160
cmp eax, 0xc1546d38
jle 0x1800021b0
cmp eax, 0xe9fea2e2
jle 0x180002249
cmp eax, 0xf8f423dd
jg 0x1800023ce
cmp eax, 0xf27fa357
jg 0x1800025a0
cmp eax, 0xe9fea2e3
je 0x180002857
cmp eax, 0xee838d81
jne 0x18000210d
mov eax, 0x11fabbda
mov r14d, 1
jmp 0x18000210d
cmp eax, 0x4cb5a4a3
jg 0x180002200
cmp eax, 0x25ca6d21
jle 0x1800022e9
cmp eax, 0x461ea804
jle 0x1800023fd
cmp eax, 0x478164ee
jg 0x180002644
cmp eax, 0x461ea805
je 0x180002869
cmp eax, 0x471dae24
jne 0x18000210d
mov eax, 0x2eb92213
mov edi, dword [rbp - 0x3c]
jmp 0x18000210d
cmp eax, 0xb2f8a672
jg 0x18000232b
cmp eax, 0x98b2d940
jle 0x180002434
cmp eax, 0xa2f5f7e1
jg 0x180002664
cmp eax, 0x98b2d941
je 0x180002873
cmp eax, 0x9e07bbe1
jne 0x18000210d
mov eax, 0xc5b67fa4
mov r15d, dword [rbp - 0x38]
jmp 0x18000210d
cmp eax, 0x67cc6319
jg 0x18000237f
cmp eax, 0x5c4df687
jle 0x180002462
cmp eax, 0x5d4e046e
jg 0x180002698
cmp eax, 0x5c4df688
je 0x18000287d
cmp eax, 0x5d14fb11
jne 0x18000210d
cmp dword [rbp - 0xc], 0
setne byte [rbp + 6]
mov eax, 0x7714e543
jmp 0x18000210d
cmp eax, 0xd09182c2
jle 0x180002497
cmp eax, 0xe3bc039e
jg 0x1800026e9
cmp eax, 0xd09182c3
je 0x1800028a5
cmp eax, 0xd31edf22
jne 0x18000210d
mov rax, qword [rbp - 0x28]
movaps xmm0, xmmword [str.df5serv.exe]
movaps xmmword [rax + 0x60], xmm0
movaps xmm0, xmmword [str.vmrawdsk.sys.]
movaps xmmword [rax + 0x50], xmm0
movaps xmm0, xmmword [str.vboxtray.exe]
movaps xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [str.procexp.exe]
movaps xmmword [rax + 0x30], xmm0
movaps xmm0, xmmword [str.vmware.exe]
movaps xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [str.wireshark.exe]
movaps xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [str.vmsrvc.exe]
movaps xmmword [rax], xmm0
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 8]
sub rsp, 0x20
mov edx, 0x1000
call sub.KERNEL32.dll_K32EnumProcesses
add rsp, 0x20
mov eax, 0xf6eb2747
jmp 0x18000210d
cmp eax, 0x1a147138
jle 0x1800024d6
cmp eax, 0x1b462f2f
jg 0x180002714
cmp eax, 0x1a147139
je 0x1800028bc
cmp eax, 0x1ac0cb58
jne 0x18000210d
cmp byte [rbp + 4], 0
mov eax, 0xf27fa358
mov ecx, 0x1a147139
cmovne eax, ecx
jmp 0x18000210d
cmp eax, 0xb8dd9b43
jle 0x180002519
cmp eax, 0xb93d7623
jg 0x180002740
cmp eax, 0xb8dd9b44
je 0x1800028da
cmp eax, 0xb8e6d322
jne 0x18000210d
mov r9, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
mov rdx, rsi
mov r8d, 8
call sub.KERNEL32.dll_K32EnumProcessModules
add rsp, 0x20
mov eax, 0x7d5296f3
jmp 0x18000210d
cmp eax, 0x79371c24
jle 0x180002569
cmp eax, 0x7d5296f2
jg 0x180002774
cmp eax, 0x79371c25
je 0x1800028e4
cmp eax, 0x7c01f457
jne 0x18000210d
mov r8d, dword [rbp - 0xc]
sub rsp, 0x20
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov eax, 0x67cc5311
jmp 0x18000210d
cmp eax, 0x24e26e5
jg 0x180002794
cmp eax, 0xf8f423de
je 0x18000290c
cmp eax, 0xfb534cb1
jne 0x18000210d
mov rax, qword [rbp - 0x18]
mov eax, 0x8f191cde
jmp 0x18000210d
cmp eax, 0x2eb92212
jg 0x1800027c0
cmp eax, 0x25ca6d22
je 0x18000292a
cmp eax, 0x2c3bfa96
jne 0x18000210d
cmp byte [rbp + 7], 0
mov eax, 0x5d4e046f
mov ecx, 0x59571d77
cmovne eax, ecx
jmp 0x18000210d
cmp eax, 0x8ea1d3a6
je 0x180002937
cmp eax, 0x8f191cde
je 0x180002955
cmp eax, 0x8fdf386a
jne 0x18000210d
mov eax, 0xc5b67fa4
xor r15d, r15d
jmp 0x18000210d
cmp eax, 0x4cb5a4a4
je 0x18000297c
cmp eax, 0x584b9738
je 0x180002986
cmp eax, 0x59571d77
jne 0x18000210d
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov qword [rbp - 0x78], rax
mov eax, 0xe4cf809b
jmp 0x18000210d
cmp eax, 0xc1546d39
je 0x180002990
cmp eax, 0xc2140cd3
je 0x1800020d8
cmp eax, 0xc5b67fa4
jne 0x18000210d
mov dword [rbp - 0x10], r15d
mov eax, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x10]
cmp ecx, eax
mov eax, 0xc2140cd3
mov ecx, 0xd09182c3
cmovb eax, ecx
jmp 0x18000210d
cmp eax, 0x5c63f2f
je 0x1800029ae
cmp eax, 0x11fabbda
je 0x1800029c1
cmp eax, 0x15967449
jne 0x18000210d
mov rax, qword [rbp - 0x28]
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd31edf22
mov ecx, 0xf6eb2747
jmp 0x180002100
cmp eax, 0xb2f8a673
je 0x1800029e3
cmp eax, 0xb379833c
je 0x1800029ed
cmp eax, 0xb45c3aea
jne 0x18000210d
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x70]
sub rsp, 0x20
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleBaseNameW
add rsp, 0x20
test eax, eax
setne byte [rbp + 3]
mov eax, 0x6f2e0ba8
jmp 0x18000210d
cmp eax, 0x67cc631a
je 0x1800029f7
cmp eax, 0x6f2e0ba8
je 0x180002a1f
cmp eax, 0x7714e543
jne 0x18000210d
cmp byte [rbp + 6], 0
mov eax, 0x5c63f2f
mov ecx, 0x478164ef
cmovne eax, ecx
jmp 0x18000210d
cmp eax, 0xf27fa358
je 0x180002a35
cmp eax, 0xf6eb2747
jne 0x18000210d
mov rax, qword [rbp - 0x28]
movaps xmm0, xmmword [str.df5serv.exe]
movaps xmmword [rax + 0x60], xmm0
movaps xmm0, xmmword [str.vmrawdsk.sys.]
movaps xmmword [rax + 0x50], xmm0
movaps xmm0, xmmword [str.vboxtray.exe]
movaps xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [str.procexp.exe]
movaps xmmword [rax + 0x30], xmm0
movaps xmm0, xmmword [str.vmware.exe]
movaps xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [str.wireshark.exe]
movaps xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [str.vmsrvc.exe]
movaps xmmword [rax], xmm0
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 8]
sub rsp, 0x20
mov edx, 0x1000
call sub.KERNEL32.dll_K32EnumProcesses
add rsp, 0x20
test eax, eax
setne byte [rbp + 7]
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd31edf22
mov ecx, 0x2c3bfa96
jmp 0x180002100
cmp eax, 0x478164ef
je 0x180002a51
cmp eax, 0x4afe1951
jne 0x18000210d
mov eax, 0xaf92536f
jmp 0x18000210d
cmp eax, 0xa2f5f7e2
je 0x180002a6f
cmp eax, 0xaf92536f
jne 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4afe1951
mov ecx, 0x25ca6d22
jmp 0x180002100
cmp eax, 0x5d4e046f
je 0x180002a8d
cmp eax, 0x67cc5311
jne 0x18000210d
mov r8d, dword [rbp - 0xc]
sub rsp, 0x20
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7c01f457
mov ecx, 0x584b9738
jmp 0x180002100
cmp eax, 0xe3bc039f
je 0x180002a99
cmp eax, 0xe4cf809b
jne 0x18000210d
mov rax, qword [rbp - 0x78]
shr rax, 2
mov dword [rbp - 0x2c], eax
mov eax, 0x8fdf386a
jmp 0x18000210d
cmp eax, 0x1b462f30
je 0x180002aa3
cmp eax, 0x1fe337bd
jne 0x18000210d
cmp dword [rbp - 0x34], 0
mov eax, 0xb8dd9b44
mov ecx, 0xf27fa358
cmove eax, ecx
jmp 0x18000210d
cmp eax, 0xb93d7624
je 0x180002ac9
cmp eax, 0xbed571a9
jne 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb379833c
mov ecx, 0x7f02aea0
jmp 0x180002100
cmp eax, 0x7d5296f3
je 0x180002adb
cmp eax, 0x7f02aea0
jne 0x18000210d
mov eax, 0xa2f5f7e2
jmp 0x18000210d
cmp eax, 0x24e26e6
je 0x180002b22
cmp eax, 0x581d67f
jne 0x18000210d
cmp byte [rbp + 5], 0
mov eax, 0x5c63f2f
mov ecx, 0x67cc631a
cmovne eax, ecx
jmp 0x18000210d
cmp eax, 0x40540f96
jne 0x180002b2c
mov eax, 0x1000
call fcn.180006b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov eax, 0x10
call fcn.180006b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 8], rax
mov eax, 0x70
call fcn.180006b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
mov qword [rbp + 8], 0
lea rax, [rbp + 0x10]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x60]
mov rax, qword [rbp - 8]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 0x68]
mov rax, qword [rbp - 8]
mov dword [rax], 0
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x28], rax
mov eax, 0x15967449
jmp 0x18000210d
cmp dword [rbp - 0x30], 0
setne byte [rbp + 4]
mov eax, 0xf8f423de
jmp 0x18000210d
mov eax, 0xb45c3aea
jmp 0x18000210d
mov eax, 0x1b462f30
jmp 0x18000210d
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x80]
sub rsp, 0x20
mov r8d, 0xe
call fcn.180001ab0
add rsp, 0x20
mov dword [rbp - 0x34], eax
mov eax, 0x1fe337bd
jmp 0x18000210d
mov eax, dword [rbp - 0x10]
mov rcx, qword [rbp - 0x20]
mov eax, dword [rcx + rax*4]
mov dword [rbp - 0xc], eax
mov eax, 0x5d14fb11
jmp 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x98b2d941
mov ecx, 0x1b462f30
jmp 0x180002100
mov eax, 0xee838d81
jmp 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4cb5a4a4
cmove eax, r13d
cmp dword [0x18000a184], 0xa
cmovl eax, r13d
jmp 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb2f8a673
mov ecx, 0x8ea1d3a6
jmp 0x180002100
mov eax, 0x11fabbda
xor r14d, r14d
jmp 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb2f8a673
mov ecx, 0x1ac0cb58
jmp 0x180002100
cmp qword [rbp - 0x18], 0
setne byte [rbp + 5]
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfb534cb1
mov ecx, 0x581d67f
jmp 0x180002100
mov eax, 0x79371c25
jmp 0x18000210d
mov eax, 0xc1546d39
jmp 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb379833c
mov ecx, 0xbed571a9
jmp 0x180002100
mov eax, dword [rbp - 0x10]
add eax, 1
mov dword [rbp - 0x38], eax
mov eax, 0x9e07bbe1
jmp 0x18000210d
mov dword [rbp - 0x3c], r14d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4cb5a4a4
mov ecx, 0x79371c25
jmp 0x180002100
mov eax, 0x8ea1d3a6
jmp 0x18000210d
mov eax, 0xbed571a9
jmp 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb8e6d322
cmove eax, r12d
cmp dword [0x18000a184], 0xa
cmovl eax, r12d
jmp 0x18000210d
cmp byte [rbp + 3], 0
mov eax, 0xf27fa358
mov ecx, 0xb93d7624
cmovne eax, ecx
jmp 0x18000210d
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov eax, 0xe3bc039f
jmp 0x18000210d
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7c01f457
mov ecx, 0x67cc5311
jmp 0x180002100
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfb534cb1
mov ecx, 0x8f191cde
jmp 0x180002100
mov eax, 0x2eb92213
xor edi, edi
jmp 0x18000210d
mov eax, 0x5c63f2f
jmp 0x18000210d
lea rax, [rbp + 0x10]
mov qword [rbp - 0x70], rax
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x98b2d941
mov ecx, 0x461ea805
jmp 0x180002100
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x80], rax
mov eax, 0x5c4df688
jmp 0x18000210d
mov r9, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
mov rdx, rsi
mov r8d, 8
call sub.KERNEL32.dll_K32EnumProcessModules
add rsp, 0x20
mov dword [rbp - 0x30], eax
mov eax, dword [0x18000a180]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb8e6d322
cmove eax, ebx
cmp dword [0x18000a184], 0xa
cmovl eax, ebx
jmp 0x18000210d
mov eax, 0xe9fea2e3
jmp 0x18000210d
cmp eax, 0x2eb92213
jne 0x18000210d
mov rax, qword [rbp - 0x28]
mov rax, qword [rbp - 0x68]
mov rax, qword [rbp - 0x60]
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp + 0x220]
xor rcx, rbp
sub rsp, 0x20
call fcn.180006bc0
add rsp, 0x20
mov eax, edi
lea rsp, [rbp + 0x228]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret