Function at 0x140004bdd
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xe0], ecx
movabs rax, 0x6e776f6e6b6e753c
mov edx, 0x3e
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0x1e
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov r8d, dword [rbp + 0xe0]
mov edx, 0
mov ecx, 0x410
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
je 0x140004c97
lea rcx, [rbp - 0x5c]
lea rdx, [rbp - 0x58]
mov rax, qword [rbp + 0xb8]
mov r9, rcx
mov r8d, 8
mov rcx, rax
call sym.K32EnumProcessModules
test eax, eax
je 0x140004c97
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x50]
mov rax, qword [rbp + 0xb8]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sym.K32GetModuleBaseNameA
lea rax, [rbp - 0x50]
lea rdx, str.vboxservice.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004ccf
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140004e8b
lea rax, [rbp - 0x50]
lea rdx, str.vboxtray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004d07
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140004e8b
lea rax, [rbp - 0x50]
lea rdx, str.VGAuthService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004d3f
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140004e8b
lea rax, [rbp - 0x50]
lea rdx, str.Vmacthlp.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004d77
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140004e8b
lea rax, [rbp - 0x50]
lea rdx, str.VMtoolsd.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004daf
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140004e8b
lea rax, [rbp - 0x50]
lea rdx, str.VMwaretrat.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004de7
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140004e8b
lea rax, [rbp - 0x50]
lea rdx, str.VMwareUser.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004e1c
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140004e8b
lea rax, [rbp - 0x50]
lea rdx, str.VMwareService.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004e51
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140004e8b
lea rax, [rbp - 0x50]
lea rdx, str.VMwareTray.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
call rax
test eax, eax
jne 0x140004e86
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140004e8b
mov eax, 0
add rsp, 0x148
pop rdi
pop rbp
ret