Function at 0x140001810
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x10b8]
mov eax, 0x11b8
call fcn.140003960
sub rsp, rax
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0x1090], rax
mov r13, rcx
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x80]
mov edx, 0x1000
lea r8, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14000188b
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], 0
mov qword [r13 + 0x18], 0xf
mov byte [r13], al
jmp 0x140001ceb
mov qword [rsp + 0x11d8], rbx
xor ebx, ebx
mov qword [rsp + 0x11e0], rsi
mov qword [rsp + 0x11e8], rdi
mov qword [rsp + 0x11b0], r12
mov qword [rsp + 0x11a8], r14
mov r14d, dword [rsp + 0x50]
shr r14d, 2
mov qword [rsp + 0x11a0], r15
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x2c], ebx
test r14d, r14d
je 0x140001c8e
lea rdi, [rbp - 0x80]
movabs r12, 0x7fffffffffffffff
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov r8d, dword [rdi]
test r8d, r8d
je 0x140001c76
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
mov rsi, rax
test rax, rax
je 0x140001c76
movzx ecx, word [0x140004710]
xor edx, edx
movsd xmm0, qword [str._unknown_]
mov r8d, 0xfa
mov word [rbp + 0xf88], cx
lea rcx, [rbp + 0xf8a]
movsd qword [rbp + 0xf80], xmm0
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x78]
mov r8d, 8
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140001c6d
mov rdx, qword [rsp + 0x48]
lea r8, [rbp + 0xf80]
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
xorps xmm0, xmm0
lea rax, [rbp + 0xf80]
movups xmmword [rsp + 0x58], xmm0
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400019a0
cmp rdi, r12
ja 0x140001d36
cmp rdi, 0x10
jae 0x1400019f3
mov r8, rdi
mov qword [rsp + 0x68], rdi
lea rdx, [rbp + 0xf80]
mov qword [rsp + 0x70], 0xf
lea rcx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x58], 0
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x58]
jmp 0x140001a91
mov r15, rdi
or r15, 0xf
cmp r15, r12
jbe 0x140001a12
movabs rax, 0x8000000000000000
mov r15, r12
add rax, 0x27
jmp 0x140001a39
cmp r15, 0x16
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140001a59
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001d30
mov rcx, rax
call fcn.1400028c0
test rax, rax
je 0x140001d29
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140001a6b
test rcx, rcx
je 0x140001a68
call fcn.1400028c0
mov r12, rax
jmp 0x140001a6b
xor r12d, r12d
mov r8, rdi
mov qword [rsp + 0x58], r12
lea rdx, [rbp + 0xf80]
mov qword [rsp + 0x68], rdi
mov rcx, r12
mov qword [rsp + 0x70], r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rdi], 0
cmp r15, 0x10
lea rbx, [rsp + 0x58]
cmovae rbx, r12
cmp rdi, 7
jb 0x140001c22
lea rsi, [rdi + rbx]
mov edx, 0x46
lea r8, [rsi - 6]
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001c1d
nop dword [rax]
cmp dword [rax], 0x65766946
jne 0x140001ae6
cmp word [rax + 4], 0x5f4d
jne 0x140001ae6
cmp byte [rax + 6], 0x62
je 0x140001b07
inc rax
lea r8, [rsi - 6]
sub r8, rax
mov rcx, rax
mov edx, 0x46
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140001ad0
jmp 0x140001c1d
cmp rax, rbx
jne 0x140001c1d
cmp r15, 0x10
lea rsi, [rsp + 0x58]
cmovae rsi, r12
cmp rdi, 0xf
jb 0x140001b9c
lea r14, [rdi + rsi]
mov edx, 0x5f
lea r8, [r14 - 0xe]
mov rcx, rsi
sub r8, rsi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140001b97
nop dword [rax]
nop word [rax + rax]
mov r8d, 0xf
lea rdx, str._GTAProcess.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140001b8a
inc rbx
lea r8, [r14 - 0xe]
sub r8, rbx
mov rcx, rbx
mov edx, 0x5f
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140001b50
jmp 0x140001b97
sub rbx, rsi
cmp rbx, 0xffffffffffffffff
jne 0x140001d08
mov r14d, dword [rsp + 0x28]
cmp r15, 0x10
lea rbx, [rsp + 0x58]
cmovae rbx, r12
cmp rdi, 0x10
jb 0x140001c1d
lea r8, [rbx - 0xf]
mov edx, 0x5f
add r8, rdi
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001c1d
nop dword [rax + rax]
movabs rcx, 0x6f7250656d61475f
cmp qword [rax], rcx
jne 0x140001bef
movabs rcx, 0x6578652e73736563
cmp qword [rax + 8], rcx
je 0x140001c10
inc rax
lea r8, [rbx - 0xf]
add r8, rdi
mov edx, 0x5f
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140001bd0
jmp 0x140001c1d
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x140001d08
mov rsi, qword [rsp + 0x20]
cmp r15, 0x10
jb 0x140001c5a
lea rdx, [r15 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140001c52
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d29
mov rcx, r12
call fcn.1400028b0
mov rdi, qword [rsp + 0x30]
movabs r12, 0x7fffffffffffffff
mov ebx, dword [rsp + 0x2c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add rdi, 4
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x30], rdi
cmp ebx, r14d
jb 0x1400018f0
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], 0
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov r14, qword [rsp + 0x11a8]
mov r12, qword [rsp + 0x11b0]
mov rdi, qword [rsp + 0x11e8]
mov rsi, qword [rsp + 0x11e0]
mov rbx, qword [rsp + 0x11d8]
mov r15, qword [rsp + 0x11a0]
mov rax, r13
mov rcx, qword [rbp + 0x1090]
xor rcx, rsp
call fcn.140002890
add rsp, 0x11b8
pop r13
pop rbp
ret
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [r13], xmm0
movups xmmword [r13 + 0x10], xmm1
jmp 0x140001cbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001500
int3
call fcn.1400015a0
int3