Function at 0x7ff741c08d20
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x7ff741cd7188]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r15, r8
mov ecx, 0x18
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x7ff741c09056
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.kernel32.dll_Module32First]
test eax, eax
je 0x7ff741c08fd3
xor r13d, r13d
movabs rbx, 0x7fffffffffffffff
mov rcx, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea rax, [rbp - 0x70]
mov r8, rcx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x7ff741c08dc0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.7ff741c04170
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
setae r8b
cmovae rdx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsi, rdx
lea r14, [rsp + 0x40]
test r8b, r8b
cmovne r14, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
cmp r14, rsi
jne 0x7ff741c08e32
mov rsi, r13
mov qword [rsp + 0x30], r13
mov edi, 0xf
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x20], sil
mov rbx, qword [rsp + 0x20]
jmp 0x7ff741c08f13
sub rsi, r14
cmp rsi, rbx
ja 0x7ff741c0909c
cmp rsi, 0x10
jae 0x7ff741c08e7b
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0xf
mov r8, rsi
mov rdx, r14
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rsi + 0x20], 0
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
jmp 0x7ff741c08f13
mov rdi, rsi
or rdi, 0xf
cmp rdi, rbx
jbe 0x7ff741c08e8c
mov rdi, rbx
jmp 0x7ff741c08e99
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x7ff741c08ee0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff741c09096
mov rcx, rax
call fcn.7ff741ca8870
test rax, rax
je 0x7ff741c09088
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x7ff741c08ef2
test rcx, rcx
je 0x7ff741c08eef
call fcn.7ff741ca8870
mov rbx, rax
jmp 0x7ff741c08ef2
mov rbx, r13
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov rdx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x7ff741c08f20
mov rdx, qword [r15]
lea rcx, [rsp + 0x20]
cmp rdi, 0x10
setae r14b
cmovae rcx, rbx
cmp rsi, qword [r15 + 0x10]
jne 0x7ff741c08f47
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x7ff741c08fe0
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.kernel32.dll_Module32Next]
mov esi, eax
test r14b, r14b
je 0x7ff741c08f8e
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x7ff741c08f85
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c09088
mov rcx, rbx
call fcn.7ff741ca88ac
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x7ff741c08fcb
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c08fc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c0908f
call fcn.7ff741ca88ac
test esi, esi
jne 0x7ff741c08d94
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x7ff741c09058
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp rdi, 0x10
jb 0x7ff741c0901d
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x7ff741c09014
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c09088
mov rcx, rbx
call fcn.7ff741ca88ac
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x7ff741c09056
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c09051
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c0908f
call fcn.7ff741ca88ac
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.7ff741ca8850
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff741c016f0
int3
call fcn.7ff741c01790
int3