Function at 0x7ff741c084e0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2500]
mov eax, 0x2600
call fcn.7ff741ca9290
sub rsp, rax
mov rax, qword [0x7ff741cd7188]
xor rax, rsp
mov qword [rbp + 0x24f0], rax
mov qword [rsp + 0x38], r9
mov r13, rdx
mov qword [rsp + 0x28], rdx
xor r12d, r12d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x7ff741c08583
mov word [rsp + 0x20], 0x21
mov byte [rsp + 0x21], r12b
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
lea rax, [rsp + 0x21]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x7ff741c08570
lea rdx, [rsp + 0x21]
jmp 0x7ff741c08bbe
mov r9d, 0x104
lea r8, [rbp + 0x22e0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.kernel32.dll_K32GetModuleFileNameExW]
mov rcx, rbx
test eax, eax
jne 0x7ff741c085e3
call qword [sym.imp.kernel32.dll_CloseHandle]
mov word [rsp + 0x20], 0x14
mov byte [rsp + 0x21], r12b
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
lea rax, [rsp + 0x21]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], r12b
jne 0x7ff741c085d0
lea rdx, [rsp + 0x21]
jmp 0x7ff741c08bbe
lea r9, [rsp + 0x60]
mov r8d, 0x2000
lea rdx, [rbp + 0xd0]
call qword [sym.imp.kernel32.dll_K32EnumProcessModules]
mov rdi, 0xffffffffffffffff
test eax, eax
je 0x7ff741c08b7f
mov ecx, r12d
mov dword [rsp + 0x20], ecx
test dword [rsp + 0x60], 0xfffffff8
jbe 0x7ff741c08b7f
movabs rsi, 0x7ffffffffffffffe
movabs r15, 0x7fffffffffffffff
nop dword [rax]
nop word [rax + rax]
mov edx, ecx
mov r9d, 0x104
lea r8, [rbp + 0x20d0]
mov rdx, qword [rbp + rdx*8 + 0xd0]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x7ff741c08b66
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea rax, [rbp + 0x20d0]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x7ff741c08683
cmp rbx, rsi
ja 0x7ff741c08cff
mov qword [rbp - 0x80], 7
cmp rbx, 8
jae 0x7ff741c086cb
mov qword [rsp + 0x78], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x20d0]
lea rcx, [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x68], r12w
jmp 0x7ff741c0876c
mov r14, rbx
or r14, 7
cmp r14, rsi
jbe 0x7ff741c086e0
mov r14, rsi
lea rcx, [r15 + r15]
jmp 0x7ff741c08706
cmp r14, 0xa
mov eax, 0xa
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, r15
ja 0x7ff741c08cf9
add rcx, rcx
cmp rcx, 0x1000
jb 0x7ff741c08732
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff741c08cf9
mov rcx, rax
call fcn.7ff741ca8870
test rax, rax
je 0x7ff741c08cf2
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x7ff741c08744
test rcx, rcx
je 0x7ff741c08741
call fcn.7ff741ca8870
mov rsi, rax
jmp 0x7ff741c08744
mov rsi, r12
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x20d0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rsi + rbx], r12w
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
setae r8b
cmovae rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
lea r14, [rdx + rax*2]
lea rsi, [rsp + 0x68]
test r8b, r8b
cmovne rsi, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
cmp rsi, r14
jne 0x7ff741c087c0
mov r14, r12
mov qword [rsp + 0x50], r12
mov ecx, 0xf
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x40], 0
jmp 0x7ff741c088d1
mov rax, r14
sub rax, rsi
sar rax, 1
mov rdx, r12
mov qword [rsp + 0x50], rdx
mov ebx, 0xf
mov qword [rsp + 0x58], rbx
cmp rax, r15
ja 0x7ff741c08d11
cmp rax, 0x10
jb 0x7ff741c08880
mov rbx, rax
or rbx, 0xf
cmp rbx, r15
jbe 0x7ff741c087ff
mov rbx, r15
jmp 0x7ff741c0880c
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rdi
cmp rcx, 0x1000
jb 0x7ff741c08854
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff741c08d05
mov rcx, rax
call fcn.7ff741ca8870
mov rcx, rax
test rax, rax
je 0x7ff741c08ceb
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x50]
jmp 0x7ff741c08868
test rcx, rcx
je 0x7ff741c08865
call fcn.7ff741ca8870
mov rdx, qword [rsp + 0x50]
jmp 0x7ff741c08868
mov rax, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
cmp rbx, 0x10
cmovae rcx, qword [rsp + 0x40]
movzx eax, byte [rsi]
mov byte [rcx + rdx], al
mov rdx, qword [rsp + 0x50]
inc rdx
mov qword [rsp + 0x50], rdx
add rsi, 2
cmp rsi, r14
je 0x7ff741c088b2
mov rbx, qword [rsp + 0x58]
jmp 0x7ff741c08880
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov byte [rsp + 0x24], 0x76
mov al, 0x2a
xor edx, edx
xor al, 0x76
mov byte [rsp + 0x25], al
mov byte [rsp + 0x26], dl
lea rax, [rsp + 0x25]
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], dl
jne 0x7ff741c088f0
lea rsi, [rsp + 0x40]
cmp rcx, 0x10
setae r12b
mov r15, qword [rsp + 0x40]
cmovae rsi, r15
test rbx, rbx
je 0x7ff741c08987
test r14, r14
je 0x7ff741c08987
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x25]
lea rdx, [rsp + 0x25]
add rdx, rbx
lea rax, [rsp + 0x25]
cmp rax, rdx
je 0x7ff741c08950
nop
movzx eax, byte [rcx]
mov byte [rbp + rax - 0x30], 1
inc rcx
cmp rcx, rdx
jne 0x7ff741c08940
lea rax, [r14 - 1]
mov rbx, rdi
cmp rax, rdi
cmovb rbx, rax
add rbx, rsi
movzx eax, byte [rbx]
cmp byte [rbp + rax - 0x30], 0
jne 0x7ff741c08982
nop dword [rax + rax]
cmp rbx, rsi
je 0x7ff741c08987
dec rbx
movzx eax, byte [rbx]
cmp byte [rbp + rax - 0x30], 0
je 0x7ff741c08970
sub rbx, rsi
jmp 0x7ff741c0898a
mov rbx, rdi
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov r8, rbx
cmp r14, rbx
cmovb r8, r14
lea rdx, [rsp + 0x40]
test r12b, r12b
cmovne rdx, r15
lea rcx, [rbp - 0x58]
call fcn.7ff741c04170
nop
inc rbx
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xor r12d, r12d
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jb 0x7ff741c08d0b
sub rax, rbx
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
add rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.7ff741c04170
mov r15, qword [rsp + 0x38]
mov rdx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x7ff741c08a1a
mov rdx, qword [r15]
lea rcx, [rbp - 0x78]
mov rsi, qword [rbp - 0x60]
cmp rsi, 0x10
setae r14b
mov rbx, qword [rbp - 0x78]
cmovae rcx, rbx
mov r8, qword [rbp - 0x68]
cmp r8, qword [r15 + 0x10]
jne 0x7ff741c08a49
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x7ff741c08bf6
test r14b, r14b
je 0x7ff741c08a80
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x7ff741c08a77
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c08cdd
mov rcx, rbx
call fcn.7ff741ca88ac
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x7ff741c08abc
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c08ab6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c08ce4
call fcn.7ff741ca88ac
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x7ff741c08af9
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c08af4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c08ceb
call fcn.7ff741ca88ac
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x7ff741c08b4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c08b48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c08cf2
call fcn.7ff741ca88ac
movabs r15, 0x7fffffffffffffff
movabs rsi, 0x7ffffffffffffffe
mov rbx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
inc ecx
mov dword [rsp + 0x20], ecx
mov eax, dword [rsp + 0x60]
shr eax, 3
cmp ecx, eax
jb 0x7ff741c08640
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov word [rsp + 0x20], 0x59
mov byte [rsp + 0x21], 0
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
lea rax, [rsp + 0x21]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x7ff741c08bb0
lea rdx, [rsp + 0x21]
mov r8, rdi
mov rcx, r13
call fcn.7ff741c04170
mov rax, r13
mov rcx, qword [rbp + 0x24f0]
xor rcx, rsp
call fcn.7ff741ca8850
mov rbx, qword [rsp + 0x2640]
add rsp, 0x2600
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.kernel32.dll_CloseHandle]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [r13], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [r13 + 0x10], xmm1
cmp rsi, 0x10
jb 0x7ff741c08c4b
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x7ff741c08c42
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c08cdd
mov rcx, rbx
call fcn.7ff741ca88ac
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x7ff741c08c84
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c08c7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c08ceb
call fcn.7ff741ca88ac
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x7ff741c08bc9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c08cd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c08cf2
call fcn.7ff741ca88ac
jmp 0x7ff741c08bc9
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff741c016f0
int3
call fcn.7ff741c01790
nop
call fcn.7ff741c016f0
nop
call fcn.7ff741c04040
nop
call fcn.7ff741c01790
int3