Function at 0x2d9e3c7d70
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebx, edx
mov ecx, 0x40
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, 0x208
mov dword [rsp + 0x60], 1
mov rbp, rax
mov byte [rax], 0x81
call fcn.2d9e3da838
mov ecx, 0x208
mov rdi, rax
call fcn.2d9e3da838
mov ecx, 0x208
mov r12, rax
call fcn.2d9e3da838
mov ecx, 0x208
mov r13, rax
call fcn.2d9e3da838
mov ecx, 0x28
mov qword [rsp + 0x70], rax
mov r15, rax
call fcn.2d9e3da838
mov ecx, 0x438
mov r14, rax
call fcn.2d9e3da7fc
mov edx, ebx
mov ecx, 0x18
mov rsi, rax
mov dword [rax], 0x438
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
je 0x2d9e3c80ec
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x2d9e3c80e1
lea r15, [rsi + 0x230]
nop dword [rax]
mov rax, qword [r15]
cmp rax, qword [0x2d9e4094b8]
jne 0x2d9e3c7e96
lea rax, [rsi + 0x240]
mov rdx, rdi
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x2d9e3c7e60
mov rdx, rsi
mov rcx, rdi
sub rdx, rdi
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx + rcx + 0x230], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x2d9e3c7e80
jmp 0x2d9e3c7ee4
mov r8d, 0x16
lea rdx, [0x2d9e409520]
mov rcx, r15
call fcn.2d9e3f8230
test eax, eax
jne 0x2d9e3c7ee4
lea r8, [rsi + 0x25c]
mov rcx, rdi
lea rdx, [0x2d9e409500]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, rsi
mov rcx, rdi
sub rdx, rdi
nop
movzx eax, word [rcx]
mov word [rdx + rcx + 0x230], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x2d9e3c7ed0
mov r9, qword [rsp + 0x70]
mov r8, r13
mov rdx, r12
mov rcx, r15
call fcn.2d9e3c95d0
xor eax, eax
mov rdx, r14
mov qword [r14], rax
mov rcx, r15
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
call fcn.2d9e3c7c90
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x70]
add ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r13
add ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r12
add ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsi + 0x30]
add ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, eax
mov rcx, rbp
lea eax, [rbx + rbx]
mov ebx, dword [rsp + 0x60]
add ebx, 0x14
add ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp rax, rbx
jae 0x2d9e3c7f8a
mov r8d, 0x42
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rbp, rax
mov eax, dword [rsi + 0x18]
lea rcx, [rsi + 0x30]
mov ebx, dword [rsp + 0x60]
mov dword [rbx + rbp], eax
add ebx, 4
mov eax, dword [rsi + 0x20]
mov dword [rbx + rbp], eax
add ebx, 4
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
lea rdx, [rsi + 0x30]
add rcx, rbp
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
lea rcx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r15
lea ebx, [rbx + rax*2]
add ebx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
mov rdx, r15
add rcx, rbp
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r12
lea ebx, [rbx + rax*2]
add ebx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
mov rdx, r12
add rcx, rbp
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r13
lea ebx, [rbx + rax*2]
add ebx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
mov rdx, r13
add rcx, rbp
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x70]
lea ebx, [rbx + rax*2]
add ebx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x70]
mov ecx, ebx
add rcx, rbp
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r14
lea ebx, [rbx + rax*2]
add ebx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
mov rdx, r14
add rcx, rbp
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.2d9e3e2bb0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov rdx, rsi
lea eax, [rbx + rax*2]
mov dword [rsp + 0x60], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x2d9e3c7e40
mov r15, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.2d9e3da7f4
mov rcx, r12
call fcn.2d9e3da7f4
mov rcx, r13
call fcn.2d9e3da7f4
mov rcx, r15
call fcn.2d9e3da7f4
mov rcx, r14
call fcn.2d9e3da7f4
mov edx, 0x438
mov rcx, rsi
call fcn.2d9e3da7f4
mov edx, dword [rsp + 0x60]
mov r8d, 0x42
mov rcx, rbp
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LocalReAlloc]