Function at 0x18003604b
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x18006f5f0
push rbp
push rdi
mov eax, 0x3ec8
call fcn.1800364f6
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xe2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1800ea138]
xor rax, rbp
mov qword [rbp + 0x3e98], rax
mov dword [rbp + 0x3e54], 0
lea rcx, [0x1800fd3aa]
call fcn.180037c84
lea rcx, [rbp + 8]
call fcn.180037c66
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x18006f68a
lea rdx, str.Failed_to_get_current_process_handle.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180036302
lea rdx, [0x180036127]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 8]
call fcn.180036523
jmp 0x18006fd8f
lea r9, [rbp + 0x2084]
mov r8d, 0x2000
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
call fcn.180036294
test eax, eax
jne 0x18006f6e4
lea rdx, str.Failed_to_enumerate_process_modules.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180036302
lea rdx, [0x180036127]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 8]
call fcn.180036523
jmp 0x18006fd8f
mov eax, dword [rbp + 0x2084]
xor edx, edx
mov ecx, 8
div rcx
mov dword [rbp + 0x20a4], eax
mov dword [rbp + 0x20c4], 0
jmp 0x18006f714
mov eax, dword [rbp + 0x20c4]
inc eax
mov dword [rbp + 0x20c4], eax
mov eax, dword [rbp + 0x20a4]
cmp dword [rbp + 0x20c4], eax
jge 0x18006faef
movsxd rax, dword [rbp + 0x20c4]
mov r9d, 0x104
lea r8, [rbp + 0x20f0]
mov rdx, qword [rbp + rax*8 + 0x70]
mov rcx, qword [rbp + 0x48]
call fcn.180037964
test eax, eax
je 0x18006faea
lea rdx, [rbp + 0x20f0]
lea rcx, [rbp + 0x2218]
call fcn.180036d5c
nop
mov byte [rbp + 0x3934], 0x2f
mov byte [rbp + 0x3954], 0x5c
lea rax, [rbp + 0x3978]
mov qword [rbp + 0x39a8], rax
lea rax, [rbp + 0x39c8]
mov qword [rbp + 0x39f8], rax
mov rdx, qword [rbp + 0x39a8]
lea rcx, [rbp + 0x2218]
call fcn.18003634d
mov qword [rbp + 0x3e68], rax
mov rdx, qword [rbp + 0x39f8]
lea rcx, [rbp + 0x2218]
call fcn.180037cf7
mov qword [rbp + 0x3e70], rax
lea r9, [rbp + 0x3934]
lea r8, [rbp + 0x3954]
mov rdx, qword [rbp + 0x3e68]
mov rcx, qword [rbp + 0x3e70]
call fcn.180036f55
lea rax, [rbp + 0x3a38]
mov qword [rbp + 0x3a68], rax
lea rax, [rbp + 0x3a88]
mov qword [rbp + 0x3ab8], rax
lea rdx, [rbp + 0x3b08]
lea rcx, [0x1800ebbe0]
call fcn.180037365
mov qword [rbp + 0x3e68], rax
mov rax, qword [rbp + 0x3e68]
mov qword [rbp + 0x3e70], rax
mov rdx, qword [rbp + 0x3a68]
lea rcx, [0x1800ebbe0]
call fcn.180037365
mov qword [rbp + 0x3e78], rax
mov rdx, qword [rbp + 0x3ab8]
lea rcx, [0x1800ebbe0]
call fcn.180036753
mov qword [rbp + 0x3e80], rax
lea r9, [rbp + 0x2218]
mov r8, qword [rbp + 0x3e78]
mov rdx, qword [rbp + 0x3e80]
lea rcx, [rbp + 0x3ad8]
call fcn.180037ac2
mov qword [rbp + 0x3e88], rax
mov rdx, qword [rbp + 0x3e70]
mov rcx, qword [rbp + 0x3e88]
call fcn.180036537
mov byte [rbp + 0x3a14], al
lea rcx, [rbp + 0x3ad8]
call fcn.180036208
nop
lea rcx, [rbp + 0x3b08]
call fcn.180036208
movzx eax, byte [rbp + 0x3a14]
test eax, eax
je 0x18006fade
lea rdx, [rbp + 0x2218]
lea rcx, [0x1800ebbe0]
call fcn.180036fa5
lea rax, [rbp + 0x3b38]
mov qword [rbp + 0x3b78], rax
lea rdx, [rbp + 0x20f0]
mov rcx, qword [rbp + 0x3b78]
call fcn.180036d5c
mov qword [rbp + 0x3e68], rax
mov rdx, qword [rbp + 0x3e68]
lea rcx, [rbp + 0x2258]
call fcn.180036528
nop
lea rcx, [rbp + 0x2258]
call fcn.180036663
movzx eax, al
test eax, eax
jne 0x18006fa0e
lea rax, [rbp + 0x3bb8]
mov qword [rbp + 0x3be8], rax
lea rax, [rbp + 0x3c08]
mov qword [rbp + 0x3c38], rax
lea rdx, [rbp + 0x3c88]
lea rcx, [0x1800ebc40]
call fcn.180037365
mov qword [rbp + 0x3e68], rax
mov rax, qword [rbp + 0x3e68]
mov qword [rbp + 0x3e70], rax
mov eax, dword [rbp + 0x3e54]
or eax, 1
mov dword [rbp + 0x3e54], eax
mov rdx, qword [rbp + 0x3be8]
lea rcx, [0x1800ebc40]
call fcn.180037365
mov qword [rbp + 0x3e78], rax
mov rdx, qword [rbp + 0x3c38]
lea rcx, [0x1800ebc40]
call fcn.180036753
mov qword [rbp + 0x3e80], rax
lea r9, [rbp + 0x2258]
mov r8, qword [rbp + 0x3e78]
mov rdx, qword [rbp + 0x3e80]
lea rcx, [rbp + 0x3c58]
call fcn.180037ac2
mov qword [rbp + 0x3e88], rax
mov eax, dword [rbp + 0x3e54]
or eax, 2
mov dword [rbp + 0x3e54], eax
mov rdx, qword [rbp + 0x3e70]
mov rcx, qword [rbp + 0x3e88]
call fcn.180036537
movzx eax, al
test eax, eax
je 0x18006fa0e
mov dword [rbp + 0x3e90], 1
jmp 0x18006fa18
mov dword [rbp + 0x3e90], 0
movzx eax, byte [rbp + 0x3e90]
mov byte [rbp + 0x3b94], al
mov eax, dword [rbp + 0x3e54]
and eax, 2
test eax, eax
je 0x18006fa46
and dword [rbp + 0x3e54], 0xfffffffd
lea rcx, [rbp + 0x3c58]
call fcn.180036208
nop
mov eax, dword [rbp + 0x3e54]
and eax, 1
test eax, eax
je 0x18006fa66
and dword [rbp + 0x3e54], 0xfffffffe
lea rcx, [rbp + 0x3c88]
call fcn.180036208
movzx eax, byte [rbp + 0x3b94]
test eax, eax
je 0x18006fad1
lea rdx, [rbp + 0x2258]
lea rcx, [0x1800ebc40]
call fcn.180036fa5
lea r8, [0x1800b600c]
lea rdx, [rbp + 0x2258]
lea rcx, [rbp + 0x3cb8]
call fcn.180037671
mov qword [rbp + 0x3e68], rax
mov rax, qword [rbp + 0x3e68]
mov qword [rbp + 0x3e70], rax
mov rdx, qword [rbp + 0x3e70]
lea rcx, [rbp + 8]
call fcn.180036622
nop
lea rcx, [rbp + 0x3cb8]
call fcn.180036523
nop
lea rcx, [rbp + 0x2258]
call fcn.180036523
nop
lea rcx, [rbp + 0x2218]
call fcn.180036523
jmp 0x18006f706
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x2084]
mov edx, 0x1000
lea rcx, [rbp + 0x22a0]
call fcn.180036c08
test eax, eax
jne 0x18006fb47
lea rdx, str.Failed_to_enumerate_processes.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180036302
lea rdx, [0x180036127]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 8]
call fcn.180036523
jmp 0x18006fd8f
mov eax, dword [rbp + 0x2084]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x32b4], eax
mov dword [rbp + 0x32d4], 0
jmp 0x18006fb77
mov eax, dword [rbp + 0x32d4]
inc eax
mov dword [rbp + 0x32d4], eax
mov eax, dword [rbp + 0x32b4]
cmp dword [rbp + 0x32d4], eax
jae 0x18006fd86
mov eax, dword [rbp + 0x32d4]
cmp dword [rbp + rax*4 + 0x22a0], 0
je 0x18006fd81
mov eax, dword [rbp + 0x32d4]
mov edx, dword [rbp + rax*4 + 0x22a0]
lea rcx, [rbp + 0x32f8]
call fcn.180037df6
nop
lea rcx, [rbp + 0x32f8]
call fcn.180036663
movzx eax, al
test eax, eax
jne 0x18006fcb2
lea rax, [rbp + 0x3d18]
mov qword [rbp + 0x3d48], rax
lea rax, [rbp + 0x3d68]
mov qword [rbp + 0x3d98], rax
lea rdx, [rbp + 0x3de8]
lea rcx, [0x1800ebc40]
call fcn.180037365
mov qword [rbp + 0x3e68], rax
mov rax, qword [rbp + 0x3e68]
mov qword [rbp + 0x3e70], rax
mov eax, dword [rbp + 0x3e54]
or eax, 4
mov dword [rbp + 0x3e54], eax
mov rdx, qword [rbp + 0x3d48]
lea rcx, [0x1800ebc40]
call fcn.180037365
mov qword [rbp + 0x3e78], rax
mov rdx, qword [rbp + 0x3d98]
lea rcx, [0x1800ebc40]
call fcn.180036753
mov qword [rbp + 0x3e80], rax
lea r9, [rbp + 0x32f8]
mov r8, qword [rbp + 0x3e78]
mov rdx, qword [rbp + 0x3e80]
lea rcx, [rbp + 0x3db8]
call fcn.180037ac2
mov qword [rbp + 0x3e88], rax
mov eax, dword [rbp + 0x3e54]
or eax, 8
mov dword [rbp + 0x3e54], eax
mov rdx, qword [rbp + 0x3e70]
mov rcx, qword [rbp + 0x3e88]
call fcn.180036537
movzx eax, al
test eax, eax
je 0x18006fcb2
mov dword [rbp + 0x3e90], 1
jmp 0x18006fcbc
mov dword [rbp + 0x3e90], 0
movzx eax, byte [rbp + 0x3e90]
mov byte [rbp + 0x3cf4], al
mov eax, dword [rbp + 0x3e54]
and eax, 8
test eax, eax
je 0x18006fcea
and dword [rbp + 0x3e54], 0xfffffff7
lea rcx, [rbp + 0x3db8]
call fcn.180036208
nop
mov eax, dword [rbp + 0x3e54]
and eax, 4
test eax, eax
je 0x18006fd0a
and dword [rbp + 0x3e54], 0xfffffffb
lea rcx, [rbp + 0x3de8]
call fcn.180036208
movzx eax, byte [rbp + 0x3cf4]
test eax, eax
je 0x18006fd75
lea rdx, [rbp + 0x32f8]
lea rcx, [0x1800ebc40]
call fcn.180036fa5
lea r8, [0x1800b600c]
lea rdx, [rbp + 0x32f8]
lea rcx, [rbp + 0x3e18]
call fcn.180037671
mov qword [rbp + 0x3e68], rax
mov rax, qword [rbp + 0x3e68]
mov qword [rbp + 0x3e70], rax
mov rdx, qword [rbp + 0x3e70]
lea rcx, [rbp + 8]
call fcn.180036622
nop
lea rcx, [rbp + 0x3e18]
call fcn.180036523
nop
lea rcx, [rbp + 0x32f8]
call fcn.180036523
jmp 0x18006fb69
lea rcx, [rbp + 8]
call fcn.180036523
lea rcx, [rbp - 0x20]
lea rdx, [0x1800b18f0]
call fcn.1800377a7
mov rcx, qword [rbp + 0x3e98]
xor rcx, rbp
call fcn.180036e4c
lea rsp, [rbp + 0x3ea8]
pop rdi
pop rbp
ret