Function at 0x1400dc073
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1400dcb00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x2db8
call fcn.1400dc0d2
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x9e6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2dd8]
mov rax, qword [0x140299008]
xor rax, rbp
mov qword [rbp + 0x2d88], rax
lea rcx, [0x14029f0a3]
call fcn.1400dc3f2
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x240]
mov rdi, rax
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
mov dword [rbp + 0x2254], 0
mov dword [rbp + 0x2274], 0
mov qword [rbp + 0x2298], 0
mov qword [rbp + 0x22b8], 0
cmp qword [rbp + 0x2db0], 0
je 0x1400dcbce
cmp qword [rbp + 0x2db8], 0
je 0x1400dcbce
mov rcx, qword [rbp + 0x2db0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jl 0x1400dcbd5
xor eax, eax
jmp 0x1400dcef1
mov dword [rbp + 0x22d4], 0
jmp 0x1400dcbef
mov eax, dword [rbp + 0x22d4]
inc eax
mov dword [rbp + 0x22d4], eax
mov rcx, qword [rbp + 0x2db0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [rbp + 0x22d4], eax
jge 0x1400dcc78
movsxd rax, dword [rbp + 0x22d4]
mov rcx, qword [rbp + 0x2db0]
movzx eax, word [rcx + rax*2]
cmp eax, 0x61
jl 0x1400dcc55
movsxd rax, dword [rbp + 0x22d4]
mov rcx, qword [rbp + 0x2db0]
movzx eax, word [rcx + rax*2]
cmp eax, 0x7a
jg 0x1400dcc55
movsxd rax, dword [rbp + 0x22d4]
mov rcx, qword [rbp + 0x2db0]
movzx eax, word [rcx + rax*2]
sub eax, 0x20
movsxd rcx, dword [rbp + 0x22d4]
mov word [rbp + rcx*2 + 0x10], ax
jmp 0x1400dcc73
movsxd rax, dword [rbp + 0x22d4]
movsxd rcx, dword [rbp + 0x22d4]
mov rdx, qword [rbp + 0x2db0]
movzx eax, word [rdx + rax*2]
mov word [rbp + rcx*2 + 0x10], ax
jmp 0x1400dcbe1
lea r8, [rbp + 0x2254]
mov edx, 0x2000
lea rcx, [rbp + 0x240]
call fcn.1400dc195
test eax, eax
jne 0x1400dccaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____EnumProcesses_Failed_With_Error:__d_n
call fcn.1400dc1db
xor eax, eax
jmp 0x1400dcef1
mov eax, dword [rbp + 0x2254]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x2254], eax
mov dword [rbp + 0x22f4], 0
jmp 0x1400dccdf
mov eax, dword [rbp + 0x22f4]
inc eax
mov dword [rbp + 0x22f4], eax
mov eax, dword [rbp + 0x2254]
cmp dword [rbp + 0x22f4], eax
jae 0x1400dceef
movsxd rax, dword [rbp + 0x22f4]
mov r8d, dword [rbp + rax*4 + 0x240]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2298], rax
cmp qword [rbp + 0x2298], 0
je 0x1400dceea
lea rax, [rbp + 0x2320]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x2550]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r9, [rbp + 0x2274]
mov r8d, 8
lea rdx, [rbp + 0x22b8]
mov rcx, qword [rbp + 0x2298]
call fcn.1400dc078
test eax, eax
jne 0x1400dcd92
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12b
je 0x1400dcd8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____EnumProcessModules_Failed_With_Error:__d_n
call fcn.1400dc1db
jmp 0x1400dced3
mov r9d, 0x104
lea r8, [rbp + 0x2320]
mov rdx, qword [rbp + 0x22b8]
mov rcx, qword [rbp + 0x2298]
call fcn.1400dc429
test eax, eax
jne 0x1400dcdcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetModuleBaseName_Failed_With_Error:__d_n
call fcn.1400dc1db
jmp 0x1400dced3
lea rcx, [rbp + 0x2320]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jl 0x1400dcde8
jmp 0x1400dced3
mov dword [rbp + 0x2774], 0
jmp 0x1400dce02
mov eax, dword [rbp + 0x2774]
inc eax
mov dword [rbp + 0x2774], eax
lea rcx, [rbp + 0x2320]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [rbp + 0x2774], eax
jge 0x1400dce85
movsxd rax, dword [rbp + 0x2774]
movzx eax, word [rbp + rax*2 + 0x2320]
cmp eax, 0x61
jl 0x1400dce62
movsxd rax, dword [rbp + 0x2774]
movzx eax, word [rbp + rax*2 + 0x2320]
cmp eax, 0x7a
jg 0x1400dce62
movsxd rax, dword [rbp + 0x2774]
movzx eax, word [rbp + rax*2 + 0x2320]
sub eax, 0x20
movsxd rcx, dword [rbp + 0x2774]
mov word [rbp + rcx*2 + 0x2550], ax
jmp 0x1400dce80
movsxd rax, dword [rbp + 0x2774]
movsxd rcx, dword [rbp + 0x2774]
movzx eax, word [rbp + rax*2 + 0x2320]
mov word [rbp + rcx*2 + 0x2550], ax
jmp 0x1400dcdf4
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x2550]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1400dced3
mov rax, qword [rbp + 0x2db8]
mov rcx, qword [rbp + 0x2298]
mov qword [rax], rcx
cmp qword [rbp + 0x2dc0], 0
je 0x1400dcecc
movsxd rax, dword [rbp + 0x22f4]
mov rcx, qword [rbp + 0x2dc0]
mov eax, dword [rbp + rax*4 + 0x240]
mov dword [rcx], eax
mov eax, 1
jmp 0x1400dcef1
cmp qword [rbp + 0x2298], 0
je 0x1400dceea
mov rcx, qword [rbp + 0x2298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400dccd1
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140296250]
call fcn.1400dc375
mov rax, rdi
mov rcx, qword [rbp + 0x2d88]
xor rcx, rbp
call fcn.1400dc1f9
lea rsp, [rbp + 0x2d98]
pop rdi
pop rbp
ret