Function at 0x404be0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
mov rdi, rcx
test rdx, rdx
je 0x404c73
mov ebp, r9d
mov rbx, r8
mov r14, rdx
mov ecx, 0x410
xor edx, edx
mov r8d, r14d
call sub.KERNEL32.dll_OpenProcess
mov rsi, rax
test rax, rax
jne 0x404c32
mov ecx, 0x1000
xor edx, edx
mov r8d, r14d
call sub.KERNEL32.dll_OpenProcess
mov rsi, rax
test rax, rax
je 0x404c73
mov qword [rsp + 0x128], rsi
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x158]
mov rcx, rsi
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
je 0x404c7f
mov qword [rdi], 2
mov rcx, rsi
call fcn.004fb96c
jmp 0x4051d0
mov qword [rdi], 2
jmp 0x4051d0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0x188], 0
mov dword [rsp + 0x20], 3
lea rdx, [rsp + 0xe8]
lea r9, [rsp + 0x188]
mov rcx, rsi
mov r8d, 4
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x404d21
mov r15, qword [rsp + 0xe8]
lea r12, [rsp + 0x188]
mov r8d, 0x20a
mov rcx, r12
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rsi
mov rdx, r15
mov r8, r12
mov r9d, 0x105
call sub.PSAPI.DLL_GetModuleBaseNameW
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x188]
mov r8d, 0x105
call sym.sysinfo::windows::process::null_terminated_wchar_to_string::h724d52ad4a003d0d
jmp 0x404d38
mov qword [rsp + 0x110], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
mov dword [rsp + 0x6c], ebp
lea r15, [rsp + 0x188]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rsi
xor edx, edx
mov r8, r15
mov r9d, 0x105
call sub.PSAPI.DLL_GetModuleFileNameExW
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x188]
mov r8d, 0x105
call sym.sysinfo::windows::process::null_terminated_wchar_to_string::h724d52ad4a003d0d
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xf0]
call dbg.from_string
mov rbp, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x2f], al
mov eax, dword [rsp + 0x49]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x53], eax
test r13, r13
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xc8], rbp
je 0x404e08
js 0x4051f8
mov rax, qword [0x005757d8]
movzx eax, byte [rax]
mov edx, 1
mov rcx, r13
call sym.__rust_alloc
mov r15, rax
test rax, rax
jne 0x404e0e
mov ecx, 1
mov rdx, r13
call dbg.handle_alloc_error
jmp 0x4051fd
mov r15d, 1
mov rcx, r15
mov rdx, rbp
mov r8, r13
call sym.memcpy
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xf8], r13
mov qword [rsp + 0x100], r13
movzx eax, byte [rsp + 0x2f]
mov byte [rsp + 0x108], al
lea rcx, [rsp + 0xf0]
call sym.std::path::PathBuf::pop::hce1fb48828d322c0
lea r15, [rsp + 0x188]
lea rdx, [rsp + 0x128]
mov rcx, r15
call sym.sysinfo::windows::process::get_process_params::h2cd90c277037ee9d
cmp byte [rsp + 0x1d0], 2
mov qword [rsp + 0xd8], rbx
jne 0x404f20
mov qword [rsp + 0x70], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x90], 8
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xb0], 1
movups xmmword [rsp + 0xb8], xmm0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
call dbg.from_string
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x130], xmm0
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0xb0], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rax
jmp 0x404f84
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0x188]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm0, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x1c8]
movaps xmmword [rsp + 0x130], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x188], 0
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r8, r15
mov r9, r15
call sub.KERNEL32.dll_GetProcessTimes
movabs rax, 0xd6bf94d5e57a42bd
mul qword [rsp + 0x30]
shr rdx, 0x17
movabs r15, 0xfffffffd49ef6f00
add r15, rdx
xor ebp, ebp
cmp r15, qword [rsp + 0xd8]
cmovbe rbp, r15
xor r12d, r12d
cmp qword [rsp + 0xe0], 0
setne bl
lea rcx, [rsp + 0x188]
mov rdx, rsi
mov r8d, dword [rsp + 0x6c]
call sym.sysinfo::windows::process::get_process_user_id::h9438680041b41133
mov rax, qword [0x005757d8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x4051e7
mov r8, qword [rsp + 0xd8]
sub r8, rbp
mov r12b, bl
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x10], rsi
mov rcx, qword [rsp + 0x120]
mov qword [rdi + 0x88], rcx
movups xmm0, xmmword [rsp + 0x110]
movups xmmword [rdi + 0x78], xmm0
mov rcx, qword [rsp + 0x198]
mov qword [rdi + 0xd8], rcx
movups xmm0, xmmword [rsp + 0x188]
movups xmmword [rdi + 0xc8], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rdi + 0x90], xmm0
mov rcx, qword [rsp + 0x80]
mov qword [rdi + 0xa0], rcx
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [rdi + 0xa8], xmm0
mov rcx, qword [rsp + 0xa0]
mov qword [rdi + 0xb8], rcx
mov rcx, qword [rsp + 0xc8]
mov qword [rdi + 0x18], rcx
mov rcx, qword [rsp + 0xd0]
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], r13
movzx ecx, byte [rsp + 0x2f]
mov byte [rdi + 0x30], cl
mov ecx, dword [rsp + 0x50]
mov edx, dword [rsp + 0x53]
mov dword [rdi + 0x31], ecx
mov dword [rdi + 0x34], edx
mov rcx, qword [rsp + 0x60]
mov qword [rdi + 0x38], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rdi + 0x40], rcx
movaps xmm0, xmmword [rsp + 0x140]
movups xmmword [rdi + 0x48], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movups xmmword [rdi + 0x68], xmm1
movups xmmword [rdi + 0x58], xmm0
xorps xmm0, xmm0
movups xmmword [rdi + 0xf8], xmm0
movups xmmword [rdi + 0x108], xmm0
mov qword [rdi], r12
mov rcx, qword [rsp + 0xe0]
mov qword [rdi + 8], rcx
mov dword [rdi + 0x10], 1
mov qword [rdi + 0xc0], r14
movups xmmword [rdi + 0xe0], xmm0
mov qword [rdi + 0xf0], rax
mov qword [rdi + 0x118], r15
mov qword [rdi + 0x120], r8
movups xmmword [rdi + 0x138], xmm0
movups xmmword [rdi + 0x128], xmm0
mov dword [rdi + 0x148], 0
mov byte [rdi + 0x14c], 1
mov rax, rdi
add rsp, 0x398
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x18
call dbg.handle_alloc_error
jmp 0x4051fd
call dbg.capacity_overflow
ud2