Function at 0x140003760
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2270
call fcn.1400767f0
sub rsp, rax
mov rax, qword [0x1400a40c0]
xor rax, rsp
mov qword [rsp + 0x2260], rax
mov r14, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
mov rbx, rax
test rax, rax
je 0x140003a90
lea r9, [rsp + 0x28]
mov r8d, 0x2000
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140003a85
test dword [rsp + 0x28], 0xfffffff8
mov r12d, r15d
jbe 0x140003a85
movabs rsi, 0x7ffffffffffffffe
nop word [rax + rax]
mov eax, r12d
lea r13, [rsp + 0x50]
mov rdx, qword [r13 + rax*8]
lea r13, [r13 + rax*8]
mov r9d, 0x104
lea r8, [rsp + 0x2050]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x140003a72
xorps xmm0, xmm0
lea rax, [rsp + 0x2050]
movups xmmword [rsp + 0x30], xmm0
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], r15w
jne 0x140003850
cmp rdi, rsi
ja 0x140003b1a
cmp rdi, 7
ja 0x1400038aa
lea rbx, [rdi + rdi]
mov qword [rsp + 0x40], rdi
mov r8, rbx
mov qword [rsp + 0x48], 7
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x30], r15w
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
jmp 0x140003962
mov rbp, rdi
or rbp, 7
cmp rbp, rsi
jbe 0x1400038c9
movabs rax, 0x7fffffffffffffff
mov rbp, rsi
lea rcx, [rax + rax]
jmp 0x1400038f9
cmp rbp, 0xa
mov eax, 0xa
cmovb rbp, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbp + 1]
cmp rcx, rax
ja 0x140003b14
add rcx, rcx
cmp rcx, 0x1000
jb 0x140003925
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b14
mov rcx, rax
call fcn.140075f70
test rax, rax
je 0x140003b0d
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140003937
test rcx, rcx
je 0x140003934
call fcn.140075f70
mov rsi, rax
jmp 0x140003937
mov rsi, r15
lea rbx, [rdi + rdi]
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x2050]
mov qword [rsp + 0x48], rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r15w
mov r10, 0xffffffffffffffff
nop dword [rax]
inc r10
cmp word [r14 + r10*2], r15w
jne 0x140003970
cmp rbp, 7
lea rbx, [rsp + 0x30]
cmova rbx, rsi
cmp r10, rdi
ja 0x140003a28
sub rdi, r10
test r10, r10
je 0x140003acd
movzx r11d, word [r14]
inc rdi
mov rax, rbx
lea rdi, [rbx + rdi*2]
nop word [rax + rax]
mov rcx, rdi
mov rdx, r15
sub rcx, rax
sar rcx, 1
je 0x1400039da
cmp word [rax], r11w
je 0x1400039d7
cmp rcx, 1
je 0x1400039da
add rax, 2
dec rcx
cmp word [rax], r11w
jne 0x1400039c4
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140003a28
mov r8, r10
mov rdx, r14
test r10, r10
je 0x140003a18
mov r9, rax
sub r9, r14
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140003ac4
add rdx, 2
sub r8, 1
jne 0x140003a00
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x140003acd
cmp rbp, 7
jbe 0x140003a63
lea rdx, [rbp*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003a5b
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b0d
mov rcx, rsi
call fcn.1400762bc
mov rbx, qword [rsp + 0x20]
movabs rsi, 0x7ffffffffffffffe
mov eax, dword [rsp + 0x28]
inc r12d
shr eax, 3
cmp r12d, eax
jb 0x140003800
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r15
mov rcx, qword [rsp + 0x2260]
xor rcx, rsp
call fcn.140075f50
lea r11, [rsp + 0x2270]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
add rax, 2
jmp 0x1400039b0
mov r15, qword [r13]
cmp rbp, 7
jbe 0x140003a85
lea rdx, [rbp*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003b00
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b0d
mov rcx, rsi
call fcn.1400762bc
jmp 0x140003a85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001c50
int3
call fcn.140001cf0
int3