Function at 0x1400339e0
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x440
lea r14, [rcx + 8]
mov qword [rsp + 0x488], r14
cmp qword [r14], 0
je 0x140033d9b
mov rcx, qword [rcx]
test rcx, rcx
je 0x140033a1d
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, qword [rax + 8]
jmp 0x140033a26
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
mov qword [rsp + 0x480], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
mov qword [rsp + 0x490], rax
cmp rax, 0xffffffffffffffff
je 0x140033d9b
mov dword [0x1401d0c90], 0
mov dword [0x14015ac90], 0x438
lea rbx, [0x14015ac90]
mov rdx, rbx
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x140033bce
nop word [rax + rax]
movsxd rax, dword [0x1401d0c90]
imul rdx, rax, 0x760
lea r10, [rdx + 0x75c]
add r10, rbx
lea r9, [rdx + 0x758]
add r9, rbx
lea rcx, [rdx + 0x754]
add rcx, rbx
lea rax, [rdx + 0x744]
add rax, rbx
lea r8, [rdx + 0x438]
add r8, rbx
add rdx, rbx
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9d, 0x30c
mov rcx, rsi
call fcn.1400340f0
mov edi, dword [0x1401d0c90]
jmp 0x140033b9b
inc edi
mov dword [0x1401d0c90], edi
cmp edi, 0x100
jae 0x140033bd4
movsxd rax, edi
imul rdx, rax, 0x760
add rdx, rbx
mov dword [rdx], 0x438
mov rcx, r12
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x140033a90
mov edi, dword [0x1401d0c90]
movsxd rax, edi
imul rcx, rax, 0x760
movabs rax, 0x8ad8f2fba9386823
imul rcx
lea r8, [rcx + rdx]
sar r8, 0xa
mov rax, r8
shr rax, 0x3f
add r8, rax
lea rdx, [rcx + rbx]
xor r9d, r9d
mov rcx, rbx
call fcn.1400312f0
xor eax, eax
mov dword [rsp + 0x480], eax
test edi, edi
jle 0x140033d8e
lea r13, [0x14015b3e2]
mov r12, qword [rsp + 0x488]
nop dword [rax]
mov qword [rsp + 0x488], 0
cdqe
imul r15, rax, 0x760
lea rcx, [r15 + 0x30]
add rcx, rbx
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x488]
mov qword [rsp + 0x20], rax
mov r9d, 0x30c
lea r8, [rsp + 0x130]
mov edx, 0x100
call fcn.140032960
movzx eax, byte [r13 + 1]
movzx ecx, byte [r13]
movzx edx, byte [r13 - 1]
movzx r8d, byte [r13 - 2]
movzx r10d, byte [r13 - 3]
movzx r11d, byte [r13 - 4]
movzx edi, byte [r13 - 5]
movzx esi, byte [r13 - 6]
movzx r14d, word [r13 - 8]
movzx r9d, word [r13 - 0xa]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov r8d, dword [r13 - 0xe]
lea rdx, str._08lx__04hx__04hx__02x_02x_02x_02x_02x_02x_02x_02x
lea rcx, [rsp + 0xb0]
call fcn.140032930
mov rax, qword [r13 - 0x73a]
mov qword [rsp + 0x70], rax
mov eax, dword [r13 - 0x732]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x80], rax
lea rax, [r15 + 0x438]
add rax, rbx
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x88], rax
mov eax, dword [r13 + 2]
mov dword [rsp + 0x98], eax
mov eax, dword [r13 + 6]
mov dword [rsp + 0x9c], eax
mov eax, dword [r13 + 0xa]
mov dword [rsp + 0xa0], eax
lea rdx, [r12 + 0x10]
lea rcx, [rsp + 0x70]
call qword [r12]
mov eax, dword [rsp + 0x480]
inc eax
mov dword [rsp + 0x480], eax
lea r13, [r13 + 0x760]
cmp eax, dword [0x1401d0c90]
jl 0x140033c30
mov r12, qword [rsp + 0x490]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140033d9d
xor al, al
add rsp, 0x440
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret