Function at 0x140047240
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x20], edi
mov rax, qword [sym.pleskstartuphandler.exe_m_ExecuteContext_4D93FADE_7B9E_4286_AE07_54AF471F7E22]
test rax, rax
jne 0x140047470
mov ecx, 0x800
call fcn.1400b5f7c
mov rsi, rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x60]
mov r8d, 0x800
mov rdx, rsi
call sub.KERNEL32.dll_K32EnumProcessModules
mov ebx, dword [rsp + 0x60]
cmp ebx, 0x800
jbe 0x140047374
mov r14, rsi
mov edx, ebx
mov rcx, rsi
call fcn.1400b9a60
mov rsi, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x140047308
mov rcx, r14
call fcn.1400b5f68
lea rcx, [0x1400471e0]
call fcn.1400ab40c
lea ecx, [rdi + 0x20]
call fcn.1400ab188
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400472f2
mov rcx, rax
call fcn.140047010
mov rdi, rax
mov qword [sym.pleskstartuphandler.exe_m_ExecuteContext_4D93FADE_7B9E_4286_AE07_54AF471F7E22], rdi
mov rax, rdi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov dword [rsp + 0x60], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x60]
mov r8d, ebx
mov rdx, rsi
call sub.KERNEL32.dll_K32EnumProcessModules
cmp dword [rsp + 0x60], ebx
jbe 0x140047374
mov rcx, rsi
call fcn.1400b5f68
lea rcx, [0x1400471e0]
call fcn.1400ab40c
mov ecx, 0x20
call fcn.1400ab188
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14004735e
mov rcx, rax
call fcn.140047010
mov rdi, rax
mov qword [sym.pleskstartuphandler.exe_m_ExecuteContext_4D93FADE_7B9E_4286_AE07_54AF471F7E22], rdi
mov rax, rdi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ebx, edi
mov dword [rsp + 0x24], ebx
mov eax, dword [rsp + 0x60]
shr eax, 3
cmp ebx, eax
jae 0x1400473dd
mov ecx, ebx
lea rdx, [0x1403fabd0]
mov rcx, qword [rsi + rcx*8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400473d9
cmp qword [rax], 0
je 0x1400473d9
mov rcx, rsi
call fcn.1400b5f68
mov qword [rsp + 0x28], rdi
mov rax, qword [r14]
mov qword [sym.pleskstartuphandler.exe_m_ExecuteContext_4D93FADE_7B9E_4286_AE07_54AF471F7E22], rax
inc qword [rax + 0x18]
lea rcx, [0x1400471e0]
call fcn.1400ab40c
mov rax, qword [sym.pleskstartuphandler.exe_m_ExecuteContext_4D93FADE_7B9E_4286_AE07_54AF471F7E22]
jmp 0x140047470
inc ebx
jmp 0x140047376
jmp 0x1400473eb
test rsi, rsi
je 0x1400473f8
mov rcx, rsi
call fcn.1400b5f68
lea rcx, [0x1400471e0]
call fcn.1400ab40c
mov ecx, 0x20
call fcn.1400ab188
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140047463
mov qword [rsp + 0x70], rax
mov ecx, reloc.WS2_32.dll_getservbyport
call fcn.1400ab188
test rax, rax
je 0x140047439
mov rcx, rax
call fcn.14001a7e0
jmp 0x14004743c
mov rax, rdi
mov qword [rbx], rax
or r15d, 1
mov dword [rsp + 0x20], r15d
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 1
and r15d, 0xfffffffe
mov dword [rsp + 0x20], r15d
jmp 0x140047466
mov rbx, rdi
mov qword [sym.pleskstartuphandler.exe_m_ExecuteContext_4D93FADE_7B9E_4286_AE07_54AF471F7E22], rbx
mov rax, rbx
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret