Function at 0x140038a60
Capabilities:
Enumerate process modules

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10818]
mov eax, 0x10918
call fcn.140134690
sub rsp, rax
movzx r14d, r8b
mov rbx, rcx
xor edi, edi
mov dword [rbp + 0x10878], edi
mov r12b, 1
mov dword [rsp + 0x40], edi
lea r9, [rsp + 0x40]
mov r8d, 0x10000
lea rdx, [rbp + 0x810]
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x140039024
xor r15d, r15d
mov dword [rbp + 0x10878], r15d
test dword [rsp + 0x40], 0xfffffff8
jbe 0x140039024
lea r13, [rdi - 1]
mov r9d, 0x800
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + r15*8 + 0x810]
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x14003900a
call fcn.14000bfcc
test rax, rax
je 0x140039062
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rax, [rbp + 0x10]
cmp rax, 0x10000
jae 0x140038cde
lea rax, [rbp + 0x10]
movzx esi, ax
xor edx, edx
mov ecx, esi
call fcn.14000b98c
mov r14, rax
test rax, rax
je 0x140038c1e
mov edx, esi
shr rdx, 4
inc rdx
mov r8d, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140038c1e
mov r8d, esi
mov rdx, rax
mov rcx, r14
call fcn.14000ba40
mov r14, rax
test rax, rax
je 0x140038c1e
movzx r9d, word [rax]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
lea r8, [r14 + 2]
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
test eax, eax
js 0x14003906d
mov edx, 1
sub edx, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, esi
or ecx, edx
jge 0x140038bdf
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.140007db4
mov rbx, qword [rsp + 0x48]
movzx r9d, word [r14]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r8, [r14 + 2]
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, dword [rbx - 0xc]
jg 0x14003906d
mov dword [rbx - 0x10], esi
mov byte [rsi + rbx], 0
mov r15d, dword [rbp + 0x10878]
movzx r14d, byte [rbp + 0x10870]
movsxd rsi, dword [rbx - 0x10]
test esi, esi
js 0x140039057
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x140038c54
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.140007db4
mov rbx, qword [rsp + 0x48]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1401758d0
test eax, eax
je 0x140038c8a
cmp eax, 0xc
je 0x140039083
cmp eax, 0x16
je 0x140039057
cmp eax, 0x22
je 0x140039057
cmp eax, 0x50
jne 0x140039078
cmp esi, dword [rbx - 0xc]
jg 0x140039057
mov dword [rbx - 0x10], esi
mov byte [rsi + rbx], 0
test r14b, r14b
je 0x140038d09
mov edx, 0xe0
lea rcx, [rbp - 0x38]
call fcn.1400175a0
or edi, 1
cmp qword [rax + 0x18], 0x10
jb 0x140038cba
mov rax, qword [rax]
test rax, rax
je 0x140038d09
cmp dword [rbx - 0x10], 0
jl 0x140038d09
mov rdx, rax
mov rcx, rbx
call fcn.140175534
test rax, rax
je 0x140038d09
cmp eax, ebx
js 0x140038d09
mov sil, 1
jmp 0x140038d0c
lea rcx, [rbp + 0x10]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x140038ce5
mov r8d, eax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.140007ea0
mov rbx, qword [rsp + 0x48]
jmp 0x140038c26
xor sil, sil
test dil, 1
je 0x140038d50
and edi, 0xfffffffe
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140038d50
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038d4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003908e
call fcn.140133e68
xor r14d, r14d
movzx eax, r12b
test sil, sil
cmove r14d, eax
mov edx, 0xab
lea rcx, [rbp - 0x18]
call fcn.1400175a0
nop
or edi, 2
mov dword [rbp + 0x10878], edi
cmp qword [rax + 0x18], 0x10
jb 0x140038d80
mov rax, qword [rax]
test rax, rax
je 0x140038da3
cmp dword [rbx - 0x10], 0
jl 0x140038da3
mov rdx, rax
mov rcx, rbx
call fcn.140175534
test rax, rax
je 0x140038da3
cmp eax, ebx
jns 0x140038e24
mov edx, 0xac
lea rcx, [rbp - 0x58]
call fcn.1400175a0
nop
or edi, 4
mov dword [rbp + 0x10878], edi
cmp qword [rax + 0x18], 0x10
jb 0x140038dc5
mov rax, qword [rax]
test rax, rax
je 0x140038de4
cmp dword [rbx - 0x10], 0
jl 0x140038de4
mov rdx, rax
mov rcx, rbx
call fcn.140175534
test rax, rax
je 0x140038de4
cmp eax, ebx
jns 0x140038e24
mov edx, 0xad
lea rcx, [rbp - 0x78]
call fcn.1400175a0
or edi, 8
mov dword [rbp + 0x10878], edi
cmp qword [rax + 0x18], 0x10
jb 0x140038e05
mov rax, qword [rax]
test rax, rax
je 0x140038e29
cmp dword [rbx - 0x10], 0
jl 0x140038e29
mov rdx, rax
mov rcx, rbx
call fcn.140175534
test rax, rax
je 0x140038e29
cmp eax, ebx
js 0x140038e29
mov sil, 1
jmp 0x140038e2c
xor sil, sil
test dil, 8
je 0x140038e8a
and edi, 0xfffffff7
mov dword [rbp + 0x10878], edi
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140038e76
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038e71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039094
call fcn.140133e68
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], 0
test dil, 4
je 0x140038ee8
and edi, 0xfffffffb
mov dword [rbp + 0x10878], edi
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140038ed4
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038ecf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003909a
call fcn.140133e68
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
test dil, 2
je 0x140038f32
and edi, 0xfffffffd
mov dword [rbp + 0x10878], edi
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140038f32
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038f2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400390a0
call fcn.140133e68
xor r12d, r12d
movzx eax, r14b
test sil, sil
cmove r12d, eax
test r12b, r12b
je 0x14003903c
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], r14b
mov r8, r13
inc r8
cmp byte [rbx + r8], r14b
jne 0x140038f67
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1400157e0
nop
mov rsi, qword [rbp + 0x10868]
mov rdi, qword [rsi]
movabs rax, 0x555555555555555
cmp qword [rsi + 8], rax
je 0x1400390a6
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], r14
mov ecx, Ordinal_50
call fcn.140133e2c
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rax + 0x20], xmm1
inc qword [rsi + 8]
mov rcx, qword [rdi + 8]
mov qword [rax], rdi
mov qword [rax + 8], rcx
mov qword [rbp - 0x80], r14
mov qword [rdi + 8], rax
mov qword [rcx], rax
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140038ff5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
movzx r14d, byte [rbp + 0x10870]
mov rbx, qword [rbp + 0x10860]
mov edi, dword [rbp + 0x10878]
inc r15d
mov dword [rbp + 0x10878], r15d
mov eax, dword [rsp + 0x40]
shr eax, 3
cmp r15d, eax
jb 0x140038ae1
movzx eax, r12b
add rsp, 0x10918
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x140039024
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140039024
mov ecx, 0x80070057
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80070057
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
int3
mov ecx, 0x8007000e
call fcn.14000c3ac
int3
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
nop
lea rcx, str.list_too_long
call fcn.140101700
int3