Function at 0x140031220
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2bc0]
mov eax, 0x2cc0
call fcn.1400ec150
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2d00], rbx
mov rbx, rdx
mov r12, rcx
mov dword [r9], 0
mov dword [rsp + 0x70], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140031592
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x140031589
lea rdx, [rsp + 0x70]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140031589
nop dword [rax + rax]
mov rdi, qword [rbx]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140031555
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x1400312de
mov rdx, qword [rdx]
lea rcx, [rbp - 0x64]
call fcn.140159ed0
test eax, eax
je 0x1400312f8
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400312d0
jmp 0x140031555
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140031555
mov dword [rsp + 0x40], 0x400
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x3c0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x14003154c
lea r9, [rsp + 0x44]
mov r8d, 0x2000
lea rdx, [rbp + 0xbc0]
mov rcx, r15
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14003154c
xor esi, esi
mov r14d, dword [rsp + 0x44]
shr r14, 3
test r14, r14
je 0x14003148f
mov r9d, 0x104
lea r8, [rbp + 0x1b0]
mov rdx, qword [rbp + rsi*8 + 0xbc0]
mov rcx, r15
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x140031456
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, rax
call fcn.14000b6b4
test rax, rax
je 0x14003157e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
test rdi, rdi
je 0x14003140c
test rdi, 0xffffffffffff0000
jne 0x1400313f9
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.14000b0cc
test rax, rax
je 0x140031423
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140008224
jmp 0x14003141e
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140031400
jmp 0x14003140e
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140007d30
mov rbx, qword [rsp + 0x38]
mov rdx, qword [r12]
test rdx, rdx
je 0x140031573
mov rcx, rbx
call fcn.140159ed0
test eax, eax
je 0x140031463
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140031456
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc rsi
cmp rsi, r14
jge 0x14003148f
jmp 0x140031373
mov rsi, qword [rbp + 0x2c18]
inc dword [rsi]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003154c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x14003154c
mov rsi, qword [rbp + 0x2c10]
mov rax, qword [rsi]
mov rcx, qword [rax + 8]
mov rbx, rax
mov edx, dword [rsp + 0x78]
cmp byte [rcx + 0x19], 0
jne 0x1400314c7
nop word [rax + rax]
cmp dword [rcx + 0x20], edx
jae 0x1400314bb
mov rcx, qword [rcx + 0x10]
jmp 0x1400314c1
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1400314b0
mov qword [rsp + 0x60], rax
cmp rbx, rax
je 0x1400314d6
cmp edx, dword [rbx + 0x20]
jae 0x140031517
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [0x140248798]
mov rcx, rsi
call fcn.140033790
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400345f0
mov rbx, qword [rsp + 0x50]
cmp word [rbp + 0x3c0], 0
jne 0x140031526
xor r8d, r8d
jmp 0x14003153c
lea rax, [rbp + 0x3c0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140031531
lea rcx, [rbx + 0x28]
lea rdx, [rbp + 0x3c0]
call fcn.14000b804
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140031589
mov rbx, qword [rbp + 0x2c08]
jmp 0x1400312c0
mov ecx, 0x80004005
call fcn.14000b9ec
nop
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x2d00]
add rsp, 0x2cc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret