Function at 0x1400206c0
Capabilities:
Enumerate process modules

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x107e8]
mov eax, 0x108e8
call fcn.14007c160
sub rsp, rax
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov rbx, rcx
xor esi, esi
mov dword [rbp + 0x10848], esi
mov r12b, 1
mov dword [rsp + 0x24], esi
lea r9, [rsp + 0x24]
mov r8d, 0x10000
lea rdx, [rbp + 0x7e0]
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x140020d68
xor r15d, r15d
mov dword [rsp + 0x20], r15d
test dword [rsp + 0x24], 0xfffffff8
jbe 0x140020d68
or r13, 0xffffffffffffffff
mov r9d, 0x800
lea r8, [rbp - 0x20]
mov rdx, qword [rbp + r15*8 + 0x7e0]
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x140020c7c
call fcn.14000bcc0
test rax, rax
je 0x140020d5d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp - 0x20]
lea rax, [rbp - 0x20]
test rax, 0xffffffffffff0000
jne 0x1400207bf
movzx ebx, cx
xor edx, edx
mov ecx, ebx
call fcn.14000b6e0
test rax, rax
je 0x1400208a6
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000bdc0
jmp 0x1400208a6
lea rax, [rbp - 0x20]
mov rdi, r13
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400207c6
test edi, edi
jne 0x140020833
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400208a6
cmp dword [rdx + 0x10], 0
jge 0x140020803
cmp dword [rbx - 0xc], 0
jl 0x140020c99
mov dword [rbx - 0x10], 0
mov byte [rbx], 0
jmp 0x1400208a6
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020819
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov esi, dword [rbp + 0x10848]
jmp 0x1400208a6
mov r15d, dword [rbx - 0x10]
lea r14, [rbp - 0x20]
sub r14, rbx
test edi, edi
js 0x140020d52
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140020868
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.14000bfd0
mov rbx, qword [rsp + 0x28]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
cmp r14, r15
ja 0x140020882
lea r8, [r14 + rbx]
mov r9d, edi
call fcn.14000b8d0
jmp 0x14002088e
movsxd r9, edi
lea r8, [rbp - 0x20]
call fcn.1400241b0
cmp edi, dword [rbx - 0xc]
jg 0x140020d47
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov byte [rax + rbx], 0
mov r15d, dword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140022f00
mov rbx, qword [rsp + 0x28]
cmp byte [rbp + 0x10840], 0
je 0x1400208fd
mov edx, 0xe7
lea rcx, [rbp - 0x68]
call fcn.140024260
or esi, 1
cmp qword [rax + 0x18], 0x10
jb 0x1400208d9
mov rax, qword [rax]
test rax, rax
je 0x1400208fd
cmp dword [rbx - 0x10], 0
jl 0x1400208fd
mov rdx, rax
mov rcx, rbx
call fcn.1400e6efc
test rax, rax
je 0x1400208fd
cmp eax, ebx
js 0x1400208fd
mov dil, 1
jmp 0x140020900
xor dil, dil
test sil, 1
je 0x140020957
and esi, 0xfffffffe
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x140020957
inc rax
mov rcx, qword [rbp - 0x68]
cmp rax, 0x1000
jb 0x140020952
test cl, 0x1f
jne 0x140020cb6
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140020cb0
sub rcx, rax
cmp rcx, 8
jb 0x140020caa
cmp rcx, 0x27
ja 0x140020ca4
mov rcx, rax
call fcn.14007b800
xor r14d, r14d
movzx eax, r12b
test dil, dil
cmove r14d, eax
mov edx, 0xb3
lea rcx, [rbp - 0x48]
call fcn.140024260
nop
or esi, 2
mov dword [rbp + 0x10848], esi
cmp qword [rax + 0x18], 0x10
jb 0x140020987
mov rax, qword [rax]
test rax, rax
je 0x1400209aa
cmp dword [rbx - 0x10], 0
jl 0x1400209aa
mov rdx, rax
mov rcx, rbx
call fcn.1400e6efc
test rax, rax
je 0x1400209aa
cmp eax, ebx
jns 0x140020a27
mov edx, VariantTimeToSystemTime
lea rcx, [rsp + 0x70]
call fcn.140024260
nop
or esi, 4
mov dword [rbp + 0x10848], esi
cmp qword [rax + 0x18], 0x10
jb 0x1400209cd
mov rax, qword [rax]
test rax, rax
je 0x1400209ec
cmp dword [rbx - 0x10], 0
jl 0x1400209ec
mov rdx, rax
mov rcx, rbx
call fcn.1400e6efc
test rax, rax
je 0x1400209ec
cmp eax, ebx
jns 0x140020a27
mov edx, VariantTimeToSystemTime
lea rcx, [rsp + 0x50]
call fcn.140024260
or esi, 8
cmp qword [rax + 0x18], 0x10
jb 0x140020a08
mov rax, qword [rax]
test rax, rax
je 0x140020a2c
cmp dword [rbx - 0x10], 0
jl 0x140020a2c
mov rdx, rax
mov rcx, rbx
call fcn.1400e6efc
test rax, rax
je 0x140020a2c
cmp eax, ebx
js 0x140020a2c
mov dil, 1
jmp 0x140020a2f
xor dil, dil
test sil, 8
je 0x140020a9f
and esi, 0xfffffff7
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x140020a88
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x140020a83
test cl, 0x1f
jne 0x140020cce
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140020cc8
sub rcx, rax
cmp rcx, 8
jb 0x140020cc2
cmp rcx, 0x27
ja 0x140020cbc
mov rcx, rax
call fcn.14007b800
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], 0
mov byte [rsp + 0x50], 0
test sil, 4
je 0x140020b0c
and esi, 0xfffffffb
mov rax, qword [rbp - 0x78]
cmp rax, 0x10
jb 0x140020af7
inc rax
mov rcx, qword [rsp + 0x70]
cmp rax, 0x1000
jb 0x140020af2
test cl, 0x1f
jne 0x140020ce6
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140020ce0
sub rcx, rax
cmp rcx, 8
jb 0x140020cda
cmp rcx, 0x27
ja 0x140020cd4
mov rcx, rax
call fcn.14007b800
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x80], 0
mov byte [rsp + 0x70], 0
and esi, 0xfffffffd
mov dword [rbp + 0x10848], esi
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x140020b63
inc rax
mov rcx, qword [rbp - 0x48]
cmp rax, 0x1000
jb 0x140020b5e
test cl, 0x1f
jne 0x140020cfe
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140020cf8
sub rcx, rax
cmp rcx, 8
jb 0x140020cf2
cmp rcx, 0x27
ja 0x140020cec
mov rcx, rax
call fcn.14007b800
xor r12d, r12d
movzx eax, r14b
test dil, dil
cmove r12d, eax
test r12b, r12b
je 0x140020d29
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
cmp byte [rbx], 0
jne 0x140020b9b
xor r8d, r8d
jmp 0x140020baa
mov r8, r13
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x140020ba0
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400080d0
nop
mov r14, qword [rbp + 0x10838]
mov rdi, qword [r14]
lea r9, [rsp + 0x30]
mov r8, qword [rdi + 8]
mov rdx, rdi
mov rcx, r14
call fcn.14000b0e0
mov rdx, qword [r14 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x140020d1c
lea rcx, [rdx + 1]
mov qword [r14 + 8], rcx
mov qword [rdi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x140020c55
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x140020c4f
test cl, 0x1f
jne 0x140020d16
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140020d10
sub rcx, rax
cmp rcx, 8
jb 0x140020d0a
cmp rcx, 0x27
ja 0x140020d04
mov rcx, rax
call fcn.14007b800
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020c6f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rbp + 0x10830]
mov esi, dword [rbp + 0x10848]
inc r15d
mov dword [rsp + 0x20], r15d
mov eax, dword [rsp + 0x24]
shr eax, 3
cmp r15d, eax
jae 0x140020d68
jmp 0x140020743
mov ecx, 0x80070057
call fcn.14000b790
nop
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
nop
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
nop
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
nop
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
nop
lea rcx, str.list_T__too_long
call fcn.14007e074
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x140020d42
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor r12b, r12b
jmp 0x140020d68
mov ecx, 0x80070057
call fcn.14000b790
int3
mov ecx, 0x80070057
call fcn.14000b790
nop
mov ecx, 0x80004005
call fcn.14000b790
int3
movzx eax, r12b
add rsp, 0x108e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret