Function at 0x14006dbb0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x320], rbx
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov ebx, edx
mov rsi, rcx
mov qword [rbp - 0x70], rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
call fcn.14006f000
mov qword [rsi], rax
mov dword [rsp + 0x30], 1
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14005f270
nop
xor eax, eax
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x48]
call fcn.14006f180
nop
mov dword [rbp - 0x50], r15d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14006dc5d
mov ecx, r15d
jmp 0x14006dc60
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x50]
mov r8d, 0x8000
mov rdx, qword [rbp - 0x48]
call qword [sym.imp.PSAPI.DLL_EnumProcessModulesEx]
mov r14d, dword [rbp - 0x50]
shr r14, 3
mov ebx, r15d
or rdi, 0xffffffffffffffff
test r14, r14
je 0x14006dde6
mov rcx, r15
nop word [rax + rax]
mov rax, qword [rbp - 0x48]
lea rdx, [rax + rcx*8]
mov rax, qword [rsp + 0x40]
test rax, rax
mov rcx, r15
je 0x14006dcb8
mov rcx, qword [rax]
mov r9d, 0x104
lea r8, [rbp - 0x40]
mov rdx, qword [rdx]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x14006ddd9
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov cl, 1
call fcn.1400cc1e4
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp word [rbp - 0x40], 0
jne 0x14006dd1d
mov r8, r15
jmp 0x14006dd2f
lea rax, [rbp - 0x40]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x14006dd24
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x50]
call fcn.14003ca90
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.1400451c0
mov r9, rax
movzx eax, byte [0x140170c0e]
mov byte [rsp + 0x20], al
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14006f250
nop
cmp qword [rbp - 0x78], 8
jb 0x14006dd7e
mov rcx, qword [rsp + 0x70]
call fcn.1400ed78c
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r15
mov word [rsp + 0x70], r15w
cmp qword [rsp + 0x68], 8
jb 0x14006dda2
mov rcx, qword [rsp + 0x50]
call fcn.1400ed78c
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14006ddd9
mov rax, qword [rcx]
call qword [rax + select]
test rax, rax
je 0x14006ddd9
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
inc ebx
mov ecx, ebx
cmp rcx, r14
jb 0x14006dca0
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14006ddf5
call fcn.1400eda80
nop
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14006de1c
lock dec dword [rbx + 8]
jne 0x14006de1c
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x14006de1c
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + ioctlsocket]
mov rax, rsi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400efba0
mov rbx, qword [rsp + 0x320]
add rsp, 0x2e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret