Function at 0x180027cd0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x4f0], rbx
mov rax, qword [0x18007f130]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
xor r12d, r12d
call fcn.180027bd0
mov edi, eax
mov dword [rsp + 0x50], r12d
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x54]
call fcn.180035fe0
mov edx, edi
lea ecx, [r12 + 0x18]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp r15, 0xffffffffffffffff
je 0x180028161
test r15, r15
je 0x180028161
mov dword [rsp + 0x50], 0x438
lea rdx, [rsp + 0x50]
mov rcx, r15
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x180028158
or r14, 0xffffffffffffffff
nop word [rax + rax]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x28], rsi
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0x280]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x180027e2f
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x180027ec2
cmp dword [rdx + 0x10], eax
jge 0x180027dfc
cmp dword [rbx - 0xc], eax
jl 0x1800280bc
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x180027ec2
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180027e13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov rsi, qword [rsp + 0x28]
jmp 0x180027ec2
mov r13d, dword [rbx - 0x10]
lea rbp, [rsp + 0x280]
sub rbp, rbx
sar rbp, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180027e63
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.1800027f0
mov rbx, qword [rsp + 0x20]
cmp rbp, r13
ja 0x180027e87
movsxd rax, edi
lea r13, [rax + rax]
lea r8, [rbx + rbp*2]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r13
mov rcx, rbx
call fcn.18003462c
jmp 0x180027ea8
movsxd rax, edi
lea r13, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r13
lea r8, [rsp + 0x280]
mov rcx, rbx
call fcn.180034594
test edi, edi
js 0x18002814d
cmp edi, dword [rbx - 0xc]
jg 0x18002814d
mov dword [rbx - 0x10], edi
mov word [r13 + rbx], r12w
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x180027f3d
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x180027fd0
cmp dword [rdx + 0x10], eax
jge 0x180027f0a
cmp dword [rsi - 0xc], eax
jl 0x1800280c7
mov dword [rsi - 0x10], r12d
mov word [rsi], r12w
jmp 0x180027fd0
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180027f21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x20]
jmp 0x180027fd0
mov r13d, dword [rsi - 0x10]
lea rbp, [rsp + 0x80]
sub rbp, rsi
sar rbp, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x180027f71
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.1800027f0
mov rsi, qword [rsp + 0x28]
cmp rbp, r13
ja 0x180027f95
movsxd rax, edi
lea r13, [rax + rax]
lea r8, [rsi + rbp*2]
movsxd rdx, dword [rsi - 0xc]
add rdx, rdx
mov r9, r13
mov rcx, rsi
call fcn.18003462c
jmp 0x180027fb6
movsxd rax, edi
lea r13, [rax + rax]
movsxd rdx, dword [rsi - 0xc]
add rdx, rdx
mov r9, r13
lea r8, [rsp + 0x80]
mov rcx, rsi
call fcn.180034594
test edi, edi
js 0x180028142
cmp edi, dword [rsi - 0xc]
jg 0x180028142
mov dword [rsi - 0x10], edi
mov word [r13 + rsi], r12w
movsxd rdi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180027ff6
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.1800027f0
mov rbx, qword [rsp + 0x20]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.18003724c
test edi, edi
js 0x180028137
cmp edi, dword [rbx - 0xc]
jg 0x180028137
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r12w
cmp dword [rbx - 0x10], 0
jl 0x180028066
lea rdx, str.syswow64
mov rcx, rbx
call fcn.18003452c
test rax, rax
je 0x180028066
sub rax, rbx
sar rax, 1
test eax, eax
jle 0x180028066
mov eax, r12d
mov rbp, qword [rsp + 0x30]
test rbp, rbp
setne al
test eax, eax
je 0x18002812c
mov rdx, rbp
mov rcx, rsi
call fcn.180034498
test eax, eax
je 0x1800280d2
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180028082
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800280a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rsp + 0x50]
mov rcx, r15
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x180028158
jmp 0x180027d80
mov ecx, 0x80070057
call fcn.180002d30
int3
mov ecx, 0x80070057
call fcn.180002d30
int3
mov r12d, 1
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r8d, 0x438
call fcn.18003b330
nop
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18002810a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x180028158
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x180028158
mov ecx, 0x80004005
call fcn.180002d30
int3
mov ecx, 0x80070057
call fcn.180002d30
int3
mov ecx, 0x80070057
call fcn.180002d30
int3
mov ecx, 0x80070057
call fcn.180002d30
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1800340f0
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret