Function at 0x140032b40
Capabilities:
Enumerate process modules

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x107e8]
mov eax, 0x108e8
call fcn.1400ec150
sub rsp, rax
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov rbx, rcx
xor esi, esi
mov dword [rbp + 0x10848], esi
mov r12b, 1
mov dword [rsp + 0x24], esi
lea r9, [rsp + 0x24]
mov r8d, 0x10000
lea rdx, [rbp + 0x7e0]
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1400331e8
xor r15d, r15d
mov dword [rsp + 0x20], r15d
test dword [rsp + 0x24], 0xfffffff8
jbe 0x1400331e8
or r13, 0xffffffffffffffff
mov r9d, 0x800
lea r8, [rbp - 0x20]
mov rdx, qword [rbp + r15*8 + 0x7e0]
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x1400330fc
call fcn.14000b6b4
test rax, rax
je 0x1400331dd
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp - 0x20]
lea rax, [rbp - 0x20]
test rax, 0xffffffffffff0000
jne 0x140032c3f
movzx ebx, cx
xor edx, edx
mov ecx, ebx
call fcn.14000b0cc
test rax, rax
je 0x140032d26
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400080f4
jmp 0x140032d26
lea rax, [rbp - 0x20]
mov rdi, r13
inc rdi
cmp byte [rax + rdi], 0
jne 0x140032c46
test edi, edi
jne 0x140032cb3
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140032d26
cmp dword [rdx + 0x10], 0
jge 0x140032c83
cmp dword [rbx - 0xc], 0
jl 0x140033119
mov dword [rbx - 0x10], 0
mov byte [rbx], 0
jmp 0x140032d26
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140032c99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov esi, dword [rbp + 0x10848]
jmp 0x140032d26
mov r15d, dword [rbx - 0x10]
lea r14, [rbp - 0x20]
sub r14, rbx
test edi, edi
js 0x1400331d2
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140032ce8
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.14000799c
mov rbx, qword [rsp + 0x28]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
cmp r14, r15
ja 0x140032d02
lea r8, [r14 + rbx]
mov r9d, edi
call fcn.140008348
jmp 0x140032d0e
movsxd r9, edi
lea r8, [rbp - 0x20]
call fcn.140035e00
cmp edi, dword [rbx - 0xc]
jg 0x1400331c7
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov byte [rax + rbx], 0
mov r15d, dword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140005ce4
mov rbx, qword [rsp + 0x28]
cmp byte [rbp + 0x10840], 0
je 0x140032d7d
mov edx, 0xed
lea rcx, [rbp - 0x68]
call fcn.1400160a0
or esi, 1
cmp qword [rax + 0x18], 0x10
jb 0x140032d59
mov rax, qword [rax]
test rax, rax
je 0x140032d7d
cmp dword [rbx - 0x10], 0
jl 0x140032d7d
mov rdx, rax
mov rcx, rbx
call fcn.1401582e4
test rax, rax
je 0x140032d7d
cmp eax, ebx
js 0x140032d7d
mov dil, 1
jmp 0x140032d80
xor dil, dil
test sil, 1
je 0x140032dd7
and esi, 0xfffffffe
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x140032dd7
inc rax
mov rcx, qword [rbp - 0x68]
cmp rax, 0x1000
jb 0x140032dd2
test cl, 0x1f
jne 0x140033136
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140033130
sub rcx, rax
cmp rcx, 8
jb 0x14003312a
cmp rcx, 0x27
ja 0x140033124
mov rcx, rax
call fcn.1400eb7f4
xor r14d, r14d
movzx eax, r12b
test dil, dil
cmove r14d, eax
mov edx, reloc.OLEAUT32.dll_VariantTimeToSystemTime
lea rcx, [rbp - 0x48]
call fcn.1400160a0
nop
or esi, 2
mov dword [rbp + 0x10848], esi
cmp qword [rax + 0x18], 0x10
jb 0x140032e07
mov rax, qword [rax]
test rax, rax
je 0x140032e2a
cmp dword [rbx - 0x10], 0
jl 0x140032e2a
mov rdx, rax
mov rcx, rbx
call fcn.1401582e4
test rax, rax
je 0x140032e2a
cmp eax, ebx
jns 0x140032ea7
mov edx, VarDecFromUI1
lea rcx, [rsp + 0x70]
call fcn.1400160a0
nop
or esi, 4
mov dword [rbp + 0x10848], esi
cmp qword [rax + 0x18], 0x10
jb 0x140032e4d
mov rax, qword [rax]
test rax, rax
je 0x140032e6c
cmp dword [rbx - 0x10], 0
jl 0x140032e6c
mov rdx, rax
mov rcx, rbx
call fcn.1401582e4
test rax, rax
je 0x140032e6c
cmp eax, ebx
jns 0x140032ea7
mov edx, VarDecFromUI1
lea rcx, [rsp + 0x50]
call fcn.1400160a0
or esi, 8
cmp qword [rax + 0x18], 0x10
jb 0x140032e88
mov rax, qword [rax]
test rax, rax
je 0x140032eac
cmp dword [rbx - 0x10], 0
jl 0x140032eac
mov rdx, rax
mov rcx, rbx
call fcn.1401582e4
test rax, rax
je 0x140032eac
cmp eax, ebx
js 0x140032eac
mov dil, 1
jmp 0x140032eaf
xor dil, dil
test sil, 8
je 0x140032f1f
and esi, 0xfffffff7
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x140032f08
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x140032f03
test cl, 0x1f
jne 0x14003314e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140033148
sub rcx, rax
cmp rcx, 8
jb 0x140033142
cmp rcx, 0x27
ja 0x14003313c
mov rcx, rax
call fcn.1400eb7f4
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], 0
mov byte [rsp + 0x50], 0
test sil, 4
je 0x140032f8c
and esi, 0xfffffffb
mov rax, qword [rbp - 0x78]
cmp rax, 0x10
jb 0x140032f77
inc rax
mov rcx, qword [rsp + 0x70]
cmp rax, 0x1000
jb 0x140032f72
test cl, 0x1f
jne 0x140033166
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140033160
sub rcx, rax
cmp rcx, 8
jb 0x14003315a
cmp rcx, 0x27
ja 0x140033154
mov rcx, rax
call fcn.1400eb7f4
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x80], 0
mov byte [rsp + 0x70], 0
and esi, 0xfffffffd
mov dword [rbp + 0x10848], esi
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x140032fe3
inc rax
mov rcx, qword [rbp - 0x48]
cmp rax, 0x1000
jb 0x140032fde
test cl, 0x1f
jne 0x14003317e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140033178
sub rcx, rax
cmp rcx, 8
jb 0x140033172
cmp rcx, 0x27
ja 0x14003316c
mov rcx, rax
call fcn.1400eb7f4
xor r12d, r12d
movzx eax, r14b
test dil, dil
cmove r12d, eax
test r12b, r12b
je 0x1400331a9
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
cmp byte [rbx], 0
jne 0x14003301b
xor r8d, r8d
jmp 0x14003302a
mov r8, r13
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x140033020
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000d058
nop
mov r14, qword [rbp + 0x10838]
mov rdi, qword [r14]
lea r9, [rsp + 0x30]
mov r8, qword [rdi + 8]
mov rdx, rdi
mov rcx, r14
call fcn.140009d2c
mov rdx, qword [r14 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x14003319c
lea rcx, [rdx + 1]
mov qword [r14 + 8], rcx
mov qword [rdi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x1400330d5
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x1400330cf
test cl, 0x1f
jne 0x140033196
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140033190
sub rcx, rax
cmp rcx, 8
jb 0x14003318a
cmp rcx, 0x27
ja 0x140033184
mov rcx, rax
call fcn.1400eb7f4
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400330ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rbp + 0x10830]
mov esi, dword [rbp + 0x10848]
inc r15d
mov dword [rsp + 0x20], r15d
mov eax, dword [rsp + 0x24]
shr eax, 3
cmp r15d, eax
jae 0x1400331e8
jmp 0x140032bc3
mov ecx, 0x80070057
call fcn.14000b9ec
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
lea rcx, str.list_T__too_long
call fcn.1400bc800
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x1400331c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor r12b, r12b
jmp 0x1400331e8
mov ecx, 0x80070057
call fcn.14000b9ec
int3
mov ecx, 0x80070057
call fcn.14000b9ec
nop
mov ecx, 0x80004005
call fcn.14000b9ec
int3
movzx eax, r12b
add rsp, 0x108e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret