Function at 0x140033990
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11f0]
mov eax, 0x12f0
call fcn.1400681e0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x1340], rbx
mov rax, qword [0x1400c7008]
xor rax, rsp
mov qword [rbp + 0x11e0], rax
mov r13, rdx
mov r14, rcx
mov qword [rsp + 0x70], rdx
xor r15d, r15d
mov dword [rsp + 0x24], r15d
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140023400
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r13
lea rcx, [rbp - 0x58]
call fcn.140023120
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x58]
call fcn.140066e60
nop
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.1400674f0
nop
cmp r13, rax
je 0x140033a44
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, r13
call fcn.140023120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x80]
call fcn.140023400
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140023400
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
lea r8, [rsp + 0x7c]
mov edx, 0x1000
lea rcx, [rbp - 0x30]
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x140033a96
mov qword [r14], r15
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], r15
jmp 0x140033c0f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov dword [rsp + 0x20], eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xfd0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x78], 0x103
mov r12d, dword [rsp + 0x7c]
shr r12d, 2
mov esi, r15d
test r12d, r12d
je 0x140033bf8
mov rdi, r15
nop word [rax + rax]
mov r8d, dword [rbp + rdi*4 - 0x30]
cmp r8d, ebx
je 0x140033bd2
mov word [rbp + 0xfd0], r15w
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140033b72
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140033b27
mov dword [rsp + 0x78], 0x103
jmp 0x140033b31
cmp dword [rsp + 0x78], 0x103
jne 0x140033b68
lea r9, [rbp - 0x60]
mov r8d, 8
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x140033b68
mov r9d, 0x104
lea r8, [rbp + 0xfd0]
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.WS2_32.dll_htonl]
nop
lea r8, [rsp + 0x28]
lea rdx, [rbp + 0xfd0]
mov rcx, r13
call fcn.14003d3e0
movzx r15d, al
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + select]
test rax, rax
je 0x140033bc6
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
test r15b, r15b
jne 0x140033be1
mov ebx, dword [rsp + 0x20]
xor r15d, r15d
inc esi
inc rdi
cmp esi, r12d
jae 0x140033bf8
jmp 0x140033ae0
mov eax, dword [rbp + rdi*4 - 0x30]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call fcn.14003a330
mov rax, qword [rbp - 0x80]
mov qword [r14], rax
mov rax, qword [rbp - 0x78]
mov qword [r14 + 8], rax
mov rax, qword [rbp - 0x70]
mov qword [r14 + 0x10], rax
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x58]
call fcn.140023400
nop
xor r8d, r8d
mov dl, 1
mov rcx, r13
call fcn.140023400
mov rax, r14
mov rcx, qword [rbp + 0x11e0]
xor rcx, rsp
call fcn.140062f80
mov rbx, qword [rsp + 0x1340]
add rsp, 0x12f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret