Function at 0x14006f5b0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10740]
mov eax, 0x10840
call fcn.140134690
sub rsp, rax
mov rsi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
test rax, rax
je 0x14006f941
xor r14d, r14d
mov dword [rbp + 0x10790], r14d
lea r9, [rbp + 0x10790]
mov r8d, 0x10000
lea rdx, [rbp + 0x740]
mov rcx, r13
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14006f936
mov r12d, r14d
test dword [rbp + 0x10790], 0xfffffff8
jbe 0x14006f936
nop word [rax + rax]
mov edx, r12d
mov r9d, 0x800
lea r8, [rsp + 0x40]
mov rdx, qword [rbp + rdx*8 + 0x740]
mov rcx, r13
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x14006f900
call fcn.14000bfcc
test rax, rax
je 0x14006f967
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rbp + 0x10798], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10798]
call fcn.140006ea0
test al, al
jne 0x14006f7df
lea rax, [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14006f6b0
mov rbx, qword [rbp + 0x10798]
test edi, edi
jne 0x14006f722
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14006f7e6
cmp dword [rdx + 0x10], 0
jge 0x14006f6f1
cmp dword [rbx - 0xc], 0
jl 0x14006f972
mov dword [rbx - 0x10], r14d
mov byte [rbx], 0
jmp 0x14006f7e6
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f709
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x10798], rbx
jmp 0x14006f7e6
mov r15d, dword [rbx - 0x10]
lea rsi, [rsp + 0x40]
sub rsi, rbx
test edi, edi
js 0x14006f972
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14006f75c
mov edx, edi
lea rcx, [rbp + 0x10798]
call fcn.140007db4
mov rbx, qword [rbp + 0x10798]
movsxd r14, edi
cmp rsi, r15
ja 0x14006f790
lea rdx, [rsi + rbx]
test rdx, rdx
jne 0x14006f77a
call fcn.140146434
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x14006f7bd
movsxd rax, dword [rbx - 0xc]
cmp rax, r14
jb 0x14006f7b2
mov r8, r14
mov rcx, rbx
call fcn.1401378a0
jmp 0x14006f7c2
movsxd r8, dword [rbx - 0xc]
mov rcx, rbx
cmp r8, r14
jb 0x14006f7ab
mov r8, r14
lea rdx, [rsp + 0x40]
call fcn.1401378a0
jmp 0x14006f7c2
xor edx, edx
call fcn.140137f50
call fcn.140146434
mov dword [rax], Ordinal_35
call fcn.140146288
cmp edi, dword [rbx - 0xc]
jg 0x14006f972
mov dword [rbx - 0x10], edi
mov byte [r14 + rbx], 0
mov rsi, qword [rbp + 0x10788]
xor r14d, r14d
jmp 0x14006f7e6
mov rbx, qword [rbp + 0x10798]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14006f95c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or ecx, eax
jge 0x14006f818
mov edx, edi
lea rcx, [rbp + 0x10798]
call fcn.140007db4
mov rbx, qword [rbp + 0x10798]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1401758d0
test eax, eax
je 0x14006f84e
cmp eax, 0xc
je 0x14006f988
cmp eax, 0x16
je 0x14006f95c
cmp eax, 0x22
je 0x14006f95c
cmp eax, 0x50
jne 0x14006f97d
cmp edi, dword [rbx - 0xc]
jg 0x14006f95c
mov dword [rbx - 0x10], edi
mov byte [rdi + rbx], 0
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x14006f880
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400157e0
nop
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400056d4
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14006f8e4
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f8de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f993
call fcn.140133e68
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f900
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, 0xcccccccd
mul r12d
shr edx, 4
lea ecx, [rdx + rdx*4]
shl ecx, 2
cmp r12d, ecx
jne 0x14006f921
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r12d
mov eax, dword [rbp + 0x10790]
shr eax, 3
cmp r12d, eax
jb 0x14006f640
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rbx, qword [rsp + 0x10880]
add rsp, 0x10840
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80070057
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
int3
mov ecx, 0x8007000e
call fcn.14000c3ac
int3
call fcn.1401462a8
int3