Function at 0x1401323c0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x318
movaps xmmword [rsp + 0x300], xmm6
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14013283a
mov r13, rax
cmp r14, 0x21
mov ebx, 0x20
cmovae rbx, r14
movaps xmm6, xmmword [section..rdata]
movaps xmmword [rsp + 0x280], xmm6
movaps xmmword [rsp + 0x270], xmm6
lea rcx, [rsp + 0x270]
xor edx, edx
mov r8, rbx
call fcn.140146ec0
mov dword [rsp + 0x5c], 0
lea r9, [rsp + 0x5c]
mov rcx, r13
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140132714
mov edx, dword [rsp + 0x5c]
test rdx, rdx
je 0x140132714
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x140132714
mov r14, rax
mov edi, dword [rsp + 0x5c]
lea r9, [rsp + 0x5c]
mov rcx, r13
mov rdx, rax
mov r8d, edi
call sub.KERNEL32.dll_K32EnumProcessModules
mov qword [rsp + 0x28], rdi
cmp rdi, 8
jb 0x14013270b
test eax, eax
je 0x14013270b
mov rax, qword [rsp + 0x28]
shr eax, 3
mov qword [rsp + 0x28], rax
xor edi, edi
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
jmp 0x1401324f8
mov r13, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
inc rdi
cmp rdi, qword [rsp + 0x28]
je 0x14013270b
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmmword [rsp + 0x40], xmm6
mov rdx, qword [r14 + rdi*8]
mov rcx, r13
lea r8, [rsp + 0x40]
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x1401324ea
mov r8d, 0x105
lea rcx, [rsp + 0x160]
mov dl, 0xaa
call fcn.140146ec0
mov r14d, 1
xor ebp, ebp
xor r15d, r15d
jmp 0x1401326b4
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x2a0], xmm6
movaps xmmword [rsp + 0x290], xmm6
movaps xmmword [rsp + 0x2b0], xmm6
movaps xmmword [rsp + 0x2c0], xmm6
movaps xmmword [rsp + 0x2d0], xmm6
movaps xmmword [rsp + 0x2e0], xmm6
mov dword [rsp + 0x2a0], 1
mov qword [rsp + 0x290], rbp
mov byte [rsp + 0x298], 4
mov dword [rsp + 0x2b8], 1
mov qword [rsp + 0x2a8], r13
sub r13, r12
mov byte [rsp + 0x2b0], 8
lea rax, [rsp + 0x160]
mov qword [rsp + 0x2c0], rax
mov dword [rsp + 0x2d0], 2
mov dword [rsp + 0x2e8], 1
mov qword [rsp + 0x2d8], r13
mov byte [rsp + 0x2e0], 8
mov qword [rsp + 0x20], 4
mov edx, 0x100
lea r12, [rsp + 0x60]
mov rcx, r12
lea r8, str._d_0x_x___s0x_x__n
lea r9, [rsp + 0x290]
call fcn.140132870
xor ecx, ecx
mov rdx, r12
call fcn.140111b00
mov byte [rsp + rbp + 0x270], 1
mov ebp, r14d
inc r14d
cmp rbx, rbp
jbe 0x1401324e0
mov r12, qword [rsp + 0x40]
mov r13, qword [rsi + rbp*8]
cmp r12, r13
ja 0x1401326a5
mov eax, dword [rsp + 0x48]
add rax, r12
cmp rax, r13
jbe 0x1401326a5
test r15b, 1
jne 0x140132550
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + rdi*8]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x160]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleFileNameExA
mov eax, eax
mov byte [rsp + rax + 0x160], 0
mov r15b, 1
jmp 0x140132550
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
lea r14, str._d_0x_x__unknown__n
lea r15, [rsp + 0x160]
lea r12, [rsp + 0x60]
jmp 0x14013273c
inc rdi
cmp rbx, rdi
je 0x140132831
cmp byte [rsp + rdi + 0x270], 0
jne 0x140132730
movaps xmmword [rsp + 0x250], xmm6
movaps xmmword [rsp + 0x240], xmm6
movaps xmmword [rsp + 0x230], xmm6
movaps xmmword [rsp + 0x220], xmm6
movaps xmmword [rsp + 0x210], xmm6
movaps xmmword [rsp + 0x200], xmm6
movaps xmmword [rsp + 0x1f0], xmm6
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm6
movaps xmmword [rsp + 0x1c0], xmm6
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1a0], xmm6
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x160], xmm6
mov rax, qword [rsi + rdi*8]
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x68], 8
mov dword [rsp + 0x88], 1
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x80], 8
mov qword [rsp + 0x20], 2
mov edx, 0x100
mov rcx, r15
mov r8, r14
mov r9, r12
call fcn.140132870
xor ecx, ecx
mov rdx, r15
call fcn.140111b00
jmp 0x140132730
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.140143c30
movaps xmm6, xmmword [rsp + 0x300]
add rsp, 0x318
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret