Function at 0x1400b4500
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x1401db200]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x434
call fcn.1401600b0
mov edx, dword [rbx + 0x98]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b471b
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400b461d
mov qword [rsp + 0x4c8], rdi
lea rdi, str.RobloxPlayerBeta.exe
nop word [rax + rax]
lea rdx, [rbp - 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rdi + rax*2 + 2]
jne 0x1400b45c0
add rax, 2
cmp rax, 0x15
je 0x1400b4616
movzx ecx, word [rdx + rax*2]
cmp cx, word [rdi + rax*2]
je 0x1400b45a0
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x200
call fcn.1401600b0
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400b4590
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, qword [rsp + 0x4c8]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140128970
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4b0
pop rbp
ret
mov rax, qword [rsp + 0x78]
jmp 0x1400b45ee
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm1, xmmword [0x1401b65b0]
mov dl, 9
movd ecx, xmm1
movdqa xmm0, xmm1
movdqa xmm2, xmmword [0x1401b65a0]
mov r8b, reloc.WS2_32.dll_ntohl
movdqu xmmword [rsp + 0x30], xmm2
xor byte [rsp + 0x31], cl
xor dl, cl
xor byte [rsp + 0x32], cl
xor r8b, cl
xor byte [rsp + 0x33], cl
mov r9b, 0x54
xor byte [rsp + 0x34], cl
xor r9b, cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movdqu xmmword [rsp + 0x20], xmm1
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x40], dl
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x41], r8b
xor al, cl
mov byte [rsp + 0x42], r9b
mov byte [rsp + 0x21], al
movd eax, xmm2
mov byte [rsp + 0x43], 0
xor al, cl
lea rcx, [rsp + 0x48]
mov byte [rsp + 0x30], al
call fcn.140082760
lea rdx, [0x1401d8d88]
lea rcx, [rsp + 0x48]
call fcn.14012aca8
int3
movdqa xmm1, xmmword [0x1401b6670]
mov dl, Ordinal_50
movd ecx, xmm1
movdqa xmm0, xmm1
movdqa xmm2, xmmword [0x1401b6640]
mov r8b, 0x6c
movdqu xmmword [rsp + 0x30], xmm2
xor byte [rsp + 0x31], cl
xor dl, cl
xor byte [rsp + 0x32], cl
xor r8b, cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movdqu xmmword [rsp + 0x20], xmm1
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x40], dl
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x41], r8b
xor al, cl
mov byte [rsp + 0x42], 0
mov byte [rsp + 0x21], al
movd eax, xmm2
xor al, cl
lea rcx, [rsp + 0x48]
mov byte [rsp + 0x30], al
call fcn.140082760
lea rdx, [0x1401d8d88]
lea rcx, [rsp + 0x48]
call fcn.14012aca8
int3