Function at 0x1400013b0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov r15, r8
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x1400017fb
mov dword [rsp + 0x30], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x34]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400016d4
xor r12d, r12d
nop word [rax + rax]
mov qword [rbp + 0x390], r12
mov qword [rbp + 0x3a0], r12
mov qword [rbp + 0x3a8], 7
mov word [rbp + 0x390], r12w
lea rax, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140001470
lea rcx, [rbp + 0x390]
cmp rdx, 7
ja 0x1400014aa
mov qword [rbp + 0x3a0], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
lea rdx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rdi + 0x390], r12w
jmp 0x1400014b5
lea r9, [rsp + 0x60]
call fcn.1400022d0
nop
mov qword [rbp + 0x370], r12
mov qword [rbp + 0x380], r12
mov qword [rbp + 0x388], 7
mov word [rbp + 0x370], r12w
lea rax, [rbp + 0x160]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400014e4
lea rcx, [rbp + 0x370]
cmp rdx, 7
ja 0x140001520
mov qword [rbp + 0x380], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
lea rdx, [rbp + 0x160]
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rdi + 0x370], r12w
jmp 0x14000152d
lea r9, [rbp + 0x160]
call fcn.1400022d0
nop
mov rcx, qword [r15 + 0x10]
cmp qword [rbp + 0x3a0], rcx
jne 0x1400015a4
lea r14, [rbp + 0x390]
cmp qword [rbp + 0x3a8], 8
cmovae r14, qword [rbp + 0x390]
cmp qword [r15 + 0x18], 8
jb 0x140001561
mov rax, qword [r15]
lea rsi, [rax + rcx*2]
jmp 0x14000156a
lea rsi, [r15 + rcx*2]
mov rdi, r15
jb 0x14000156d
mov rdi, qword [r15]
cmp rdi, rsi
je 0x14000159a
sub r14, rdi
nop word [rax + rax]
movzx edx, word [r14 + rdi]
movzx ecx, word [rdi]
call fcn.140001380
test al, al
je 0x1400015d8
add rdi, 2
cmp rdi, rsi
jne 0x140001580
mov al, 1
test al, al
jne 0x140001716
mov rcx, qword [r15 + 0x10]
cmp qword [rbp + 0x380], rcx
jne 0x140001618
lea r14, [rbp + 0x370]
cmp qword [rbp + 0x388], 8
cmovae r14, qword [rbp + 0x370]
cmp qword [r15 + 0x18], 8
jb 0x1400015dc
mov rax, qword [r15]
lea rsi, [rax + rcx*2]
jmp 0x1400015e5
xor al, al
jmp 0x14000159c
lea rsi, [r15 + rcx*2]
mov rdi, r15
jb 0x1400015e8
mov rdi, qword [r15]
cmp rdi, rsi
je 0x14000160e
sub r14, rdi
movzx edx, word [r14 + rdi]
movzx ecx, word [rdi]
call fcn.140001380
test al, al
je 0x14000170f
add rdi, 2
cmp rdi, rsi
jne 0x1400015f0
mov al, 1
test al, al
jne 0x140001716
mov rax, qword [rbp + 0x388]
cmp rax, 8
jb 0x14000165e
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001659
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017ed
call fcn.14000567c
mov qword [rbp + 0x380], r12
mov qword [rbp + 0x388], 7
mov word [rbp + 0x370], r12w
mov rax, qword [rbp + 0x3a8]
cmp rax, 8
jb 0x1400016be
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017f4
call fcn.14000567c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140001440
test rbx, rbx
je 0x1400016e2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140005620
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor al, al
jmp 0x140001610
mov rdi, qword [rsp + 0x48]
mov rax, qword [rbp + 0x388]
cmp rax, 8
jb 0x140001761
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000175c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017ed
call fcn.14000567c
mov qword [rbp + 0x380], r12
mov qword [rbp + 0x388], 7
mov word [rbp + 0x370], r12w
mov rax, qword [rbp + 0x3a8]
cmp rax, 8
jb 0x1400017bd
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017f4
call fcn.14000567c
mov qword [rbp + 0x3a0], r12
mov qword [rbp + 0x3a8], 7
mov word [rbp + 0x390], r12w
test rbx, rbx
je 0x1400017e5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x1400016e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.Could_not_get_module_snapshot_for_remote_process.
lea rcx, [rbp + 0x370]
call fcn.140001210
lea rdx, [0x140009150]
lea rcx, [rbp + 0x370]
call sub.VCRUNTIME140.dll__CxxThrowException
int3