Function at 0x14001ba5f
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1400485b0
push r13
push rbp
push rsi
push rdi
mov eax, 0x1ce8
call fcn.14001b2ee
sub rsp, rax
lea r13, [rsp + 0x20]
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x20]
mov ecx, 0x5b2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140067040]
xor rax, r13
mov qword [rbp + 0x1c90], rax
lea rcx, [0x140070677]
call fcn.14001c0a4
nop
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.14001bfd2
lea rcx, [rbp + 0x19b4]
call fcn.14001badc
mov qword [rbp + 0x1c88], rax
lea rax, [rbp + 0x1a34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1a54]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1a34]
movzx r8d, byte [rbp + 0x1a54]
movzx edx, byte [rbp + 0x1a74]
lea rcx, [rbp + 0x19e0]
call fcn.140042fd0
mov rcx, rax
call fcn.14001b483
mov rdx, rax
lea rcx, [rbp + 0x1c30]
call fcn.14001b578
nop
lea rax, [rbp + 0x1ad4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1af4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1ad4]
movzx r8d, byte [rbp + 0x1af4]
movzx edx, byte [rbp + 0x1b14]
lea rcx, [rbp + 0x1aa0]
call fcn.140043170
mov rcx, rax
call fcn.14001b550
mov rdx, rax
lea rcx, [rbp + 0x1c58]
call fcn.14001b578
nop
lea rax, [rbp + 0x1c80]
mov r8, rax
lea rdx, [rbp + 0x1c30]
lea rcx, [rbp + 0x1b38]
call fcn.14001b7c6
lea rcx, [rbp + 0x1b68]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1c00]
lea rcx, [rbp + 0x1b68]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0x1c88]
lea rdx, [rbp + 0x1c00]
lea rcx, [rbp + 8]
call fcn.14001bab9
nop
lea r9, [fcn.14001be4c]
mov r8d, 2
mov edx, 0x28
lea rcx, [rbp + 0x1c30]
call fcn.14001b442
nop
mov dword [rbp + 0x1064], 0x1000
lea r8, [rbp + 0x1084]
mov edx, dword [rbp + 0x1064]
lea rcx, [rbp + 0x50]
call fcn.14001b6db
test eax, eax
jne 0x1400487a5
mov byte [rbp + 0x1b94], 0
lea rcx, [rbp + 8]
call fcn.14001bb8b
movzx eax, byte [rbp + 0x1b94]
jmp 0x14004893e
mov eax, dword [rbp + 0x1084]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x1084], eax
mov dword [rbp + 0x10a4], 0
jmp 0x1400487d5
mov eax, dword [rbp + 0x10a4]
inc eax
mov dword [rbp + 0x10a4], eax
mov eax, dword [rbp + 0x1084]
cmp dword [rbp + 0x10a4], eax
jae 0x140048927
mov eax, dword [rbp + 0x10a4]
cmp dword [rbp + rax*4 + 0x50], 0
je 0x140048922
mov eax, dword [rbp + 0x10a4]
mov r8d, dword [rbp + rax*4 + 0x50]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x12f8], rax
cmp qword [rbp + 0x12f8], 0
je 0x140048922
lea r9, [rbp + 0x1064]
mov r8d, 8
lea rdx, [rbp + 0x1318]
mov rcx, qword [rbp + 0x12f8]
call fcn.14001b190
test eax, eax
je 0x140048914
mov r9d, 0x104
lea r8, [rbp + 0x10d0]
mov rdx, qword [rbp + 0x1318]
mov rcx, qword [rbp + 0x12f8]
call fcn.14001c1b2
nop
lea rax, [rbp + 8]
mov qword [rbp + 0x1338], rax
mov rcx, qword [rbp + 0x1338]
call fcn.14001b825
mov qword [rbp + 0x1358], rax
mov rcx, qword [rbp + 0x1338]
call fcn.14001c167
mov qword [rbp + 0x1378], rax
jmp 0x1400488b3
mov rax, qword [rbp + 0x1358]
add rax, 0x28
mov qword [rbp + 0x1358], rax
mov rax, qword [rbp + 0x1378]
cmp qword [rbp + 0x1358], rax
je 0x140048914
mov rax, qword [rbp + 0x1358]
mov qword [rbp + 0x1398], rax
lea rdx, [rbp + 0x10d0]
mov rcx, qword [rbp + 0x1398]
call fcn.14001b59b
movzx eax, al
test eax, eax
je 0x140048912
mov rcx, qword [rbp + 0x12f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rbp + 0x1bb4], 1
lea rcx, [rbp + 8]
call fcn.14001bb8b
movzx eax, byte [rbp + 0x1bb4]
jmp 0x14004893e
jmp 0x1400488a1
mov rcx, qword [rbp + 0x12f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1400487c7
mov byte [rbp + 0x1bd4], 0
lea rcx, [rbp + 8]
call fcn.14001bb8b
movzx eax, byte [rbp + 0x1bd4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14005e280]
call fcn.14001bdb1
mov rax, rdi
mov rcx, qword [rbp + 0x1c90]
xor rcx, r13
call fcn.14001b811
lea rsp, [r13 + 0x1cc8]
pop rdi
pop rsi
pop rbp
pop r13
ret