Function at 0x1400b6cc0
Capabilities:
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5f8
movaps xmmword [rsp + 0x5e0], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
jne 0x1400b6cf7
mov rcx, qword [rsi + 8]
cmp qword [rcx], 0x64
ja 0x1400b727c
mov byte [rsp + 0x45], 0
mov byte [rsp + 0x46], 0
mov rdi, qword [rsi + 0x10]
mov r14, qword [rsi + 0x18]
mov r15, qword [rsi + 0x20]
lea rcx, [rsp + 0x45]
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rdi
lea rax, [rsp + 0x46]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], r14
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x170], rbx
mov rbp, qword [rbx + 8]
lea rax, [rsp + 0x140]
mov qword [rsp + 0x190], rax
lea rax, [0x140122880]
mov qword [rsp + 0x198], rax
cmp qword [0x14015b120], 0
jne 0x1400b725e
mov ecx, 0x3c0
mov edx, 8
call fcn.140009b20
test rax, rax
je 0x1400b7327
mov qword [rsp + 0x178], rax
movaps xmm0, xmmword [0x1400cd370]
movups xmmword [rsp + 0x180], xmm0
mov qword [rsp + 0x50], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov ecx, 8
xor edx, edx
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1400b7207
mov r12, rax
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], r14
lea rbp, [rsp + 0x1a0]
mov r8d, 0x438
mov rcx, rbp
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x1a0], 0x438
mov rcx, r12
mov rdx, rbp
call sub.kernel32.dll_Module32FirstW
cmp eax, 1
jne 0x1400b71cf
lea rdi, [rsp + 0x3d0]
lea r13, [rsp + 0x5d8]
lea rsi, [rsp + 0x88]
mov eax, 8
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0xc0]
movaps xmm6, xmmword [0x1400cd380]
jmp 0x1400b6ef9
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
shl rax, 6
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movups xmm2, xmmword [rsp + 0xa0]
movups xmm3, xmmword [rsp + 0xb0]
movups xmmword [rcx + rax + 0x30], xmm3
movups xmmword [rcx + rax + 0x20], xmm2
movups xmmword [rcx + rax + 0x10], xmm1
mov qword [rsp + 0x70], rcx
movups xmmword [rcx + rax], xmm0
inc rdx
mov rax, rdx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x60], rdx
nop word cs:[rax + rax]
mov rcx, r12
lea rdx, [rsp + 0x1a0]
call sub.kernel32.dll_Module32NextW
cmp eax, 1
jne 0x1400b71cf
xor r8d, r8d
nop dword [rax]
cmp word [rsp + r8*2 + 0x3d0], 0
je 0x1400b6f60
lea rax, [rsp + r8*2]
add rax, 0x3d0
cmp word [rax + 2], 0
je 0x1400b6f47
cmp word [rax + 4], 0
je 0x1400b6f4c
cmp word [rax + 6], 0
je 0x1400b6f52
cmp word [rax + 8], 0
je 0x1400b6f58
add r8, 5
add rax, 0xa
cmp rax, r13
jne 0x1400b6f00
mov r8d, 0x104
jmp 0x1400b6f60
inc r8
jmp 0x1400b6f60
add r8, 2
jmp 0x1400b6f60
add r8, 3
jmp 0x1400b6f60
add r8, 4
nop dword [rax]
mov rcx, rbx
mov rdx, rdi
call fcn.140096d60
mov rbp, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xd0]
lea rcx, [rsp + 0x80]
mov rdx, rbp
mov r8, r14
call fcn.140098040
cmp qword [rsp + 0x80], 0
je 0x1400b7045
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xe0], xmm0
mov r15, qword [rsp + 0xe8]
cmp rax, 0x40
jb 0x1400b7030
test r15, r15
je 0x1400b7030
movzx ecx, word [r15]
cmp ecx, 0x5a4d
jne 0x1400b7030
mov r9d, dword [r15 + 0x3c]
mov rcx, rax
sub rcx, r9
mov r8, rbx
setb bl
mov rdx, rdi
mov rdi, rsi
lea rsi, [r15 + r9]
cmp rcx, 0x88
setb cl
or cl, bl
mov rbx, r8
mov ecx, 0
cmove rcx, rsi
mov rsi, rdi
mov rdi, rdx
jne 0x1400b7030
cmp dword [rcx], 0x4550
jne 0x1400b7030
movzx ebx, word [rcx + 0x18]
cmp ebx, 0x20b
mov rbx, r8
jne 0x1400b7030
movzx r8d, word [rcx + 0x14]
sub r8, 0x70
jae 0x1400b706a
nop
mov rcx, r15
call sub.kernel32.dll_UnmapViewOfFile
mov rcx, qword [rsp + 0xe0]
call sub.kernel32.dll_CloseHandle
mov rdx, qword [rsp + 0xc8]
test rdx, rdx
je 0x1400b6ee0
not rdx
shr rdx, 0x3f
mov rcx, rbp
call fcn.140009bb0
jmp 0x1400b6ee0
add r9, 0x88
sub rax, r9
jb 0x1400b7030
cmp rax, r8
jb 0x1400b7030
mov eax, dword [rcx + 0x84]
shl rax, 3
cmp r8, rax
jb 0x1400b7030
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x108], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmm1, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
mov ecx, 0x10
mov edx, 8
call fcn.140009b20
test rax, rax
je 0x1400b7338
mov edx, dword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
mov qword [rsp + 0x100], rax
mov qword [rax + 8], rdx
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xf8], rax
movzx eax, byte [rsp + 0xd8]
mov byte [rsp + 0x47], al
lea rcx, [rsp + 0xd9]
mov eax, dword [rcx]
mov ecx, dword [rcx + 3]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4b], ecx
mov rcx, r15
call sub.kernel32.dll_UnmapViewOfFile
mov rcx, qword [rsp + 0xe0]
call sub.kernel32.dll_CloseHandle
movzx eax, byte [rsp + 0x47]
cmp al, 2
je 0x1400b6ee0
mov rdx, qword [rsp + 0x108]
sub rdx, qword [rsp + 0x68]
mov qword [rsp + 0x80], rbp
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], r14
mov byte [rsp + 0x98], al
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x4b]
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x11], eax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xa0], rax
movups xmmword [rsp + 0xa8], xmm6
mov qword [rsp + 0xb8], rdx
mov rdx, qword [rsp + 0x78]
cmp rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
jne 0x1400b6e84
lea rcx, [rsp + 0x50]
call fcn.1400983f0
jmp 0x1400b6e7a
mov rcx, r12
call sub.kernel32.dll_CloseHandle
mov r14, qword [rsp + 0x138]
mov rbx, qword [rsp + 0x130]
mov r15, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x118]
mov rbp, qword [rsp + 0x110]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1b0], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x178]
movups xmmword [rsp + 0x1b8], xmm1
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x1c8], rax
movups xmmword [0x14015b120], xmm0
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [0x14015b130], xmm0
movaps xmm0, xmmword [rsp + 0x1c0]
movups xmmword [0x14015b140], xmm0
xor ecx, ecx
sub rbp, 1
cmovae rcx, rbp
lea rdx, [rsp + 0x190]
call fcn.140098650
cmp byte [rsp + 0x46], 0
je 0x1400b7283
xor ecx, ecx
jmp 0x1400b7309
cmp byte [rsp + 0x45], 0
jne 0x1400b72fb
cmp byte [rdi], 0
je 0x1400b72fb
mov qword [rsp + 0x140], r15
mov qword [rsp + 0x148], 0
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x1b0], 3
mov qword [rsp + 0x80], 2
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x140]
lea r8, [rsp + 0x1a0]
lea r9, [rsp + 0x80]
call fcn.1400aea50
mov byte [r14], al
mov rax, qword [rsp + 0x140]
inc qword [rax + 8]
mov rax, qword [rsi + 8]
inc qword [rax]
cmp byte [r14], 0
sete cl
mov eax, ecx
movaps xmm6, xmmword [rsp + 0x5e0]
add rsp, 0x5f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x3c0
mov edx, 8
call fcn.14000a410
ud2
mov ecx, 0x10
mov edx, 8
call fcn.14000a410
ud2