Function at 0x1400b86d0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x140166080]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x434
call fcn.1400d30d0
mov edx, dword [rbx + 0x98]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b88eb
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400b87ed
mov qword [rsp + 0x4c8], rdi
lea rdi, str.RobloxPlayerBeta.exe
nop word [rax + rax]
lea rdx, [rbp - 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rdi + rax*2 + 2]
jne 0x1400b8790
add rax, 2
cmp rax, 0x15
je 0x1400b87e6
movzx ecx, word [rdx + rax*2]
cmp cx, word [rdi + rax*2]
je 0x1400b8770
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x200
call fcn.1400d30d0
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400b8760
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, qword [rsp + 0x4c8]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400d04f0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4b0
pop rbp
ret
mov rax, qword [rsp + 0x78]
jmp 0x1400b87be
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm1, xmmword [0x1401463b0]
mov dl, 0x5b
movd ecx, xmm1
movdqa xmm0, xmm1
movdqa xmm2, xmmword [0x1401463a0]
mov r8b, 0x5c
movdqu xmmword [rsp + 0x30], xmm2
xor byte [rsp + 0x31], cl
xor dl, cl
xor byte [rsp + 0x32], cl
xor r8b, cl
xor byte [rsp + 0x33], cl
mov r9b, 6
xor byte [rsp + 0x34], cl
xor r9b, cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movdqu xmmword [rsp + 0x20], xmm1
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x40], dl
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x41], r8b
xor al, cl
mov byte [rsp + 0x42], r9b
mov byte [rsp + 0x21], al
movd eax, xmm2
mov byte [rsp + 0x43], 0
xor al, cl
lea rcx, [rsp + 0x48]
mov byte [rsp + 0x30], al
call fcn.140099840
lea rdx, [0x1401646f8]
lea rcx, [rsp + 0x48]
call fcn.1400d2858
int3
movdqa xmm1, xmmword [0x140146510]
mov dl, 0x75
movd ecx, xmm1
movdqa xmm0, xmm1
movdqa xmm2, xmmword [0x140146500]
mov r8b, 0x28
movdqu xmmword [rsp + 0x30], xmm2
xor byte [rsp + 0x31], cl
xor dl, cl
xor byte [rsp + 0x32], cl
xor r8b, cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movdqu xmmword [rsp + 0x20], xmm1
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x40], dl
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x41], r8b
xor al, cl
mov byte [rsp + 0x42], 0
mov byte [rsp + 0x21], al
movd eax, xmm2
xor al, cl
lea rcx, [rsp + 0x48]
mov byte [rsp + 0x30], al
call fcn.140099840
lea rdx, [0x1401646f8]
lea rcx, [rsp + 0x48]
call fcn.1400d2858
int3