Function at 0x1400b1d50
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x318
movaps xmmword [rsp + 0x300], xmm6
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x1400b21ca
mov r13, rax
cmp r14, 0x21
mov ebx, 0x20
cmovae rbx, r14
movaps xmm6, xmmword [section..rdata]
movaps xmmword [rsp + 0x280], xmm6
movaps xmmword [rsp + 0x270], xmm6
lea rcx, [rsp + 0x270]
xor edx, edx
mov r8, rbx
call fcn.140114c60
mov dword [rsp + 0x5c], 0
lea r9, [rsp + 0x5c]
mov rcx, r13
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400b209c
mov edx, dword [rsp + 0x5c]
test rdx, rdx
je 0x1400b209c
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x1400b209c
mov rdi, rax
mov r14d, dword [rsp + 0x5c]
lea r9, [rsp + 0x5c]
mov rcx, r13
mov rdx, rax
mov r8d, r14d
call sub.KERNEL32.dll_K32EnumProcessModules
mov qword [rsp + 0x28], r14
cmp r14, 8
jb 0x1400b2093
test eax, eax
je 0x1400b2093
mov rax, qword [rsp + 0x28]
shr eax, 3
mov qword [rsp + 0x28], rax
xor ebp, ebp
lea r12, [rsp + 0x60]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
jmp 0x1400b1e88
mov r13, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
inc rbp
cmp rbp, qword [rsp + 0x28]
je 0x1400b2093
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmmword [rsp + 0x40], xmm6
mov rdx, qword [rdi + rbp*8]
mov rcx, r13
lea r8, [rsp + 0x40]
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x1400b1e7a
mov r8d, 0x105
lea rcx, [rsp + 0x160]
mov dl, 0xaa
call fcn.140114c60
mov r15d, 1
xor edi, edi
xor eax, eax
jmp 0x1400b2041
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x2a0], xmm6
movaps xmmword [rsp + 0x290], xmm6
movaps xmmword [rsp + 0x2b0], xmm6
movaps xmmword [rsp + 0x2c0], xmm6
movaps xmmword [rsp + 0x2d0], xmm6
movaps xmmword [rsp + 0x2e0], xmm6
mov dword [rsp + 0x2a0], 1
mov qword [rsp + 0x290], rdi
mov byte [rsp + 0x298], 4
mov dword [rsp + 0x2b8], 1
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], r14
sub r14, r13
mov byte [rsp + 0x2b0], 8
lea rax, [rsp + 0x160]
mov qword [rsp + 0x2c0], rax
mov dword [rsp + 0x2d0], 2
mov dword [rsp + 0x2e8], 1
mov qword [rsp + 0x2d8], r14
mov byte [rsp + 0x2e0], 8
mov qword [rsp + 0x20], 4
mov edx, 0x100
mov rcx, r12
lea r8, str._d_0x_x___s0x_x__n
lea r9, [rsp + 0x290]
call fcn.1400ab370
xor ecx, ecx
mov rdx, r12
call fcn.1400a0790
mov byte [rsp + rdi + 0x270], 1
mov al, 1
mov edi, r15d
inc r15d
cmp rbx, rdi
jbe 0x1400b1e70
mov r13, qword [rsp + 0x40]
mov r14, qword [rsi + rdi*8]
cmp r13, r14
ja 0x1400b2032
mov ecx, dword [rsp + 0x48]
add rcx, r13
cmp rcx, r14
jbe 0x1400b2032
test al, 1
jne 0x1400b1ee0
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + rbp*8]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x160]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleFileNameExA
mov eax, eax
mov byte [rsp + rax + 0x160], 0
jmp 0x1400b1ee0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
lea r14, str._d_0x_x__unknown__n
lea r15, [rsp + 0x160]
lea r12, [rsp + 0x60]
jmp 0x1400b20cc
inc rdi
cmp rbx, rdi
je 0x1400b21c1
cmp byte [rsp + rdi + 0x270], 0
jne 0x1400b20c0
movaps xmmword [rsp + 0x250], xmm6
movaps xmmword [rsp + 0x240], xmm6
movaps xmmword [rsp + 0x230], xmm6
movaps xmmword [rsp + 0x220], xmm6
movaps xmmword [rsp + 0x210], xmm6
movaps xmmword [rsp + 0x200], xmm6
movaps xmmword [rsp + 0x1f0], xmm6
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm6
movaps xmmword [rsp + 0x1c0], xmm6
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1a0], xmm6
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x160], xmm6
mov rax, qword [rsi + rdi*8]
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x68], 8
mov dword [rsp + 0x88], 1
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x80], 8
mov qword [rsp + 0x20], 2
mov edx, 0x100
mov rcx, r15
mov r8, r14
mov r9, r12
call fcn.1400ab370
xor ecx, ecx
mov rdx, r15
call fcn.1400a0790
jmp 0x1400b20c0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x1400b21fa
movaps xmm6, xmmword [rsp + 0x300]
add rsp, 0x318
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400e0180
int3