Function at 0x1400090b0
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push r12
push r13
push r15
mov eax, 0x4048
call fcn.14000d6e0
sub rsp, rax
mov rax, qword [0x140042080]
xor rax, rsp
mov qword [rsp + 0x4030], rax
xor r15d, r15d
mov rbx, rcx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov r13, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140009334
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140009334
mov ecx, eax
mov edx, 1
call fcn.140015db8
mov r12, rax
test rax, rax
je 0x140009334
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov rcx, r13
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140009317
lea rcx, [rbx + 0x2022]
mov r8d, 0x1000
lea rdx, [rsp + 0x2030]
call fcn.14000a220
test rax, rax
je 0x140009317
mov qword [rsp + 0x4078], rbp
lea rax, [rsp + 0x2030]
mov qword [rsp + 0x4080], rsi
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x4040], r14
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x140009190
mov eax, dword [rsp + 0x20]
lea rcx, str.LOADER:_found__d_loaded_DLLs..._n
shr eax, 3
mov ebp, r15d
mov edx, eax
mov qword [rsp + 0x4088], rdi
mov r14d, eax
call fcn.140002880
test r14, r14
je 0x140009238
mov rdi, r15
mov rsi, r12
nop dword [rax + rax]
mov rdx, qword [r12 + rdi*8]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov rcx, r13
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
jne 0x1400091f9
lea rcx, str.LOADER:_could_not_resolve_DLLs_name___skipping__n
call fcn.140002880
jmp 0x140009230
lea rdx, [rsp + 0x30]
lea rcx, str.LOADER:_loaded_DLL:__ls_n
call fcn.140002880
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2030]
call fcn.1400188cc
test eax, eax
jne 0x140009230
mov rax, qword [r12 + rdi*8]
inc ebp
mov qword [rsi], rax
add rsi, 8
inc rdi
cmp rdi, r14
jl 0x1400091d0
mov edx, ebp
lea rcx, str.LOADER:_found__d_DLL_s__loaded_from_applications_temporary_directory__n
call fcn.140002880
mov r14, qword [rsp + 0x4040]
movsxd rsi, ebp
mov rbp, qword [rsp + 0x4078]
test rsi, rsi
jle 0x140009307
mov rdi, r12
nop word [rax + rax]
mov rdx, qword [rdi]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov rcx, r13
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
jne 0x140009298
lea rcx, str.LOADER:_could_not_resolve_DLLs_name__was_it_unloaded_____skipping__n
call fcn.140002880
jmp 0x1400092f9
mov ebx, 1
lea rdx, [rsp + 0x30]
mov r8d, ebx
lea rcx, str.LOADER:_forcing_unload_of__ls__attempt__d__n
call fcn.140002880
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x1400092e8
nop
cmp ebx, 0x20
jge 0x140009324
inc ebx
lea rdx, [rsp + 0x30]
mov r8d, ebx
lea rcx, str.LOADER:_forcing_unload_of__ls__attempt__d__n
call fcn.140002880
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1400092c0
mov edx, ebx
lea rcx, str.LOADER:_DLL_unloaded_after__d_attempt_s___n
call fcn.140002880
inc r15d
add rdi, 8
sub rsi, 1
jne 0x140009270
mov rdi, qword [rsp + 0x4088]
mov rsi, qword [rsp + 0x4080]
mov rcx, r12
call fcn.140015dc0
mov eax, r15d
jmp 0x140009336
mov edx, ebx
lea rcx, str.LOADER:_giving_up_after__d_attempts__n
call fcn.140002880
jmp 0x1400092f9
xor eax, eax
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.14000d3e0
add rsp, 0x4048
pop r15
pop r13
pop r12
pop rbx
ret