Function at 0x1400b02c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x14015d080]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x434
call fcn.1400cacc0
mov edx, dword [rbx + 0x98]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b04db
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400b03dd
mov qword [rsp + 0x4c8], rdi
lea rdi, str.RobloxPlayerBeta.exe
nop word [rax + rax]
lea rdx, [rbp - 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rdi + rax*2 + 2]
jne 0x1400b0380
add rax, 2
cmp rax, 0x15
je 0x1400b03d6
movzx ecx, word [rdx + rax*2]
cmp cx, word [rdi + rax*2]
je 0x1400b0360
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x200
call fcn.1400cacc0
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400b0350
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, qword [rsp + 0x4c8]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400c80e0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4b0
pop rbp
ret
mov rax, qword [rsp + 0x78]
jmp 0x1400b03ae
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm1, xmmword [0x14013e120]
mov dl, 0x2e
movd ecx, xmm1
movdqa xmm0, xmm1
movdqa xmm2, xmmword [0x14013e110]
mov r8b, 0x29
movdqu xmmword [rsp + 0x30], xmm2
xor byte [rsp + 0x31], cl
xor dl, cl
xor byte [rsp + 0x32], cl
xor r8b, cl
xor byte [rsp + 0x33], cl
mov r9b, 0x73
xor byte [rsp + 0x34], cl
xor r9b, cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movdqu xmmword [rsp + 0x20], xmm1
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x40], dl
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x41], r8b
xor al, cl
mov byte [rsp + 0x42], r9b
mov byte [rsp + 0x21], al
movd eax, xmm2
mov byte [rsp + 0x43], 0
xor al, cl
lea rcx, [rsp + 0x48]
mov byte [rsp + 0x30], al
call fcn.140091e10
lea rdx, [0x14015af10]
lea rcx, [rsp + 0x48]
call fcn.1400ca448
int3
movdqa xmm1, xmmword [0x14013e0f0]
mov dl, 0x2f
movd ecx, xmm1
movdqa xmm0, xmm1
movdqa xmm2, xmmword [0x14013e140]
mov r8b, 0x72
movdqu xmmword [rsp + 0x30], xmm2
xor byte [rsp + 0x31], cl
xor dl, cl
xor byte [rsp + 0x32], cl
xor r8b, cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movdqu xmmword [rsp + 0x20], xmm1
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x40], dl
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x41], r8b
xor al, cl
mov byte [rsp + 0x42], 0
mov byte [rsp + 0x21], al
movd eax, xmm2
xor al, cl
lea rcx, [rsp + 0x48]
mov byte [rsp + 0x30], al
call fcn.140091e10
lea rdx, [0x14015af10]
lea rcx, [rsp + 0x48]
call fcn.1400ca448
int3