Function at 0x1400bec50
Capabilities:
Enumerate process modules

Disassembly:
cmp edx, 2
jl 0x1400b850b
mov r11, rsp
sub rsp, 0x368
mov rax, qword [0x1401664b8]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x40], rcx
mov qword [r11 - 8], rbx
movsxd rax, edx
movd xmm0, edx
mov qword [r11 - 0x10], rsi
cvtdq2ps xmm0, xmm0
lea rcx, [rcx + rax*8]
mov qword [r11 - 0x18], rdi
add rcx, 0xfffffffffffffff8
mov qword [rsp + 0x48], rcx
call sub.api_ms_win_crt_math_l1_1_0.dll_logf
addss xmm0, xmm0
xor edx, edx
mov r8d, 0x2e8
lea rcx, [rsp + 0x58]
cvttss2si rax, xmm0
mov dword [rsp + 0x50], eax
call sub.VCRUNTIME140.dll_memset
lea rsi, [rsp + 0x40]
nop word [rax + rax]
movups xmm2, xmmword [rsi]
movsd xmm0, qword [rsi + 0x10]
movdqa xmm1, xmm2
movsd qword [rsp + 0x30], xmm0
mov r11d, dword [rsp + 0x30]
movq r8, xmm2
psrldq xmm1, 8
movq r10, xmm1
mov r9, r10
sub r9, r8
sar r9, 3
inc r9d
test r11d, r11d
je 0x1400b83d1
nop dword [rax]
cmp r9d, 8
jle 0x1400b850c
test r9d, r9d
jns 0x1400b82f2
inc r9d
mov rax, qword [r8]
sar r9d, 1
movsxd rdx, r9d
lea r9, [r10 + 8]
mov rcx, qword [r8 + rdx*8]
mov qword [r8 + rdx*8], rax
mov rdx, r8
mov qword [r8], rcx
nop dword [rax]
add rdx, 8
cmp rdx, r10
ja 0x1400b8321
mov rax, qword [rdx]
cmp qword [r8], rax
jae 0x1400b8310
mov rcx, qword [r9 - 8]
add r9, 0xfffffffffffffff8
cmp r9, r8
jbe 0x1400b8333
cmp rcx, qword [r8]
jae 0x1400b8321
cmp rdx, r9
ja 0x1400b8343
mov rax, qword [rdx]
mov qword [rdx], rcx
mov qword [r9], rax
jmp 0x1400b8310
mov rax, qword [r8]
dec r11d
mov qword [r8], rcx
mov rcx, r9
mov qword [r9], rax
sub rcx, r8
sub rcx, 8
mov rax, r10
sub rax, rdx
and rcx, 0xfffffffffffffff8
and rax, 0xfffffffffffffff8
cmp rcx, rax
jl 0x1400b8396
lea rax, [r8 + 8]
cmp rax, r9
jae 0x1400b8388
lea rax, [r9 - 8]
mov qword [rsi], r8
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], r11d
add rsi, 0x18
cmp r10, rdx
jbe 0x1400b84ca
mov r8, rdx
jmp 0x1400b83bb
cmp r10, rdx
jbe 0x1400b83aa
mov qword [rsi], rdx
mov qword [rsi + 8], r10
mov dword [rsi + 0x10], r11d
add rsi, 0x18
lea rax, [r8 + 8]
cmp rax, r9
jae 0x1400b84ca
lea r10, [r9 - 8]
mov r9, r10
sub r9, r8
sar r9, 3
inc r9d
test r11d, r11d
jne 0x1400b82e0
lea eax, [r9 - 2]
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
js 0x1400b8447
lea edi, [rax*2 + 1]
mov r11d, ebx
cmp edi, r9d
jge 0x1400b843f
nop dword [rax]
lea r10d, [r11 + r11]
lea edx, [r10 + 1]
lea eax, [rdx + 1]
cmp eax, r9d
jge 0x1400b8415
movsxd rax, edx
movsxd rcx, r10d
mov rax, qword [r8 + rax*8]
cmp qword [r8 + rcx*8 + 0x10], rax
cmovb edx, r10d
inc edx
movsxd rax, edx
movsxd rcx, r11d
mov r10, qword [r8 + rax*8]
mov r11, qword [r8 + rcx*8]
cmp r11, r10
jae 0x1400b843f
mov qword [r8 + rcx*8], r10
mov qword [r8 + rax*8], r11
lea eax, [rdx*2 + 1]
mov r11d, edx
cmp eax, r9d
jl 0x1400b83f0
sub edi, 2
sub ebx, 1
jns 0x1400b83e5
lea r11d, [r9 - 1]
movsxd rbx, r11d
test r11d, r11d
jle 0x1400b84ca
mov rax, qword [r8 + rbx*8]
xor r10d, r10d
mov rcx, qword [r8]
mov qword [r8], rax
mov qword [r8 + rbx*8], rcx
cmp r11d, 1
jle 0x1400b84bf
nop word [rax + rax]
lea r9d, [r10 + r10]
lea edx, [r9 + 1]
lea eax, [rdx + 1]
cmp eax, r11d
jge 0x1400b8495
movsxd rax, edx
movsxd rcx, r9d
mov rax, qword [r8 + rax*8]
cmp qword [r8 + rcx*8 + 0x10], rax
cmovb edx, r9d
inc edx
movsxd rax, edx
movsxd rcx, r10d
mov r9, qword [r8 + rax*8]
mov r10, qword [r8 + rcx*8]
cmp r10, r9
jae 0x1400b84bf
mov qword [r8 + rcx*8], r9
mov qword [r8 + rax*8], r10
lea eax, [rdx*2 + 1]
mov r10d, edx
cmp eax, r11d
jl 0x1400b8470
dec r11d
dec rbx
test rbx, rbx
jg 0x1400b8453
sub rsi, 0x18
lea rax, [rsp + 0x40]
cmp rsi, rax
jae 0x1400b82a0
mov rdi, qword [rsp + 0x350]
mov rsi, qword [rsp + 0x358]
mov rbx, qword [rsp + 0x360]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.14010f320
add rsp, 0x368
ret
cmp r10, r8
jbe 0x1400b84ca
lea r9, [r8 + 8]
mov rdx, r8
mov rcx, r9
cmp r9, r10
ja 0x1400b8533
mov rax, qword [rcx]
cmp qword [rdx], rax
cmovb rdx, rcx
add rcx, 8
cmp rcx, r10
jbe 0x1400b8520
mov rax, qword [r10]
mov rcx, qword [rdx]
mov qword [rdx], rax
mov qword [r10], rcx
sub r10, 8
cmp r10, r8
ja 0x1400b8515
jmp 0x1400b84ca
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov qword [rsp + 0x70], rbp
mov r14, rcx
lea rsi, [rdx + 0x408]
xor r15d, r15d
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rsi]
mov rax, qword [r14]
shl ebx, 3
mov dword [rsp + 0x60], r15d
test rax, rax
jne 0x1400bec98
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rdi + 0x400]
lea r9, [rsp + 0x60]
test rcx, rcx
mov dword [rsp + 0x20], 3
mov rdx, rdi
mov r8d, ebx
cmovne rdx, rcx
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModulesEx
test eax, eax
je 0x1400bed6a
mov eax, dword [rsp + 0x60]
cmp eax, ebx
jbe 0x1400bed36
movsxd rbx, dword [rsi]
shr eax, 3
cmp eax, ebx
jle 0x1400bed1b
mov ebp, eax
mov dword [rsi], eax
sub ebp, ebx
cmp eax, dword [rdi + 0x40c]
jle 0x1400becf3
mov edx, ebx
mov rcx, rdi
call fcn.1400c27b0
mov rax, qword [rdi + 0x400]
mov rcx, rdi
movsxd r8, ebp
shl r8, 3
test rax, rax
cmovne rcx, rax
xor edx, edx
lea rcx, [rcx + rbx*8]
call sub.VCRUNTIME140.dll_memset
jmp 0x1400bec80
jge 0x1400bec80
je 0x1400bec80
mov rcx, rdi
mov dword [rsi], eax
call fcn.1400c28f0
jmp 0x1400bec80
mov rax, qword [rdi + 0x400]
movzx r9d, byte [rsp + 0x60]
test rax, rax
movzx r8d, byte [rsp + 0x60]
mov edx, dword [rsi]
cmovne rdi, rax
mov rcx, rdi
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
jmp 0x1400b8220
mov dword [rsi], r15d
cmp dword [rdi + 0x40c], r15d
je 0x1400bed80
xor edx, edx
mov rcx, rdi
call fcn.1400c2990
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret