Function at 0x180001b50
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x2178]
mov eax, 0x2278
call fcn.18000fda0
sub rsp, rax
mov rax, qword [0x180017040]
xor rax, rsp
mov qword [rbp + 0x2160], rax
xor edx, edx
lea rcx, [rsp + 0x3f]
mov r8d, 0xf5
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [0x1800170b8]
lea r9, [rbp + 0x44]
shr rcx, 0x16
lea rdx, [rbp + 0x50]
mov rsi, rax
mov qword [rsp + 0x37], rcx
mov qword [0x1800170b8], rcx
movabs rax, 0x6c6c756632336964
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x180001cd0
xor edi, edi
test dword [rbp + 0x44], 0xfffffff8
jbe 0x180001cd0
nop word [rax + rax]
lea rbx, [rbp + 0x50]
mov r9d, 0x104
mov rdx, qword [rbx + rdi*8]
lea rbx, [rbx + rdi*8]
lea r8, [rbp + 0x2050]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x180001cc0
lea rax, [rbp + 0x2051]
lea r8, [rsp + 0x30]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180001c43
inc rax
test ecx, ecx
jne 0x180001c30
test edx, edx
jne 0x180001cc0
mov r11, qword [rbx]
xor r9d, r9d
mov word [rbp + 0x40], 0xe7ff
movsxd rcx, dword [r11 + 0x3c]
lea r8, [r11 + 0x18]
add r8, rcx
movzx eax, word [rcx + r11 + 0x14]
movzx r10d, word [rcx + r11 + 6]
add r8, rax
test r10d, r10d
je 0x180001cc0
movzx eax, word [rbp + 0x40]
cmp dword [r8], 0x7865742e
jne 0x180001cad
cmp byte [r8 + 4], 0x74
jne 0x180001cad
mov ebx, dword [r8 + 0xc]
mov ecx, dword [r8 + 8]
add rbx, r11
lea rdx, [rbx - 2]
add rdx, rcx
cmp rbx, rdx
jae 0x180001cad
nop dword [rax]
cmp word [rbx], ax
je 0x180001cbb
inc rbx
cmp rbx, rdx
jb 0x180001ca0
add r8, 0x28
inc r9d
cmp r9d, r10d
jl 0x180001c76
jmp 0x180001cc0
test rbx, rbx
jne 0x180001ced
mov eax, dword [rbp + 0x44]
inc edi
shr eax, 3
cmp edi, eax
jb 0x180001bf0
xor eax, eax
mov rcx, qword [rbp + 0x2160]
xor rcx, rsp
call fcn.18000ec70
add rsp, 0x2278
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x22a0], r12
mov r8b, 8
mov qword [rsp + 0x22a8], r13
mov cl, 6
mov qword [rsp + 0x22b0], r14
xor cl, 0x69
movzx r14d, r8b
mov qword [rsp + 0x2270], r15
mov dl, 0xa
mov byte [rsp + 0x22], cl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
xor dl, 0x69
mov al, 0x25
mov byte [rsp + 0x23], dl
mov r9b, 0x1d
mov byte [rsp + 0x20], 0x69
mov r10b, 0xc
mov byte [rsp + 0x2e], 0
mov r11b, 0xd
lea rdx, [rsp + 0x21]
xor al, 0x69
xor r8b, 0x69
xor r9b, 0x69
mov byte [rsp + 0x21], al
xor r10b, 0x69
mov byte [rsp + 0x24], r8b
xor r11b, 0x69
mov byte [rsp + 0x25], r9b
mov r15b, 4
mov byte [rsp + 0x26], r10b
mov dil, 0x49
mov byte [rsp + 0x27], r11b
mov sil, 0x3b
mov r12b, 0x19
mov r13b, 0x63
xor r15b, 0x69
xor dil, 0x69
mov byte [rsp + 0x2b], r15b
xor sil, 0x69
mov byte [rsp + 0x28], dil
xor r14b, 0x69
mov byte [rsp + 0x29], sil
xor r12b, 0x69
mov byte [rsp + 0x2a], r14b
xor r13b, 0x69
mov byte [rsp + 0x2c], r12b
mov byte [rsp + 0x2d], r13b
call fcn.180001e00
lea rdx, [0x180002070]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r15, qword [rsp + 0x2270]
mov rax, rbx
mov r14, qword [rsp + 0x22b0]
mov r13, qword [rsp + 0x22a8]
mov r12, qword [rsp + 0x22a0]
jmp 0x180001cd2