Function at 0x140014fd0
Capabilities:
Acquire debug privileges
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14008a040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rcx
mov qword [rbp - 0x19], rcx
xor r12d, r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov ecx, 0x120
call fcn.140043684
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi], rax
lea r14, [rdi + 0x10]
mov qword [rbp - 0x29], r14
call fcn.140001e40
mov rcx, rax
test rax, rax
je 0x1400154c5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
call fcn.140001e40
mov rcx, rax
test rax, rax
je 0x1400154d0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14 + 8], rax
lea rcx, [r14 + 0x18]
call fcn.14001a480
nop
lea rdx, [0x14007b4f0]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140015091
lea rcx, [r14 + 8]
call fcn.14000bc00
lea rdx, [r14 + 8]
mov rcx, r14
call fcn.14000e620
mov dword [r14 + 0x10], r12d
mov byte [r14 + 0x40], 0
mov qword [r14 + 0x38], r12
lea r15, [rdi + 0x58]
mov qword [rbp - 0x29], r15
mov qword [r15], r12
lea rbx, [r15 + 0x20]
mov qword [rbp - 0x29], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov ecx, 0x30
call fcn.140043684
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [r15 + 0x38], r12
mov qword [rdi + 0x100], r12
mov dword [rdi + 0xbc], 0x4cbebc20
mov dword [rdi + 0xac], 0x4cbebc20
mov dword [rdi + 0xa8], 0x4cbebc20
mov dword [rdi + 0xa4], 0x4cbebc20
mov dword [rdi + 0xa0], 0x4cbebc20
mov dword [rdi + 0x9c], 0x4cbebc20
mov dword [rdi + 0x98], 0x4cbebc20
mov dword [rdi + 0xb8], 0x4cbebc20
mov dword [rdi + 0xb4], 0x4cbebc20
mov dword [rdi + 0xb0], 0x4cbebc20
mov qword [rdi + 0xd8], r12
mov qword [rdi + 0xd0], r12
mov qword [rdi + 0xc8], r12
mov qword [rdi + 0xc0], r12
mov qword [rdi + 0xf8], r12
mov qword [rdi + 0xf0], r12
mov qword [rdi + 0xe8], r12
mov qword [rdi + 0xe0], r12
mov dword [rdi + 0x108], 0x60
mov dword [rdi + 0x10c], 0x61
mov dword [rdi + 0x110], 0x62
mov dword [rdi + 0x114], 0x63
mov dword [rdi + 0x118], 0x64
mov dword [rdi + 0x11c], 0x65
mov dword [rdi + 0x120], 0x66
mov dword [rdi + 0x124], 0x67
mov dword [rdi + 0x128], 0x68
mov dword [rdi + 0x12c], 0x69
mov dword [rdi + 0x130], 0x6e
mov dword [rdi + 0x134], 0x6b
mov dword [rdi + 0x138], 0x6d
lea rbx, [rdi + 0x140]
mov qword [rbp - 0x29], rbx
lea rax, vtable.TrRemote.0
mov qword [rbx], rax
mov qword [rbx + 8], r12
lea rcx, [rbx + 0x18]
call fcn.14001a480
call fcn.140001e40
mov rcx, rax
test rax, rax
je 0x1400154db
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x38], rax
lea rax, vtable.TrSpeedHack.0
mov qword [rbx], rax
mov dword [rdi + 0x1a0], esi
mov dword [rdi + 0x1a4], 9
mov byte [rdi + 0x1a8], 0
call fcn.140001e40
mov rcx, rax
test rax, rax
je 0x1400154e6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x1b0], rax
call fcn.140001e40
mov rcx, rax
test rax, rax
je 0x1400154f1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x1b8], rax
call fcn.140001e40
mov rcx, rax
test rax, rax
je 0x1400154fc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x1c0], rax
call fcn.140001e40
mov rcx, rax
test rax, rax
je 0x1400154ba
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x1c8], rax
lea rdx, str.DarkSoulsIII.exe
mov r8, rsi
inc r8
cmp word [rdx + r8*2], 0
jne 0x140015313
lea rcx, [rdi + 0x1b0]
call fcn.14000bc00
lea rdx, [rdi + 0x1b0]
lea rcx, [rdi + 0x1b8]
call fcn.14000e620
mov qword [rbp - 0x21], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x21]
mov edx, 0x28
call qword [0x14008de08]
test eax, eax
je 0x1400153be
lea r8, [rbp - 0x29]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [0x14008de10]
test eax, eax
je 0x1400153b4
mov dword [rbp + 0x1f], 1
mov rax, qword [rbp - 0x29]
mov qword [rbp + 0x23], rax
mov dword [rbp + 0x2b], 2
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x10]
lea r8, [rbp + 0x1f]
xor edx, edx
mov rcx, qword [rbp - 0x21]
call qword [0x14008de18]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.NOT_SET
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x1400153c5
mov r8d, esi
lea rcx, [rdi + 0x1c8]
call fcn.14000bc00
lea rax, [rbp - 0x21]
mov qword [rbp + 0x1f], rax
mov rcx, qword [rdi + 0x1b8]
sub rcx, 0x18
call fcn.140001230
add rax, 0x18
mov qword [rbp - 0x21], rax
mov rcx, qword [rdi + 0x1b0]
sub rcx, 0x18
call fcn.140001230
add rax, 0x18
mov qword [rbp - 0x29], rax
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x29]
mov rcx, r14
call fcn.14001a590
mov qword [r15 + 0x38], r14
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
mov dword [rbp - 0x21], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
lea rcx, [rbp - 0x11]
cmp dword [rbp - 0x21], 0
je 0x140015465
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
jmp 0x14001546b
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0x1000
cmp dword [rbp + 0x17], edx
cmova edx, dword [rbp + 0x17]
mov ecx, edx
mov qword [r15], rcx
mov qword [rdi + 0x100], r15
mov qword [rdi + 0x148], r15
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400432d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001bd0
nop
mov ecx, 0x80004005
call fcn.140001bd0
nop
mov ecx, 0x80004005
call fcn.140001bd0
nop
mov ecx, 0x80004005
call fcn.140001bd0
nop
mov ecx, 0x80004005
call fcn.140001bd0
nop
mov ecx, 0x80004005
call fcn.140001bd0
nop
mov ecx, 0x80004005
call fcn.140001bd0
int3