Function at 0x140003c50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov ecx, 0xe0
call fcn.14003140c
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.140005a90
nop
mov qword [0x140040838], rax
lea rdx, str.LOCKDOWN_Protocol
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400407e8], rax
test rax, rax
je 0x14000402c
lea rdx, [0x140040800]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x140040800]
test r8d, r8d
je 0x14000402c
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400407f0], rax
test rax, rax
je 0x14000402c
mov edx, dword [0x140040800]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp - 0x80], 0x438
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r14, 0xffffffffffffffff
mov r9d, r14d
lea r8, str.LockdownProtocol_Win64_Shipping.exe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, r14
mov rcx, rax
call fcn.140031698
mov rsi, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, str.LockdownProtocol_Win64_Shipping.exe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
je 0x140003dd9
nop dword [rax]
lea rax, [rbp - 0x50]
mov r8, rsi
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140003dc4
add rax, 2
test ecx, ecx
jne 0x140003db0
mov rcx, rdi
test edx, edx
je 0x140003e37
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140003da0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400407f8], r15
lea rdx, str.module_base_invalid
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400044d0
lea rdx, [0x1400046a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400012a0
mov rcx, rax
call fcn.1400046e0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x68]
mov qword [0x1400407f8], rax
test rax, rax
je 0x140003de9
mov ecx, 0xe0
call fcn.14003140c
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.140005a90
nop
mov qword [0x140040838], rax
lea rcx, [rsp + 0x30]
call fcn.1400011c0
movabs rdi, 0x7fffffffe2329aff
movabs rbx, 0x7fffffffffffffff
mov rax, qword [rsp + 0x30]
cmp rax, rdi
je 0x140003ebb
setl cl
test cl, cl
je 0x140003ebb
add rax, 0x1dcd6500
mov qword [rsp + 0x30], rax
jmp 0x140003ec0
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
call fcn.1400048e0
mov rax, qword [0x140040838]
cmp qword [rax], 0
jne 0x140003f25
lea rdx, str.Download_the_Medal.tv_and_open_it_and_then_run_the_cheat
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400044d0
lea rdx, [0x1400046a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400012a0
mov rcx, rax
call fcn.1400046e0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x30]
call fcn.1400011c0
mov rax, qword [rsp + 0x30]
cmp rax, rdi
je 0x140003f47
setl cl
test cl, cl
je 0x140003f47
lea rbx, [rax + 0x1dcd6500]
mov edi, 0xff
movabs rsi, 0x4e94914effff
movabs r14, 0x431bde82d7b634db
lea rcx, [rsp + 0x30]
call fcn.1400011c0
mov rax, qword [rsp + 0x30]
cmp rbx, rax
je 0x140003fc3
mov ecx, 1
cmovl ecx, edi
test cl, cl
jle 0x140003fc3
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jg 0x140003fb7
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140003fae
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140003f60
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140003f60
lea rax, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rsp + 0x40], rax
lea rax, [0x140002180]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140040838]
sub rcx, 0xffffffffffffff80
lea rdx, [rsp + 0x40]
call fcn.140006270
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004025
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x78], r15
call fcn.140005e20
jmp 0x140004025
lea rdx, str.open_the_game
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400044d0
lea rdx, [0x1400046a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400012a0
mov rcx, rax
call fcn.1400046e0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3