Function at 0x1400014c0
Capabilities:
Create thread
Enumerate process modules
Get process image filename
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.1400031d0
sub rsp, rax
mov rdi, rdx
movsxd r15, ecx
xor r14d, r14d
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, str.NtSuspendProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1410], rax
lea rdx, str.NtResumeProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov esi, r14d
mov qword [rsp + 0x40], r14
lea ecx, [r15 - 1]
movsxd rdx, ecx
mov qword [rsp + 0x50], rdx
test ecx, ecx
je 0x140001572
movabs rax, 0x1fffffffffffffff
cmp rdx, rax
ja 0x140001a6e
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140001ff0
mov rsi, qword [rsp + 0x40]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r14
mov r14d, 1
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
mov edx, 0x10000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
lea r8, [rbp + 0x1400]
mov edx, 0x1000
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14000161f
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001601
sub rsi, rcx
and rsi, 0xfffffffffffffff8
mov rax, rcx
cmp rsi, 0x1000
jb 0x1400015f9
add rsi, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
call fcn.140002890
mov eax, r14d
mov rbx, qword [rsp + 0x1508]
add rsp, 0x14c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r13d, dword [rbp + 0x1400]
shr r13d, 2
lea r15, [rdi + r15*8]
add rdi, 8
mov rbx, qword [rsp + 0x38]
cmp rdi, r15
jae 0x140001679
nop dword [rax]
cmp rbx, rsi
je 0x140001656
mov rax, qword [rdi]
mov qword [rbx], rax
add rbx, 8
mov qword [rsp + 0x38], rbx
jmp 0x140001670
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400023f0
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rdi, 8
cmp rdi, r15
jb 0x140001640
xor r15d, r15d
mov edi, r15d
mov r12, qword [rsp + 0x30]
cmp r13d, r14d
jbe 0x140001729
lea rsi, [rbp + 0x3c4]
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
mov ecx, 0x1800
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001714
mov r8d, 0x104
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x140001714
mov edx, 0x5c
lea rcx, [rbp - 0x60]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add rax, 2
cmp r12, rbx
je 0x140001708
mov r8, qword [r12]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001704
add rax, 2
test ecx, ecx
jne 0x1400016f0
test edx, edx
je 0x140001722
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, r15
inc r14d
add rsi, 4
cmp r14d, r13d
jb 0x1400016a0
jmp 0x140001729
mov byte [0x140007212], 1
lea rdx, str.Processes_to_be_managed:_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001b60
movabs rbx, 0x7fffffffffffffff
cmp byte [0x140007212], r15b
je 0x1400017c2
lea rdx, [0x140004510]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001b60
mov rcx, rax
lea rdx, [0x14000450c]
call fcn.140001b60
lea rdx, str.Press_F5_to_item_desync__keep_it_on_for_3_4_seconds_and_equip_your_item_beforehand_in_your_5_slot_and_have_it_actively_equipped_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001b60
mov rcx, rax
lea rdx, [0x14000450c]
call fcn.140001b60
lea rdx, str.Press_Xbutton2_to_automatically_tab_glitch__freeze_roblox_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001b60
mov rcx, rax
lea rdx, [0x14000450c]
call fcn.140001b60
cmp byte [0x140007212], r15b
jne 0x1400018b1
lea rdx, str.TO_ENABLE_FREEZING__CREATE_A_.CMD_in_the_same_folder_that_just_does__nameofthisexe_.exe_RobloxPlayerBeta.exe__or_whatever_your_roblox_process_is_called_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001d40
mov rcx, rax
lea rdx, [0x140001fb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.ALERT__Roblox_has_NOT_been_found__run_the_.cmd_file_and_NOT_the_.exe_file_as_you_need_to_put_the_roblox_process_as_your_parameter_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001d40
mov rcx, rax
lea rdx, [0x140001fb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.If_you_did_do_this__check_for_spelling_and_make_sure_its_CASE_SENSITIVE_AND_HAS_THE_.exe_AT_THE_END_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001d40
mov rcx, rax
lea rdx, [0x140001fb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.The_program_will_still_run__but_you_will_not_be_able_to_suspend_freeze_Roblox_at_all__so_relaunch_it_properly.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001d40
mov rcx, rax
lea rdx, [0x140001fb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Program_will_open_in_1_second.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001d40
mov rcx, rax
lea rdx, [0x140001fb0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x58]
call fcn.1400012a0
movabs rcx, 0x7fffffffc46535ff
mov rax, qword [rsp + 0x58]
cmp rax, rcx
jge 0x14000189e
add rax, 0x3b9aca00
mov qword [rbp + 0x1418], rax
jmp 0x1400018a5
mov qword [rbp + 0x1418], rbx
lea rcx, [rbp + 0x1418]
call fcn.140002280
mov ecx, 8
call fcn.140002614
lea rcx, [0x1400013a0]
mov qword [rax], rcx
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x1400025b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140001a5d
xor sil, sil
mov r13, qword [rbp + 0x1410]
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001924
test sil, sil
jne 0x140001933
mov rcx, rdi
call r13
mov sil, 1
jmp 0x140001933
test sil, sil
je 0x140001933
mov rcx, rdi
call qword [rsp + 0x60]
xor sil, sil
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001a00
mov rbx, qword [r12]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140001a00
lea rdx, [rbp + 0x1410]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x1410]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140001a00
xor r14b, r14b
mov r9d, 0x104
lea r8, [rbp + 0x1b0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x1400019c9
lea rcx, [rbp + 0x1b0]
sub rbx, rcx
nop
movzx edx, word [rcx]
movzx eax, word [rcx + rbx]
sub edx, eax
jne 0x1400019c3
add rcx, 2
test eax, eax
jne 0x1400019b0
test edx, edx
sete r14b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
je 0x140001a00
cmp byte [0x140007210], 0
jne 0x140001a07
movzx eax, byte [0x140007211]
test al, al
sete al
xchg byte [0x140007211], al
mov byte [0x140007210], 1
mov r12, qword [rsp + 0x30]
jmp 0x140001a07
mov byte [0x140007210], 0
lea rcx, [rsp + 0x68]
call fcn.1400012a0
mov rax, qword [rsp + 0x68]
movabs rcx, 0x7fffffffffff3caf
cmp rax, rcx
jge 0x140001a3f
add rax, 0xc350
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
call fcn.140002280
jmp 0x140001904
movabs rbx, 0x7fffffffffffffff
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x48]
call fcn.140002280
jmp 0x140001904
mov dword [rsp + 0x78], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140001b40
int3