Function at 0x140003b90
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Inject thread
Set console window title
Spawn thread to rwx shellcode
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r12, rdx
movsxd rbx, ecx
lea rcx, [0x140004c90]
call fcn.1400064d0
lea rcx, [0x1400084fa]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor r13d, r13d
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], r13b
cmp ebx, 1
jle 0x140003d4f
mov r15, rbx
cmp rbx, 1
jbe 0x140003d4f
lea esi, [r13 + 1]
nop dword [rax + rax]
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov r8d, 1
lea rdx, [0x140008734]
lea rcx, [rbp - 0x38]
call fcn.140004fb0
nop
lea r8, [rbp - 0x38]
mov rdx, qword [r12 + rsi*8]
lea rcx, [rbp - 0x80]
call fcn.140005130
mov r9, rax
mov rdi, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140003c6d
mov r9, qword [rax]
mov r14, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x140003caf
lea rax, [rdi + r14]
mov qword [rbp + 0x18], rax
lea rbx, [rbp + 8]
cmp rcx, 0x10
cmovae rbx, qword [rbp + 8]
lea rcx, [rbx + r14]
mov r8, rdi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rbx]
mov byte [rax + r14], 0
jmp 0x140003cc1
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.1400055d0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140003cfc
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cf7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003da9
call fcn.1400064e8
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140003d43
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003db0
call fcn.1400064e8
inc rsi
cmp rsi, r15
jl 0x140003c20
call fcn.1400030e0
mov eax, dword [0x14000b048]
mov dword [rsp + 0x78], eax
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov rdi, qword [0x14000b060]
lea rsi, [0x14000b050]
cmp qword [0x14000b068], 0x10
cmovae rsi, qword [0x14000b050]
movabs rax, 0x7fffffffffffffff
cmp rdi, 0x10
jae 0x140003db7
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x40], 0xf
jmp 0x140003e27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003e01
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004c7e
mov rcx, rax
call fcn.14000625c
mov rcx, rax
test rax, rax
je 0x140004beb
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140003e10
test rcx, rcx
je 0x140003e0d
call fcn.14000625c
jmp 0x140003e10
mov rax, r13
mov qword [rbp - 0x58], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x18], r13
mov qword [rbp - 8], r13
mov eax, 0xf
mov qword [rbp], rax
mov byte [rbp - 0x18], 0
cmp rdi, 8
jae 0x140003e4e
mov r14d, r13d
jmp 0x140004b6e
lea rcx, [0x140008738]
call fcn.1400010b0
lea rcx, str.https:__github.com_xiaonian233_genshin_fps_unlock__n
call fcn.1400010b0
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
lea rcx, [0x1400087b0]
call fcn.1400010b0
lea rbx, [rbp - 0x58]
mov rsi, qword [rbp - 0x58]
mov r15, qword [rbp - 0x40]
cmp r15, 0x10
cmovae rbx, rsi
mov r14, 0xffffffffffffffff
mov rdi, qword [rbp - 0x48]
test rdi, rdi
je 0x140003f32
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0xf8], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0xfd]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + 0xfc], 1
lea rax, [rdi - 1]
mov r8, r14
cmp rax, r14
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax + 0xa0], 0
jne 0x140003f2d
cmp r8, rbx
je 0x140003f32
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax + 0xa0], 0
je 0x140003f17
sub r8, rbx
jmp 0x140003f35
mov r8, r14
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp - 0x58]
cmp r15, 0x10
cmovae rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.140004fb0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140003f9c
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b5b
call fcn.1400064e8
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rbp - 8], xmm1
lea rcx, [rbp - 0x58]
call fcn.140004d00
lea rcx, [rax + 1]
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rax, qword [rbp - 0x48]
cmp rax, rcx
jb 0x140004c84
sub rax, rcx
mov r8, r14
cmp rax, r14
cmovb r8, rax
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
add rdx, rcx
lea rcx, [rbp - 0x38]
call fcn.140004fb0
nop
lea rsi, [rbp - 0x38]
mov r12, qword [rbp - 0x38]
mov r13, qword [rbp - 0x20]
cmp r13, 0x10
cmovae rsi, r12
mov rdi, qword [rbp - 0x28]
cmp rdi, 0x10
jae 0x14000402e
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x80], xmm0
mov ebx, 0xf
jmp 0x1400040a3
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004082
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004c78
mov rcx, rax
call fcn.14000625c
mov rcx, rax
test rax, rax
je 0x14000438a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004090
test rcx, rcx
je 0x14000408e
call fcn.14000625c
jmp 0x140004090
xor eax, eax
mov qword [rbp - 0x80], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rbx
lea rcx, [rbp - 0x80]
call fcn.1400027f0
test eax, eax
je 0x1400040e6
lea rcx, [0x1400087c0]
call fcn.1400010b0
lea rcx, [0x1400087d8]
call fcn.1400010b0
lea rcx, [0x1400087f8]
call fcn.1400010b0
xor esi, esi
mov r14d, esi
jmp 0x140004b29
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rax, qword [rbp - 0x18]
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rdx, qword [rbp + 8]
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rcx, qword [rbp - 0x58]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x48], r8
lea r8, [rbp + 0x30]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140004249
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, ebx
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 0xf
mov rdx, qword [rsp + 0x58]
inc r14
cmp byte [rdx + r14], sil
jne 0x1400041c7
mov r8, r14
lea rcx, [rbp - 0x80]
call fcn.140004fb0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae r8, qword [rbp - 0x80]
mov edx, ebx
lea rcx, str.CreateProcess_failed___d_:__s
call fcn.1400010b0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140004241
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000423c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000423c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400064e8
mov r14d, esi
jmp 0x140004b29
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x70]
lea rcx, str.PID:__d_n
call fcn.1400010b0
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x14000b710]
mov edx, dword [rax + 4]
mov dword [0x14000b708], edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
mov r15d, 0x3e8
nop dword [rax]
nop dword [rax + rax]
lea rsi, [rbp - 0x38]
cmp r13, 0x10
cmovae rsi, r12
cmp rdi, 0x10
jae 0x1400042d3
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x68], 0xf
jmp 0x140004348
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004323
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004c78
mov rcx, rax
call fcn.14000625c
mov rcx, rax
test rax, rax
je 0x14000438a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004331
test rcx, rcx
je 0x14000432f
call fcn.14000625c
jmp 0x140004331
xor eax, eax
mov qword [rbp - 0x80], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x70], rdi
lea r8, [rbp + 0xa0]
lea rdx, [rbp - 0x80]
mov ecx, dword [rsp + 0x70]
call fcn.1400025e0
test al, al
jne 0x140004391
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
add r15d, 0xfffffffb
jne 0x1400042b0
lea rcx, str.Get_BaseModule_time_out___n
call fcn.1400010b0
jmp 0x140004b1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, 0x1000
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
test rax, rax
jne 0x1400043c1
lea rcx, str.VirtualAlloc_Failed___PE_buffer_
call fcn.140001110
jmp 0x140004b1e
mov rbx, qword [rbp + 0xb8]
test rbx, rbx
je 0x140004b29
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r13
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140004401
lea rcx, str.Readmem_Failed___PE_buffer_
jmp 0x140004b08
mov eax, dword [str..text]
mov dword [rsp + 0x58], eax
movzx eax, word [0x1400088b8]
mov word [rsp + 0x5c], ax
xor eax, eax
mov word [rsp + 0x5e], ax
mov r9d, dword [r13 + 0x3c]
add r9, r13
mov rax, r9
lea rcx, [rbp + 0xa0]
mov edx, 2
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140004440
mov rax, qword [rax]
mov qword [rcx], rax
mov r8, qword [rbp + 0xa0]
cmp r8d, 0x4550
jne 0x140004b01
shr r8, 0x30
test r8d, r8d
je 0x140004506
mov r10d, r8d
mov rax, qword [rsp + 0x58]
nop dword [rax]
mov ecx, r8d
mov rdx, r10
sub rdx, rcx
lea rcx, [rdx + rdx*4]
movups xmm2, xmmword [r9 + rcx*8 + 0x108]
movups xmmword [rbp - 0x80], xmm2
movups xmm0, xmmword [r9 + rcx*8 + 0x118]
movups xmmword [rbp - 0x70], xmm0
movsd xmm1, qword [r9 + rcx*8 + 0x128]
movsd qword [rbp - 0x60], xmm1
movq rcx, xmm2
cmp rcx, rax
je 0x140004543
add r8d, 0xffffffff
jne 0x1400044c0
mov rsi, qword [rsp + 0x50]
mov r15d, dword [rsp + 0x7c]
mov edi, r15d
mov r9d, 4
mov r8d, 0x3000
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140004554
lea rcx, str.VirtualAlloc_Failed___Text_
call fcn.1400010b0
jmp 0x140004b1e
mov r15d, dword [rbp - 0x78]
mov rsi, qword [rbp - 0x78]
shr rsi, 0x20
add rsi, rbx
jmp 0x140004510
mov qword [rsp + 0x20], 0
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140004589
lea rcx, str.Readmem_Fail____text_
call fcn.1400010b0
mov rcx, rbx
jmp 0x140004b10
lea rcx, str.Searching_for_pattern..._n
call fcn.1400010b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x80]
call fcn.1400024e0
xor r11d, r11d
mov r10, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
sub r10, r9
sar r10, 2
cmp rdi, r10
je 0x1400046d5
xor edx, edx
test r10, r10
je 0x1400045f3
nop dword [rax]
mov r8d, dword [r9 + rdx*4]
lea rax, [rdx + r11]
movzx ecx, byte [rax + rbx]
cmp ecx, r8d
je 0x1400045eb
cmp r8d, 0xffffffff
jne 0x1400046c3
inc rdx
cmp rdx, r10
jb 0x1400045d0
lea rdi, [r11 + rbx]
test r9, r9
je 0x14000463c
mov rax, qword [rbp - 0x70]
sub rax, r9
sar rax, 2
lea rdx, [rax*4]
mov rax, r9
cmp rdx, 0x1000
jb 0x140004634
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000471a
mov rcx, r9
call fcn.1400064e8
test rdi, rdi
je 0x140004aed
movsxd rax, dword [rdi + 3]
add rdi, 9
add rdi, rax
mov eax, dword [rdi]
add eax, 4
cdqe
add rdi, rax
sub rdi, rbx
add rdi, rsi
mov rdx, rdi
lea rcx, str.FPS_Offset:__X_n
call fcn.1400010b0
mov r12, qword [rsp + 0x60]
test r15d, r15d
je 0x140004919
test rsi, rsi
je 0x140004919
test rdi, rdi
je 0x140004919
test r12, r12
je 0x140004919
mov edx, 0x1000
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140004721
lea rcx, str.Buffer_Alloc_Fail___n
jmp 0x140004914
inc r11
mov rax, rdi
sub rax, r10
cmp r11, rax
jb 0x1400045c6
test r9, r9
je 0x140004aed
mov rax, qword [rbp - 0x70]
sub rax, r9
sar rax, 2
lea rdx, [rax*4]
mov rax, r9
cmp rdx, 0x1000
jb 0x140004ae5
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ae5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [0x140008a60]
mov edx, 3
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140004730
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsi], eax
lea rax, [0x14000b048]
mov qword [rsi + 8], rax
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsi + 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsi + 0x18], rax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsi + 0x20], rax
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsi + 0x28], rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x30], rax
mov dword [rsi + 0xe4], 0x3e8
mov dword [rsi + 0xec], 0x3c
mov qword [rsi + 0x110], 0xb848
movabs rax, 0x741d8b0000
mov qword [rsi + 0x118], rax
movabs rax, 0xccccccccccc31889
mov qword [rsi + 0x120], rax
mov qword [rsi + 0x112], rdi
movabs rax, 0x5c76617e8834858
mov qword [rsi + 0x15c], rax
movabs rax, 0xe0ff21ebffffff16
mov qword [rsi + 0x164], rax
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x14000490d
mov qword [rsp + 0x20], 0
mov r9d, 0x1a0
mov r8, rsi
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400048ee
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r9, [r15 + 0x50]
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x1400048e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [r15 + 0x194]
test rsi, rsi
jne 0x140004927
jmp 0x14000491b
lea rcx, str.Create_InGame_SyncThread_Fail_
call fcn.140001110
jmp 0x14000491b
lea rcx, str.Inject_shellcode_Fail_
call fcn.140001110
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140004919
lea rcx, str.Alloc_shellcode_space_Fail_
call fcn.140001110
xor esi, esi
lea rcx, str.Inject_Patch_Fail__n_n
call fcn.140001110
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, str.Done_n_n
call fcn.1400010b0
lea rcx, [0x1400089a0]
call fcn.1400010b0
lea rcx, [0x1400089c0]
call fcn.1400010b0
lea rcx, [0x1400089d8]
call fcn.1400010b0
lea rcx, [0x1400089f0]
call fcn.1400010b0
lea rcx, [0x140008a08]
call fcn.1400010b0
xor r13d, r13d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x78]
lea r8, [0x1400039c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400049c2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x7c], 0x103
movabs r15, 0x7fffffff88ca6bff
movabs r12, 0x7fffffffffffffff
nop
lea rdx, [rsp + 0x7c]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140004a0e
imul rax, rax, 0x64
jmp 0x140004a29
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jge 0x140004a3b
add rax, 0x77359400
mov qword [rsp + 0x50], rax
jmp 0x140004a40
mov qword [rsp + 0x50], r12
lea rcx, [rsp + 0x50]
call fcn.140005c00
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rsp + 0x58]
mov rdx, rdi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x58]
cmp eax, 0xffffffff
je 0x140004ab8
cmp eax, dword [rsp + 0x78]
je 0x140004ab8
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rsp + 0x78]
mov rdx, rdi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rsp + 0x78]
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [rsp + 0x7c], 0x103
je 0x1400049e0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r14d, r13d
mov r12, qword [rbp - 0x38]
jmp 0x140004b2c
mov rcx, r9
call fcn.1400064e8
lea rcx, str.outdated_pattern_n
call fcn.1400010b0
xor r13d, r13d
mov r14d, r13d
jmp 0x140004b2c
lea rcx, str.Invalid_PE_header_
call fcn.140001110
mov rcx, r13
mov r8d, 0x8000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13d, r13d
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140004b6a
inc rdx
mov rax, r12
cmp rdx, 0x1000
jb 0x140004b62
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400064e8
mov rax, qword [rbp]
cmp rax, 0x10
jb 0x140004ba9
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ba4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ba4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400064e8
mov qword [rbp - 8], r13
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140004bf7
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bf2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400064e8
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140004c45
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400064e8
mov eax, r14d
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1400060c0
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001270
nop
call fcn.140001270
nop
call fcn.140005110
int3