Function at 0x140001000
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x7f0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x7e0], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
jne 0x140001054
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_obtaining_console_handle.
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001500]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001150
mov edx, 6
mov qword [rsp + 0x800], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [rsp + 0x490], 0x238
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001125
lea rdx, [rsp + 0x490]
mov qword [rsp + 0x808], rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001114
xor ebp, ebp
nop dword [rax]
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x6d0]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x4bc]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rsp + 0x6d0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rbx
test eax, eax
je 0x14000116e
lea rdx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400010b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x808]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_attach_Minecraft.Windows.exe_process.
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001500]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0x800]
mov eax, 1
mov rcx, qword [rsp + 0x7e0]
xor rcx, rsp
call fcn.1400015c0
add rsp, 0x7f0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x498], ebp
je 0x14000111d
mov edx, dword [rsp + 0x498]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [rsp + 0x40], 0x438
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400011a8
mov rdi, rbp
jmp 0x14000122c
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000121e
nop word [rax + rax]
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x6d0]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov dword [rsp + 0x28], 0xff
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rsp + 0x6d0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000121e
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400011c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x498]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Detection_begins_for_version_1.20.80.
mov rbx, rax
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001500]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.This_program_will_look_at_the_games_memory_to_identify_a_potential_reach.
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001500]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop word [rax + rax]
mov r9d, 2
mov word [rsp + 0x480], bp
lea r8, [rsp + 0x480]
mov qword [rsp + 0x20], rbp
lea rdx, [rdi + 0x5cd818]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rsp + 0x480], 0x74
jne 0x1400012cf
cmp byte [rsp + 0x481], 0xb
je 0x140001290
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Memory_modification__use_of_reach_detected.
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001500]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Cheater_detected.
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001500]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140001320