Function at 0x1400014c0
Capabilities:
Check for time delay via queryperformancecounter
Enumerate process modules
Link many functions at runtime
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0xe50]
sub rsp, 0xf50
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0xe48], rax
xor r12d, r12d
mov rsi, r8
mov qword [rbp - 0x58], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x58]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rbx, qword [rbp - 0x58]
lea r8, [rbp + 0xdd0]
lea rdx, str.SeLockMemoryPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140001543
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LookupPrivilegeValue_error:__u_n
call fcn.140001260
jmp 0x1400015ba
mov rax, qword [rbp + 0xdd0]
lea r8, [rbp + 0xe00]
mov qword [rsp + 0x28], r12
mov r9d, 0x10
xor edx, edx
mov qword [rbp + 0xe04], rax
mov rcx, rbx
mov dword [rbp + 0xe00], 1
mov dword [rbp + 0xe0c], 2
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400015a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AdjustTokenPrivileges_error:__u_n
call fcn.140001260
jmp 0x1400015ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x1400015ba
lea rcx, str.The_token_does_not_have_the_specified_privilege.__n
call fcn.140001260
lea rcx, str.ntdll.dll
mov qword [rsp + 0xf88], r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x14000161b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_ntdll.dll_n
call fcn.140001010
xor eax, eax
mov r13, qword [rsp + 0xf88]
mov rcx, qword [rbp + 0xe48]
xor rcx, rsp
call fcn.140002e50
mov rbx, qword [rsp + 0xf98]
add rsp, 0xf50
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
lea rdx, str.NtQuerySystemInformation
mov qword [rsp + 0xf80], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtDuplicateObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
mov qword [0x140007700], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenSection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQuerySection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateSection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtMapViewOfSection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtUnMapViewOfSection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtUnlockVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtLockVirtualMemory
mov rcx, rbx
mov qword [0x140007708], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, eax
xor edx, edx
mov ebx, eax
call fcn.140002ce0
mov ecx, eax
mov r13, 0xffffffffffffffff
mov dword [0x140007714], eax
mov eax, 4
mul rcx
cmovo rax, r13
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, rax
mov qword [0x140007720], rax
mov ecx, ebx
call fcn.140002ce0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Opening_threads_n
call fcn.140001010
mov ecx, dword [0x140007714]
mov eax, 8
mul rcx
cmovo rax, r13
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x4d0
mov qword [0x140007718], rax
mov edi, r12d
call sub.VCRUNTIME140.dll_memset
cmp dword [0x140007714], r12d
jbe 0x1400017bf
nop dword [rax]
mov rax, qword [0x140007720]
xor edx, edx
mov ebx, edi
mov ecx, 0x1fffff
mov r8d, dword [rax + rbx*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rcx, qword [0x140007718]
inc edi
cmp edi, dword [0x140007714]
mov qword [rcx + rbx*8], rax
jb 0x140001790
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Getting_RobloxPlayer.dll_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, r13
jne 0x1400017fc
lea rdx, str.Failed_CreateToolhelp32Snapshot_n
jmp 0x1400018a8
lea rdx, [rbp + 0x4c0]
mov dword [rbp + 0x4c0], 0x438
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
mov rcx, rbx
test eax, eax
jne 0x14000182c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Failed_Module32First_n
jmp 0x1400018a8
lea rdx, [rbp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
je 0x140001898
lea rdi, str.RobloxPlayerBeta.dll
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x4f0]
mov rcx, r13
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rdi + rcx*2 + 2]
jne 0x140001884
add rcx, 2
cmp rcx, 0x15
je 0x140001938
movzx eax, word [rdx + rcx*2]
cmp ax, word [rdi + rcx*2]
je 0x140001860
lea rdx, [rbp + 0x4c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140001850
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Module_not_found_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001010
mov rbx, r13
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Game_RobloxPlayer.dll_module:
call fcn.140001010
mov rcx, rax
lea rdx, [0x140001470]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x1400026b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp rbx, r13
jne 0x14000194d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, str.Failed_to_find
call fcn.1400026f0
mov rcx, rax
call fcn.1400028d0
mov rcx, rax
lea rdx, [0x140002b40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdi, qword [rsp + 0xf80]
mov eax, 1
jmp 0x1400015ec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x4e8]
jmp 0x1400018b7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Finding_byfron_threads_n
call fcn.140001010
cmp dword [0x140007714], r12d
mov edi, r12d
mov qword [rsp + 0x78], r12
mov r15d, r12d
jbe 0x140001a40
nop dword [rax + rax]
mov rcx, qword [0x140007718]
lea r8, [rsp + 0x78]
mov r9d, 8
mov r14d, edi
mov qword [rsp + 0x20], r12
mov rcx, qword [rcx + r14*8]
lea edx, [r9 + 1]
call qword [0x140007700]
mov rax, qword [rsp + 0x78]
mov edx, r12d
sub rax, rbx
cmp rax, 0x7184d68
mov eax, r12d
setb dl
cmp qword [rsp + 0x78], rbx
setae al
test eax, edx
je 0x140001a32
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140001470]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000482c]
call fcn.140001010
mov rcx, rax
lea rdx, [0x140001450]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rax, qword [0x140007720]
mov edx, dword [rax + r14*4]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140004828]
call fcn.140001010
inc r15d
inc edi
cmp edi, dword [0x140007714]
jb 0x140001980
mov ecx, r15d
mov eax, 8
mul rcx
cmovo rax, r13
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
cmp dword [0x140007714], r12d
mov edi, r12d
mov r14, qword [0x140007718]
mov r15d, r12d
jbe 0x140001acd
nop
mov r9d, 8
mov r12d, edi
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], 0
mov rcx, qword [r14 + r12*8]
lea edx, [r9 + 1]
call qword [0x140007700]
mov rax, qword [rsp + 0x78]
xor edx, edx
mov r14, qword [0x140007718]
sub rax, rbx
cmp rax, 0x7184d68
setb dl
xor eax, eax
cmp qword [rsp + 0x78], rbx
setae al
test eax, edx
je 0x140001ac0
inc r15d
inc edi
cmp edi, dword [0x140007714]
jb 0x140001a70
xor r12d, r12d
xor edx, edx
lea rcx, [rbp + 0x900]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x20], 0x10001f
lea rdx, [rbp - 0x10]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [0x140007718]
lea rdx, [rbp + 0x900]
mov dword [rbp + 0x930], 0x10001f
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Thread:
call fcn.140001010
mov rcx, rax
lea rdx, [0x140001450]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rax, qword [0x140007720]
mov edx, dword [rax]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000482c]
call fcn.140001010
mov rcx, rax
lea rdx, [0x140001470]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbp + 0x88]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140004828]
call fcn.140001010
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Thread:
call fcn.140001010
mov rcx, rax
lea rdx, [0x140001450]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rax, qword [0x140007720]
mov edx, dword [rax + 0x20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000482c]
call fcn.140001010
mov rcx, rax
lea rdx, [0x140001470]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbp + 0x998]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140004828]
call fcn.140001010
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Finding_addr_n
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
call fcn.140001010
cmp qword [rsp + 0x38], 0
jne 0x140002290
nop word [rax + rax]
mov rcx, qword [0x140007718]
lea rdx, [rbp - 0x10]
mov dword [rbp + 0x20], 0x10001f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rsp + 0x38]
mov r14d, r12d
test rdx, rdx
jne 0x140002290
nop dword [rax]
mov rbx, qword [rbp + 0x88]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx - 0x3a8]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rbx - 0x3a8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xdd0]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xdd0], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea edi, [r14*8]
add rbx, rdi
lea r8, [rsp + 0x40]
mov rdx, rbx
mov r9d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xde8]
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x80]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xde8], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0xb8]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rbx + 0xb8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xdd8]
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xdd8], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x2b0]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rbx + 0x2b0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x48], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xe10], rax
mov r9d, 1
lea r8, [rbp + 0xe10]
lea rdx, [rbp - 0x48]
mov rcx, rsi
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x418]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rbx + 0x418]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xe38]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x38]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xe38], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rbx + 0x100]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xe28]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x28]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xe28], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x38]
mov rcx, rsi
lea rdx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xe18]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x18]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xe18], rax
call qword [0x140007708]
mov rbx, qword [rbp + 0x88]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0xd0]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rbx + 0xd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x20], rax
lea r8, [rbp + 0xe40]
mov rax, qword [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov r9d, 1
mov qword [rbp + 0xe40], rax
mov rcx, rsi
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
add rbx, rdi
mov r9d, 0x30
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xe20]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x30]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xe20], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x210]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rbx + 0x210]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xe30]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x40]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xe30], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x4a0]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rbx + 0x4a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp - 0x70]
mov qword [rbp + 0xde0], rax
lea rdx, [rbp + 0xde0]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp - 0x70], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x150]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
lea rdx, [rbx + 0x150]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp - 0x78]
mov qword [rbp + 0xdf0], rax
lea rdx, [rbp + 0xdf0]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp - 0x78], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp - 0x68]
mov qword [rbp + 0xdf8], rax
lea rdx, [rbp + 0xdf8]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp - 0x68], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x38]
mov rcx, rsi
lea rdx, [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp - 0x60]
mov qword [rbp + 0xe00], rax
lea rdx, [rbp + 0xe00]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp - 0x60], rax
call qword [0x140007708]
mov rdx, qword [rsp + 0x38]
inc r14d
cmp r14d, 0x64
mov ecx, r12d
mov eax, r12d
setb cl
test rdx, rdx
sete al
test eax, ecx
jne 0x140001c60
test rdx, rdx
je 0x140001c30
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140001470]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140004828]
call fcn.140001010
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Found_n
call fcn.140001010
movzx eax, byte [0x140007710]
nop dword [rax + rax]
cmp al, 1
je 0x1400022e0
mov eax, dword [0x140007714]
mov rbx, qword [0x140007718]
test eax, eax
je 0x14000230a
mov edi, eax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x1400022f7
mov rbx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov dword [rbp + 0xdd8], 0x42c60000
mov rcx, rsi
mov dword [rbp - 0x80], 0x42c80000
mov dword [rbp + 0xde8], 0
lea rdx, [rbx + 0x1b4]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 4
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xdd8]
mov rcx, rsi
lea rdx, [rbx + 0x1b4]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xe00]
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xe00], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x3a0]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 4
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xdd8]
mov rcx, rsi
lea rdx, [rbx + 0x3a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xdf8]
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x68]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xdf8], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x14c]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 4
mov qword [rsp + 0x20], r12
lea r8, [rbp - 0x80]
mov rcx, rsi
lea rdx, [rbx + 0x14c]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x48]
lea r8, [rbp + 0xdf0]
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x78]
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov rcx, rsi
mov qword [rbp + 0xdf0], rax
call qword [0x140007708]
mov rbx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, 0x30
mov rcx, rsi
lea rdx, [rbx + 0x138]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov r9d, 4
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0xde8]
mov rcx, rsi
lea rdx, [rbx + 0x138]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x70], rax
mov rax, qword [rsp + 0x58]
mov r9d, 1
mov qword [rbp + 0xde0], rax
lea r8, [rbp + 0xde0]
mov rcx, rsi
lea rdx, [rbp - 0x70]
call qword [0x140007708]
mov eax, dword [0x140007714]
mov rbx, qword [0x140007718]
test eax, eax
je 0x140002513
mov edi, eax
nop dword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x140002500
lea rcx, [rbp + 0xdd0]
mov qword [rbp + 0xdd0], r12
mov qword [rsp + 0x70], r12
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
sub rax, qword [rbp + 0xdd0]
cmp rax, 0x3e8
jae 0x1400022d4
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
sub rax, qword [rbp + 0xdd0]
cmp rax, 0x3e8
jb 0x140002550
jmp 0x1400022d4