Function at 0x140001b64
Capabilities:
Create thread
Inject thread

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x4c0
lea rbp, [rsp + 0x80]
call fcn.14000c1f7
call fcn.1400017a9
lea rax, [rbp + 0x25f]
mov rcx, rax
call fcn.140071800
lea rdx, [rbp + 0x25f]
lea rax, [rbp + 0x230]
mov r8, rdx
lea rdx, str.Starfield.exe
mov rcx, rax
call fcn.1400b9c40
lea rax, [rbp + 0x25f]
mov rcx, rax
call fcn.140071830
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.14007e870
lea rdx, [rbp + 0x230]
lea rax, [rbp + 0x290]
mov r8d, 2
mov rcx, rax
call fcn.140089030
lea rax, [rbp + 0x260]
lea rcx, [rbp + 0x290]
lea rdx, [rbp + 0x200]
mov r8, rcx
mov rcx, rax
call fcn.14008a6e0
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.140028a90
lea rax, [rbp + 0x260]
mov rcx, rax
call fcn.1400890c0
lea rax, [rbp + 0x290]
mov rcx, rax
call fcn.1400890c0
lea rax, str.Starfield.exe
mov qword [rbp + 0x428], rax
lea rax, [rbp + 0x2bd]
mov rcx, rax
call fcn.140071800
lea rdx, [rbp + 0x2bd]
lea rax, [rbp + 0x1c0]
mov r8, rdx
lea rdx, str.Starfield
mov rcx, rax
call fcn.1400b9c40
lea rax, [rbp + 0x2bd]
mov rcx, rax
call fcn.140071830
lea rax, [rbp + 0x2be]
mov rcx, rax
call fcn.140071860
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.1400b7780
mov rsi, rax
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.1400b7950
mov rdx, rax
lea rcx, [rbp + 0x2be]
lea rax, [rbp + 0x1a0]
mov r9, rcx
mov r8, rsi
mov rcx, rax
call fcn.1400bdc60
lea rax, [rbp + 0x2be]
mov rcx, rax
call fcn.140071890
lea rax, [rbp + 0x1a0]
mov rdx, rax
mov rax, qword [0x1400d9820]
mov rcx, rax
call fcn.1400cc440
mov rcx, rax
lea rax, str._Script_Hook___By_ACCESS_DENIIED_n
mov rdx, rax
call fcn.1400cc140
mov rcx, rax
mov rax, qword [0x1400d97e0]
mov rdx, rax
call fcn.1400a3be0
mov rax, qword [rbp + 0x428]
mov rcx, rax
call fcn.1400016eb
mov dword [rbp + 0x43c], eax
lea rax, [rbp + 0x2bf]
mov rcx, rax
call fcn.140071800
lea rdx, [rbp + 0x2bf]
lea rax, [rbp + 0x180]
mov r8, rdx
lea rdx, str.scripts
mov rcx, rax
call fcn.1400b9c40
lea rax, [rbp + 0x2bf]
mov rcx, rax
call fcn.140071830
lea rdx, [rbp + 0x180]
lea rax, [rbp + 0x2c0]
mov r8d, 2
mov rcx, rax
call fcn.140089030
lea rax, [rbp + 0x150]
lea rcx, [rbp + 0x2c0]
lea rdx, [rbp + 0x200]
mov r8, rcx
mov rcx, rax
call fcn.14008a6e0
lea rax, [rbp + 0x2c0]
mov rcx, rax
call fcn.1400890c0
cmp dword [rbp + 0x43c], 0
jne 0x140001f52
lea rax, str.Game_process_not_found._Attempting_to_start_the_game...
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
lea rax, [rbp + 0x320]
mov r8d, 2
lea rdx, str.Starfield.exe
mov rcx, rax
call fcn.140088fa0
lea rax, [rbp + 0x2f0]
lea rcx, [rbp + 0x320]
lea rdx, [rbp + 0x200]
mov r8, rcx
mov rcx, rax
call fcn.14008a6e0
lea rax, [rbp - 0x20]
lea rdx, [rbp + 0x2f0]
mov rcx, rax
call fcn.140028a90
lea rax, [rbp + 0x2f0]
mov rcx, rax
call fcn.1400890c0
lea rax, [rbp + 0x320]
mov rcx, rax
call fcn.1400890c0
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14000186f
xor eax, 1
test al, al
je 0x140001ec0
lea rax, str.Game_failed_to_start._Exiting...
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
mov rax, qword [str._6_r_]
mov rcx, rax
call fcn.140076280
mov ebx, 1
mov esi, 0
jmp 0x140001f3d
mov dword [rbp + 0x35c], 5
lea rdx, [rbp + 0x35c]
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.1400b2d80
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.14008f720
mov rax, qword [rbp + 0x428]
mov rcx, rax
call fcn.1400016eb
mov dword [rbp + 0x43c], eax
cmp dword [rbp + 0x43c], 0
je 0x140001f38
lea rax, str.Game_started_successfully._n
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
mov esi, 1
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400ba310
cmp esi, 1
jne 0x14000269a
cmp dword [rbp + 0x43c], 0
jne 0x140001f9f
lea rax, str.Game_process_not_found._Exiting...
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
mov rax, qword [str._6_r_]
mov rcx, rax
call fcn.140076280
mov ebx, 1
jmp 0x14000269a
mov dword [rbp + 0x438], 0
lea rdx, [rbp + 0x150]
lea rax, [rbp + 0x140]
mov rcx, rax
call fcn.1400842e0
lea rax, [rbp + 0x140]
mov qword [rbp + 0x420], rax
mov rdx, qword [rbp + 0x420]
lea rax, [rbp + 0x360]
mov rcx, rax
call fcn.140084320
lea rax, [rbp + 0x130]
lea rdx, [rbp + 0x360]
mov rcx, rax
call fcn.14008a570
lea rax, [rbp + 0x360]
mov rcx, rax
call fcn.140084820
mov rdx, qword [rbp + 0x420]
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.140084320
lea rax, [rbp + 0x120]
lea rdx, [rbp + 0x370]
mov rcx, rax
call fcn.1400859c0
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.140084820
jmp 0x140002114
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.140026da0
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp + 0x3f0]
mov rcx, rax
call fcn.140026d20
test al, al
je 0x140002105
add dword [rbp + 0x438], 1
mov rax, qword [rbp + 0x3f0]
mov rcx, rax
call fcn.140026d40
mov rdx, rax
lea rax, [rbp + 0x380]
mov rcx, rax
call fcn.140029710
lea rax, [rbp - 0x20]
lea rdx, [rbp + 0x380]
mov rcx, rax
call fcn.140028a90
lea rax, [rbp + 0x380]
mov rcx, rax
call fcn.1400890c0
lea rax, str.Detected:
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
lea rax, [rbp - 0x20]
mov rdx, rax
call fcn.1400cc0d0
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400ba310
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.140084840
lea rdx, [rbp + 0x120]
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.14008a790
test al, al
jne 0x140002048
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.140084820
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.140084820
lea rax, [rbp + 0x140]
mov rcx, rax
call fcn.140084820
cmp dword [rbp + 0x438], 0
jle 0x1400021f1
mov rax, qword [0x1400d97d0]
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.14007a530
mov rcx, rax
lea rax, str.Injecting
mov rdx, rax
call fcn.1400cbe60
mov rcx, rax
mov eax, dword [rbp + 0x438]
mov edx, eax
call fcn.14007a750
mov rcx, rax
lea rax, str._script_s__into
mov rdx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [rbp + 0x428]
mov rdx, rax
call fcn.1400cbe60
mov rcx, rax
lea rax, [0x1400d416a]
mov rdx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
jmp 0x14000221c
lea rax, str.No_scripts_found_in_the_scripts_folder.
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
mov eax, dword [rbp + 0x43c]
mov r8d, eax
mov edx, 0
mov ecx, 0x43a
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x418], rax
cmp qword [rbp + 0x418], 0
je 0x1400025e1
mov dword [rbp + 0x434], 0
lea rdx, [rbp + 0x150]
lea rax, [rbp + 0x110]
mov rcx, rax
call fcn.1400842e0
lea rax, [rbp + 0x110]
mov qword [rbp + 0x410], rax
mov rdx, qword [rbp + 0x410]
lea rax, [rbp + 0x3b0]
mov rcx, rax
call fcn.140084320
lea rax, [rbp + 0x100]
lea rdx, [rbp + 0x3b0]
mov rcx, rax
call fcn.14008a570
lea rax, [rbp + 0x3b0]
mov rcx, rax
call fcn.140084820
mov rdx, qword [rbp + 0x410]
lea rax, [rbp + 0x3c0]
mov rcx, rax
call fcn.140084320
lea rax, [rbp + 0xf0]
lea rdx, [rbp + 0x3c0]
mov rcx, rax
call fcn.1400859c0
lea rax, [rbp + 0x3c0]
mov rcx, rax
call fcn.140084820
jmp 0x1400024bc
lea rax, [rbp + 0x100]
mov rcx, rax
call fcn.140026da0
mov qword [rbp + 0x408], rax
mov rax, qword [rbp + 0x408]
mov rcx, rax
call fcn.140026d20
test al, al
je 0x1400024ad
mov rax, qword [rbp + 0x408]
mov rcx, rax
call fcn.140026d40
mov rdx, rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.140028a90
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.140034480
mov rdx, rax
lea rax, [rbp - 0x20]
mov r8, rdx
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_strcpy_s]
call rax
lea rax, [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x418]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x400], rax
cmp qword [rbp + 0x400], 0
je 0x1400024a1
lea rax, [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea r8, [rax + 1]
lea rcx, [rbp - 0x20]
mov rdx, qword [rbp + 0x400]
mov rax, qword [rbp + 0x418]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rax, qword [rbp + 0x418]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x400]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x3f8], rax
cmp qword [rbp + 0x3f8], 0
je 0x14000247b
mov rax, qword [rbp + 0x3f8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x3f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
add dword [rbp + 0x434], 1
mov rdx, qword [rbp + 0x400]
mov rax, qword [rbp + 0x418]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400ba310
lea rax, [rbp + 0x100]
mov rcx, rax
call fcn.140084840
lea rdx, [rbp + 0xf0]
lea rax, [rbp + 0x100]
mov rcx, rax
call fcn.14008a790
test al, al
jne 0x1400022f6
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.140084820
lea rax, [rbp + 0x100]
mov rcx, rax
call fcn.140084820
lea rax, [rbp + 0x110]
mov rcx, rax
call fcn.140084820
mov rax, qword [rbp + 0x418]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x434], 0
jle 0x140002572
lea rax, str.Injected
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov eax, dword [rbp + 0x434]
mov edx, eax
call fcn.14007a750
mov rcx, rax
lea rax, str._scripts_successfully._n
mov rdx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
jmp 0x1400025e1
lea rax, str.No_scripts_were_injected.
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
lea rax, str._nPress_any_key_to_exit.
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
mov rax, qword [str._6_r_]
mov rcx, rax
call fcn.140076280
mov ebx, 0
jmp 0x14000269a
lea rax, str.This_console_will_close_automatically_in_5_seconds...
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
mov dword [rbp + 0x3dc], 4
lea rdx, [rbp + 0x3dc]
lea rax, [rbp + 0x3d0]
mov rcx, rax
call fcn.1400b2d80
lea rax, [rbp + 0x3d0]
mov rcx, rax
call fcn.14008f720
lea rax, str.Exiting...
mov rdx, rax
mov rax, qword [0x1400d97c0]
mov rcx, rax
call fcn.1400cbe60
mov rcx, rax
mov rax, qword [0x1400d97d0]
mov rdx, rax
call fcn.14007a530
mov dword [rbp + 0x3ec], 1
lea rdx, [rbp + 0x3ec]
lea rax, [rbp + 0x3e0]
mov rcx, rax
call fcn.1400b2d80
lea rax, [rbp + 0x3e0]
mov rcx, rax
call fcn.14008f720
mov ebx, 0
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.1400890c0
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.1400ba310
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400be240
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.1400ba310
lea rax, [rbp + 0x1e0]
mov rcx, rax
call fcn.1400ba310
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.1400890c0
lea rax, [rbp + 0x230]
mov rcx, rax
call fcn.1400ba310
mov eax, ebx
jmp 0x140002912
add rsp, 0x4c0
pop rbx
pop rsi
pop rbp
ret