Function at 0x14003aa4a
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
jmp 0x140067c90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xbe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x4e8]
mov rax, qword [0x1400d8080]
xor rax, rbp
mov qword [rbp + 0x460], rax
lea rcx, [0x1400e8391]
call fcn.14003b738
nop
lea rcx, [rbp + 0x10]
call fcn.14003a43c
nop
call fcn.14003bb5c
movzx eax, al
test eax, eax
jne 0x140067d1e
lea rcx, str.Driver_Signature_Enforcement__DSE__is_enabled._Please_disable_it_before_proceeding._n
call fcn.14003a26b
nop
mov dword [rbp + 0x304], 0xffffffff
lea rcx, [rbp + 0x10]
call fcn.14003bb11
mov eax, dword [rbp + 0x304]
jmp 0x140068086
lea rcx, [rbp + 0x10]
call fcn.14003ae05
movzx eax, al
test eax, eax
jne 0x140067e48
lea rcx, str.Config_not_found_or_invalid._Creating_new_configuration._n
call fcn.14003a26b
nop
lea r8, [0x1400c6798]
lea rdx, str.Executable_Files
lea rcx, [rbp + 0x328]
call fcn.14003a423
mov qword [rbp + 0x458], rax
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp + 0x10]
call fcn.140039a5a
lea rcx, [rbp + 0x328]
call fcn.140039726
nop
lea rcx, [rbp + 0x10]
call fcn.1400398de
movzx eax, al
test eax, eax
je 0x140067db8
lea rcx, str.No_valid_game_path_selected._Exiting._n
call fcn.14003a26b
nop
mov dword [rbp + 0x364], 0xffffffff
lea rcx, [rbp + 0x10]
call fcn.14003bb11
mov eax, dword [rbp + 0x364]
jmp 0x140068086
lea r8, [0x1400c6800]
lea rdx, str.DLL_Files
lea rcx, [rbp + 0x388]
call fcn.14003a423
mov qword [rbp + 0x458], rax
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp + 0x38]
call fcn.140039a5a
lea rcx, [rbp + 0x388]
call fcn.140039726
nop
lea rcx, [rbp + 0x38]
call fcn.1400398de
movzx eax, al
test eax, eax
je 0x140067e31
lea rcx, str.No_valid_DLL_path_selected._Exiting._n
call fcn.14003a26b
nop
mov dword [rbp + 0x3c4], 0xffffffff
lea rcx, [rbp + 0x10]
call fcn.14003bb11
mov eax, dword [rbp + 0x3c4]
jmp 0x140068086
lea rcx, [rbp + 0x10]
call fcn.14003ab85
nop
lea rcx, str.New_configuration_created_and_saved._n
call fcn.14003a26b
nop
lea rax, [rbp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0x108]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rbp + 0x80], 0x68
lea rcx, [rbp + 0x10]
call fcn.14003939d
lea rcx, [rbp + 0x108]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140067f03
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_game_process._Error:__lu_n
call fcn.14003a26b
nop
mov dword [rbp + 0x3e4], 0xffffffff
lea rcx, [rbp + 0x10]
call fcn.14003bb11
mov eax, dword [rbp + 0x3e4]
jmp 0x140068086
lea rcx, [rbp + 0x38]
call fcn.14003939d
mov rdx, rax
mov rcx, qword [rbp + 0x108]
call fcn.140039686
test eax, eax
jne 0x140067f76
lea rcx, str.DLL_injection_failed._n
call fcn.14003a26b
nop
xor edx, edx
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x404], 0xffffffff
lea rcx, [rbp + 0x10]
call fcn.14003bb11
mov eax, dword [rbp + 0x404]
jmp 0x140068086
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
lea rax, str.C:path_toHoYoKProtectBypass.sys
mov qword [rbp + 0x138], rax
mov rcx, qword [rbp + 0x138]
call fcn.14003bb61
movzx eax, al
test eax, eax
jne 0x140067ffc
lea rcx, str.Failed_to_load_HoYoKProtect_bypass_driver._Exiting._n
call fcn.14003a26b
nop
xor edx, edx
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x424], 0xffffffff
lea rcx, [rbp + 0x10]
call fcn.14003bb11
mov eax, dword [rbp + 0x424]
jmp 0x140068086
lea r8, [rbp + 0x118]
lea rdx, [0x14003acd9]
lea rcx, [rbp + 0x158]
call fcn.14003ae50
nop
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rcx, [rbp + 0x158]
call fcn.14003901e
nop
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, str.Game_closed._Monitoring_thread_terminated._n
call fcn.14003a26b
nop
mov dword [rbp + 0x444], 0
lea rcx, [rbp + 0x158]
call fcn.14003a194
nop
lea rcx, [rbp + 0x10]
call fcn.14003bb11
mov eax, dword [rbp + 0x444]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1400c65e0]
call fcn.14003b07b
mov rax, rdi
mov rcx, qword [rbp + 0x460]
xor rcx, rbp
call fcn.14003a2de
lea rsp, [rbp + 0x478]
pop rdi
pop rbp
ret