Function at 0x14000fc40
Capabilities:
Acquire debug privileges

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov esi, ecx
mov rbx, rdx
call fcn.140001f00
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
cmp esi, 5
je 0x14000fca9
mov rdx, qword [rbx]
lea rcx, str.Usage:__s__process_name___module_name___old_opcodes___new_opcodes__n
call fcn.140001620
mov rdx, qword [rbx]
lea rcx, str.Exmample_1:__s_notepad.exe_notepad.exe__7503___9090__n
call fcn.140001620
mov rdx, qword [rbx]
lea rcx, str.Exmample_2:__s_notepad.exe_comctl32.dll__7503___9090__n
call fcn.140001620
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, qword [rbx + 8]
mov rdi, qword [rbx + 0x10]
mov rbp, qword [rbx + 0x18]
mov r12, qword [rbx + 0x20]
call fcn.140001970
mov esi, eax
test eax, eax
je 0x14000fe6a
mov edx, eax
lea rcx, str.Found_process_id__d_n
call fcn.140001620
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x48]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000fd29
mov rcx, qword [rsp + 0x48]
mov r8d, 1
lea rdx, str.SeDebugPrivilege
call fcn.1400018e0
test eax, eax
je 0x14000fe8c
lea rcx, str.SetPrivilege_ok_n
call fcn.140001620
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000fe9a
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
je 0x14000fe7e
lea rcx, str.Attached_as_debugger_n
call fcn.140001620
mov r9d, 0x18
xor edx, edx
mov rcx, rbx
lea r8, [rsp + 0x50]
call sub.KERNEL32.dll_K32GetModuleInformation
mov edx, dword [rsp + 0x58]
lea rcx, str.Module_size:__d_n
call fcn.140001620
mov rcx, rbx
call fcn.1400016a0
mov rdx, rdi
lea r9, [rsp + 0x40]
mov rcx, rbx
lea r8, [rsp + 0x38]
call fcn.140001a40
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14000fdbb
mov r13, qword [rsp + 0x40]
test r13, r13
jne 0x14000fe47
lea rcx, str.Unable_to_find_the_code_section_n
call fcn.140001620
lea rcx, str.Replacing_opcodes.._n
call fcn.140001620
mov qword [rsp + 0x20], r12
mov r9, rbp
mov rdx, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140001ba0
test eax, eax
jle 0x14000fe39
mov edx, eax
lea rcx, str.COMPLETED__occurrences_found:__d__n
call fcn.140001620
mov rcx, rbx
call fcn.1400017c0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
test eax, eax
je 0x14000fe2b
lea rcx, str.Detached_from_process_n
call fcn.140001620
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000fc9a
lea rcx, str.Error:_cannot_detach_from_process_n
call fcn.140001620
jmp 0x14000fe1d
lea rcx, str.NO_OCCURRENCE_FOUND_n
call fcn.140001620
jmp 0x14000fdfd
mov rdx, rdi
lea rcx, str.Code_section_address:__016llX_n
call fcn.140001620
mov rdx, r13
lea rcx, str.Code_section_size:__lld_n
call fcn.140001620
jmp 0x14000fdc7
lea rcx, str.Invalid_process_name_n
call fcn.140001620
or eax, 0xffffffff
jmp 0x14000fc9c
lea rcx, str.Error:_cannot_attach_as_debugger_to_the_process_n
call fcn.140001620
jmp 0x14000fe76
lea rcx, str.Failed_to_SetPrivilege_n
call fcn.140001620
jmp 0x14000fe76
lea rcx, str.Unable_to_open_the_process_n
call fcn.140001620
jmp 0x14000fe76