Function at 0x403b10
Capabilities:
Enumerate processes
Get system information on windows
Read file on windows
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x2388
call fcn.00405160
mov eax, dword [0x408004]
xor eax, esp
mov dword [esp + 0x2384], eax
push esi
push edi
push 0x46
lea eax, [esp + 0x20cc]
mov dword [esp + 0x206c], 0
push 0
push eax
mov dword [esp + 0x2078], 0
mov dword [esp + 0x207c], 0
mov dword [esp + 0x2080], 0
mov dword [esp + 0x2084], 0
mov dword [esp + 0x2088], 0
mov dword [esp + 0x208c], 0
mov dword [esp + 0x2090], 0
mov dword [esp + 0x2094], 0
mov dword [esp + 0x2098], 0
mov dword [esp + 0x209c], 0
mov dword [esp + 0x20a0], 0
mov dword [esp + 0x20a4], 0
mov dword [esp + 0x20a8], 0
mov dword [esp + 0x20ac], 0
mov dword [esp + 0x20b0], 0
mov dword [esp + 0x20b4], 0
mov dword [esp + 0x20b8], 0
mov dword [esp + 0x20bc], 0
mov dword [esp + 0x20c0], 0
mov dword [esp + 0x20c4], 0
mov dword [esp + 0x20c8], 0
mov dword [esp + 0x20cc], 0
mov dword [esp + 0x20d0], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x210e], 0
mov dword [esp + 0x2112], 0
mov word [esp + 0x2116], 0
mov byte [esp + 0x2118], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x403ce7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WARNING:_error_using_GetModuleHandle_to_find_ntdll.dll:__d_nAmnesia_wont_be_suspended_during_code_injection_n
call fcn.00401010
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x228
lea eax, [esp + 0x2160]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x2158], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403d3c
call esi
push eax
push str.error_when_using_CreateToolhelp32Snapshot:__d_n
call fcn.00401010
add esp, 8
jmp 0x403e37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSuspendProcess
push esi
call edi
test eax, eax
jne 0x403d11
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.WARNING:_error_using_GetProcAddress_to_find_NtSuspendProcess:__d_nAmnesia_wont_be_suspended_during_code_injection_n
call fcn.00401010
add esp, 8
jmp 0x403c9f
push str.NtResumeProcess
push esi
call edi
test eax, eax
jne 0x403c99
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.WARNING:_error_using_GetProcAddress_to_find_NtResumeProcess:__d_nAmnesia_wont_be_suspended_during_code_injection_n
call fcn.00401010
add esp, 8
jmp 0x403c9f
lea eax, [esp + 0x2158]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x403d70
call esi
push eax
push str.error_when_using_Process32First:__d_n
call fcn.00401010
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403e2a
mov ecx, str.Amnesia.exe
lea eax, [esp + 0x217c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403da6
test dx, dx
je 0x403da2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403da6
add eax, 4
add ecx, 4
test dx, dx
jne 0x403d80
xor esi, esi
jmp 0x403dab
sbb esi, esi
or esi, 1
test esi, esi
je 0x403e0f
mov ecx, str.Amnesia_NoSteam.exe
lea eax, [esp + 0x217c]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403de6
test dx, dx
je 0x403de2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403de6
add eax, 4
add ecx, 4
test dx, dx
jne 0x403dc0
xor eax, eax
jmp 0x403deb
sbb eax, eax
or eax, 1
test eax, eax
je 0x403e0f
lea eax, [esp + 0x2158]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x403d70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403e2a
mov eax, dword [esp + 0x2160]
push edi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x28]
cmp edi, 0xffffffff
jne 0x403e68
push str.couldnt_find_amnesia_process_PID_n
call fcn.00401010
add esp, 4
push str.couldnt_inject_Amnesia_n
push str._sPress_Enter_to_exit_n
call fcn.00401010
add esp, 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x2384]
xor ecx, esp
call fcn.004044d2
mov esp, ebp
pop ebp
ret
mov ecx, str.Amnesia_NoSteam.exe
test esi, esi
mov eax, str.Amnesia.exe
cmovne eax, ecx
push 0x1014
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1054]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esp + 0x1050]
push dword [esp + 0x24]
push edi
call fcn.00401050
cmp dword [esp + 0x105c], 0
je 0x403fd1
lea eax, [esp + 0x30]
mov byte [esp + 0x12], 0
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x17], 0
push eax
lea eax, [esp + 0x17]
mov byte [esp + 0x19], 0
push eax
lea eax, [esp + 0x1d]
mov byte [esp + 0x1b], 0
xorps xmm0, xmm0
mov byte [esp + 0x1c], 0
push eax
lea edx, [esp + 0x23]
movsd qword [esp + 0x40], xmm0
lea ecx, [esp + 0x22]
call fcn.00401560
add esp, 0x10
test al, al
je 0x403fd1
cmp byte [esp + 0xf], 0
mov al, byte [esp + 0x12]
mov byte [esp + 0x20c8], al
je 0x403fa5
push str.checking_for_updates._to_skip_this__change_the__check_for_tool_updates__setting_to__y_._n
call fcn.00401010
add esp, 4
mov dword [esp + 0x18], 0
lea eax, [esp + 0xf]
mov dword [esp + 0x1c], 0
lea edx, [esp + 0x1c]
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x18]
mov byte [esp + 0xf], 0
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00401b80
add esp, 8
test al, al
jne 0x403f6a
push str.couldnt_determine_if_this_version_of_the_tool_is_the_most_recent_version_n
call fcn.00401010
add esp, 4
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x403f7b
push eax
call edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403f86
push eax
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403f91
push eax
call edi
cmp byte [esp + 0xf], 0
je 0x403fbd
push str.this_is_the_most_recent_version_of_this_tool_n
call fcn.00401010
add esp, 4
mov ecx, dword [esp + 0x1058]
test esi, esi
je 0x404016
cmp ecx, 0x62b000
jne 0x40401e
jmp 0x40404a
cmp byte [esp + 0x10], 0
jne 0x403fa5
push str.to_use_this_tool_when_it_isnt__or_might_not_be__the_most_recent_version__change_the__allow_not_fully_updated_tool__setting_to__y__n
call fcn.00401010
add esp, 4
push str.couldnt_inject_Amnesia_n
push str._sPress_Enter_to_exit_n
call fcn.00401010
add esp, 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov esi, 1
mov eax, dword [esp + 0x1050]
test eax, eax
je 0x404000
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004044d2
mov esp, ebp
pop ebp
ret
cmp ecx, 0x62e000
je 0x40404a
cmp byte [esp + 0x11], 0
mov edx, str._nto_use_this_tool_with_other_versions_of_Amnesia__change_the__allow_unexpected_game_versions__setting_to__y_.
mov eax, 0x406dd4
cmove eax, edx
push eax
push ecx
push dword [esp + 0x2c]
push str.WARNING:__lss_.text_segment_is__u_bytes__but_this_tool_was_made_for_versions_which_are_6467584_bytes_and_6479872_bytes._nthis_tool_might_not_work_correctly_with_other_versions_of_the_game._s_n
call fcn.00401010
add esp, 0x10
cmp byte [esp + 0x11], 0
je 0x403fd1
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push 0x140
mov dword [esp + 0x20cd], eax
lea eax, [esp + 0x215c]
push 0
push eax
mov dword [esp + 0x20d9], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x2158]
lea edx, [esp + 0x1c]
push eax
push ecx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
call fcn.00401d20
add esp, 0xc
test al, al
je 0x403fd1
xor edi, edi
mov dword [esp + 0x14], 0
cmp byte [esp + 0x13], 0
mov byte [esp + 0xf], 0
je 0x40422e
push 0x1000
lea eax, [esp + 0x50]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x40], edi
lea eax, [esp + 0x48]
mov dword [esp + 0x44], edi
push 0x1004
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x40]
push 0x406190
push str.maps_and_delays.txt
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x40411f
cmp dword [esp + 0x40], edi
jne 0x40413b
push str.maps_and_delays.txt
push str.FileHelper_couldnt_open__s_n
call fcn.00401010
add esp, 8
cmp dword [esp + 0x40], edi
je 0x403fd1
mov edx, dword [esp + 0x48]
xor esi, esi
mov ecx, dword [esp + 0x44]
cmp ecx, edx
jne 0x40417c
push dword [esp + 0x40]
lea eax, [esp + 0x50]
mov dword [esp + 0x48], 0
push 0x1000
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, eax
add esp, 0x10
mov dword [esp + 0x48], edx
test edx, edx
je 0x404208
mov ecx, dword [esp + 0x44]
mov al, byte [esp + ecx + 0x4c]
inc ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x44], ecx
cmp al, 0xd
je 0x404145
cmp al, 0x2f
je 0x404198
cmp al, 0xa
je 0x404198
inc esi
jmp 0x404145
cmp edi, esi
mov eax, esi
cmovae eax, edi
cmp byte [esp + 0x10], 0x2f
mov edi, eax
je 0x4041ac
test esi, esi
jne 0x4041b1
mov byte [esp + 0xf], 1
xor eax, eax
test esi, esi
setne al
add dword [esp + 0x14], eax
xor esi, esi
mov al, byte [esp + 0x10]
cmp al, 0xa
je 0x404145
cmp ecx, edx
jne 0x4041fd
push dword [esp + 0x40]
lea eax, [esp + 0x50]
mov dword [esp + 0x48], esi
push 0x1000
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, dword [esp + 0x54]
mov edx, eax
add esp, 0x10
mov dword [esp + 0x48], edx
test edx, edx
je 0x404145
mov al, byte [esp + ecx + 0x4c]
inc ecx
mov dword [esp + 0x44], ecx
jmp 0x4041c2
cmp edi, esi
mov eax, esi
cmovae eax, edi
mov edi, eax
xor eax, eax
test esi, esi
setne al
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
test eax, eax
je 0x40422e
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea edx, [esp + 0x1050]
lea ecx, [esp + 0x2068]
call fcn.00401fd0
test al, al
je 0x403fd1
mov esi, dword [esp + 0x20]
xor eax, eax
cmp byte [esp + 0x12], al
mov ecx, 9
cmove eax, ecx
lea ecx, [esi + 1]
add ecx, eax
mov eax, ecx
and al, 0xf
movzx edx, al
neg edx
sbb edx, edx
and ecx, 0xfffffff0
and edx, 0x10
add edx, ecx
mov ecx, dword [esp + 0x1c]
sub ecx, esi
mov dword [esp + 0x38], edx
inc ecx
mov eax, ecx
and al, 0xf
movzx eax, al
neg eax
sbb eax, eax
and ecx, 0xfffffff0
and eax, 0x10
xor esi, esi
add eax, ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], eax
imul eax, dword [esp + 0x18]
add eax, edx
cmp byte [esp + 0x13], 0
mov dword [esp + 0x28], eax
je 0x4042ce
lea ecx, [edi + 5]
mov eax, ecx
and al, 0xf
movzx esi, al
neg esi
sbb esi, esi
and ecx, 0xfffffff0
and esi, 0x10
add esi, ecx
mov eax, esi
imul eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
xorps xmm0, xmm0
mov dword [esp + 0x2140], 0
lea eax, [esp + 0x2120]
movaps xmmword [esp + 0x2120], xmm0
push eax
movaps xmmword [esp + 0x2134], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov eax, 0x200
mov dword [esp + 0x2098], ecx
div dword [esp + 0x2124]
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x209c], ecx
test edx, edx
mov ecx, dword [esp + 0x20]
cmovne eax, dword [esp + 0x2124]
mov dword [esp + 0x20a0], ecx
sub eax, edx
mov ecx, dword [esp + 0x14]
add eax, 0x200
mov edx, dword [esp + 0x28]
mov dword [esp + 0x20a4], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20b0], ecx
mov ecx, dword [esp + 0x3c]
push 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x20b8], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20c8], eax
add eax, ecx
add eax, dword [esp + 0x2c]
push 0x3000
push eax
push 0
push dword [esp + 0x1060]
mov dword [esp + 0x20cc], edx
mov dl, byte [esp + 0x23]
mov dword [esp + 0x20bc], edi
mov dword [esp + 0x20d0], esi
mov dword [esp + 0x20d4], ecx
mov byte [esp + 0x212c], dl
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x4043d4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.error_when_using_VirtualAllocEx:__d_n
call fcn.00401010
add esp, 8
jmp 0x403fee
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x2068]
add eax, esi
mov dword [esp + 0x2090], esi
mov dword [esp + 0x2094], eax
lea ecx, [esp + 0x1050]
mov dword [esp + 0x1054], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x215c]
mov byte [esp + 0x14], 0
push eax
mov dword [esp + 0x1068], 0
call fcn.004034c0
add esp, 8
test al, al
jne 0x4044b3
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push 0x8000
push 0
push esi
push dword [esp + 0x105c]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x404460
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WARNING:_error_when_using_VirtualFreeEx:__d_ncouldnt_release_VirtualAllocEx_memory_n
call fcn.00401010
add esp, 8
cmp byte [esp + 0x10], 0
je 0x403fd1
push edi
push dword [esp + 0x1054]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40449d
mov esi, dword [esp + 0x24]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.WARNING:_error_when_using_TerminateProcess_to_close__ls:__d_nCouldnt_close__ls._This_session_of__ls_may_crash._n
call fcn.00401010
add esp, 0x14
jmp 0x403fd1
push dword [esp + 0x24]
push str._ls_closed_to_prevent_it_from_crashing_n
call fcn.00401010
add esp, 8
jmp 0x403fd1
push str.Amnesia_successfully_injected_n
push str._sPress_Enter_to_exit_n
call fcn.00401010
add esp, 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor esi, esi
jmp 0x403fee