Function at 0x1400212c1
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
jmp 0x140034840
push rbp
push rdi
sub rsp, 0x3c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140073040]
xor rax, rbp
mov qword [rbp + 0x398], rax
lea rcx, [0x14007c0fb]
call fcn.140021ba9
nop
lea rdx, str.vgc.exe
lea rcx, [rbp + 0x368]
call fcn.1400213ed
nop
lea rcx, [rbp + 0x368]
call fcn.140021596
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x368]
call fcn.140021a73
nop
cmp dword [rbp + 4], 0
je 0x140034c53
mov r8d, dword [rbp + 4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14003491a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x394], eax
lea rdx, str._nFailed_to_open_process_with_error:__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14002116d
mov ecx, dword [rbp + 0x394]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140021087]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140034c77
xor edx, edx
mov ecx, 4
call fcn.140021582
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
je 0x140034c22
mov dword [rbp + 0x68], 0x1c
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call fcn.14002177b
test eax, eax
je 0x140034c15
mov edx, 0x20
lea rcx, [rbp + 0xa8]
call fcn.1400211ef
lea rcx, [rbp + 0xa8]
call fcn.140021c4e
nop
mov edx, 0x20
lea rcx, [rbp + 0xe8]
call fcn.14002114f
lea rcx, [rbp + 0xe8]
call fcn.140021032
nop
mov edx, 0x20
lea rcx, [rbp + 0x128]
call fcn.1400213d4
lea rcx, [rbp + 0x128]
call fcn.1400210f0
nop
mov eax, dword [rbp + 4]
cmp dword [rbp + 0x74], eax
jne 0x140034a85
mov r8d, dword [rbp + 0x70]
xor edx, edx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
je 0x140034a61
mov qword [rbp + 0x188], 0
lea rdx, [rbp + 0x188]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
test eax, eax
je 0x140034a3b
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0xa8]
call fcn.140021c6c
nop
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0xe8]
call fcn.140021951
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x128]
call fcn.14002155f
nop
jmp 0x140034a5f
lea rdx, str._n_Failed_to_query_cycle_time_for_thread._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140021613
lea rdx, [0x1400215c3]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x140034a85
lea rdx, str._nFailed_to_open_thread.__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140021613
lea rdx, [0x1400215c3]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call fcn.140021181
test eax, eax
jne 0x1400349ab
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov qword [rbp + 0x1a8], 0
jmp 0x140034ac4
mov rax, qword [rbp + 0x1a8]
inc rax
mov qword [rbp + 0x1a8], rax
lea rcx, [rbp + 0xa8]
call fcn.140021ae1
cmp qword [rbp + 0x1a8], rax
jae 0x140034bee
mov qword [rbp + 0x1c8], 0
mov rdx, qword [rbp + 0x1a8]
lea rcx, [rbp + 0xa8]
call fcn.14002117c
lea rdx, [rbp + 0x1c8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
test eax, eax
je 0x140034bc5
mov rdx, qword [rbp + 0x1a8]
lea rcx, [rbp + 0xe8]
call fcn.140021bbd
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1c8]
sub rcx, rax
mov rax, rcx
test rax, rax
jne 0x140034ba6
mov rdx, qword [rbp + 0x1a8]
lea rcx, [rbp + 0xa8]
call fcn.14002117c
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x140034b82
lea rdx, str._n_Emulating_Vanguard..._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140021613
lea rdx, [0x1400215c3]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x140034ba6
lea rdx, str._n_Failed_to_emulate._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140021613
lea rdx, [0x1400215c3]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x1a8]
lea rcx, [rbp + 0xa8]
call fcn.14002117c
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140034be9
lea rdx, str._n_Failed_to_query_final_cycle_time_for_thread._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140021613
lea rdx, [0x1400215c3]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x140034ab3
lea rcx, [rbp + 0x128]
call fcn.14002140b
nop
lea rcx, [rbp + 0xe8]
call fcn.1400215be
nop
lea rcx, [rbp + 0xa8]
call fcn.140021393
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140034c46
lea rdx, str._n_Failed_to_create_thread_snapshot._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140021613
lea rdx, [0x1400215c3]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140034c77
lea rdx, str._n_Could_not_find_process:_vgc.exe_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140021613
lea rdx, [0x1400215c3]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14006aa40]
call fcn.140021a1e
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.1400215af
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret