Function at 0x140001260
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
movabs rdi, 0x7fffffffc46535ff
movabs r12, 0xb2f4fc0794908cf3
movabs r13, 0x4e94914f0000
lea r14, str.RobloxPlayerBeta.exe
mov r15, 0xffffffffffffffff
movabs rbx, 0x7fffffffffffffff
movabs rsi, 0x431bde82d7b634db
lea rcx, [rsp + 0x40]
call fcn.140001180
mov rax, qword [rsp + 0x40]
cmp rax, rdi
lea rdi, [rax + 0x3b9aca00]
jl 0x1400012f6
mov rdi, rbx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140001317
imul rax, rcx, 0x64
jmp 0x140001386
cmp rbx, 0x16e3600
jne 0x14000136b
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x140001386
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x1400013d4
mov rcx, rdi
sub rcx, rax
cmp rcx, r13
jl 0x1400013a5
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1400012f6
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400013c8
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400012f6
xor esi, esi
mov dword [rbp - 0x80], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, r15
movabs rdi, 0x7fffffffc46535ff
je 0x1400012c4
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001458
lea rdx, [rbp - 0x54]
mov rax, r15
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r14 + rax*2 + 2]
jne 0x140001442
add rax, 2
cmp rax, 0x15
je 0x140001455
movzx ecx, word [rdx + rax*2]
cmp cx, word [r14 + rax*2]
je 0x140001420
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001411
jmp 0x140001458
mov esi, dword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
movabs rbx, 0x7fffffffffffffff
je 0x1400012ce
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x1400014c3
lea rdx, str.____Failed_to_open_process.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a40
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov eax, r15d
jmp 0x14000192d
lea rdx, str.___Opened_process:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.C:WindowsSystem32Wintrust.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
test rax, rax
jne 0x140001547
lea rdx, str.____Failed_to_load_Wintrust.dll.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a40
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
jmp 0x14000192d
lea rdx, str.WinVerifyTrust
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x140001568
lea rdx, str.____Failed_to_find_WinVerifyTrust.
jmp 0x14000150d
lea rdx, str.___WinVerifyTrust_address:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov rcx, rax
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov ecx, 6
call fcn.140001ca0
mov rbx, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 6]
mov qword [rsp + 0x78], r15
xor eax, eax
mov dword [rbx], eax
mov word [rbx + 4], ax
mov qword [rsp + 0x70], r15
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0xb8
mov word [rsp + 0x34], 0xc300
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 6
call fcn.140001ca0
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r13, [rax + 6]
mov qword [rsp + 0x60], r13
mov r8d, 6
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x58], r13
sub r15, rbx
mov qword [rsp + 0x20], 0
mov r9, r15
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 6
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.___Hooked_function_at:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov rcx, rax
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Roblox
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x38], eax
xor edx, edx
mov r8d, 1
lea rcx, str.MainDLL.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400016c4
lea rdx, str.____Failed_to_load_MainDLL.dll
jmp 0x14000170f
lea rdx, str.callback
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400016e2
lea rdx, str.____Invalid_DLL_or_callback_not_found.
jmp 0x14000170f
mov r9d, dword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov rdx, rax
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140001798
lea rdx, str.____Failed_to_set_Windows_hook.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001a40
lea rdx, [0x140001c20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, r15
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.____Restored_function_at:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov rdx, r14
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140001c20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, 0xffffffffffffffff
jmp 0x1400018c5
lea rdx, str.___Windows_hook_set_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
lea rdx, str.___Press_enter_to_unhook
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea rdx, str.___Windows_hook_removed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, r15
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.____Restored_function_at:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov rcx, rax
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, str.___Done._Press_any_key_to_exit.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001a40
mov rcx, rax
lea rdx, [0x140001c20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor edi, edi
test rsi, rsi
je 0x1400018fa
sub r13, rsi
cmp r13, 0x1000
jb 0x1400018ee
add r13, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x14000195d
mov rsi, rcx
mov rdx, r13
mov rcx, rsi
call fcn.140001cdc
nop
test rbx, rbx
je 0x14000192b
cmp r15, 0x1000
jb 0x140001920
add r15, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140001964
mov rbx, rcx
mov rdx, r15
mov rcx, rbx
call fcn.140001cdc
mov eax, edi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140001c80
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3