Function at 0x14000266b
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rbx
sub rsp, 0x98
movabs rax, 0x6e6e7552776f6e53
movabs rdx, 0x6578652e7265
lea rsi, [rsp + 0x4e]
mov qword [rsp + 0x4e], rax
xor eax, eax
mov rcx, rsi
mov qword [rsp + 0x56], rdx
mov qword [rsp + 0x38], rax
call fcn.140002030
mov ebx, eax
test eax, eax
jne 0x1400026ea
lea rdx, str.Expeditions.exe
mov rcx, rsi
call sub.ucrtbase.dll_strcpy
mov rcx, rsi
call fcn.140002030
mov ebx, eax
test eax, eax
jne 0x1400026ea
lea rdx, str.SnowRunner.exe_or_Expeditions.exe
lea rcx, str.Process__s_not_found__n_n
call fcn.140004350
mov edx, 0x10
lea rcx, str.SnowRunner.exe_or_Expeditions.exe_not_found_in_memory__n_nPlease_launch_the_game_before_this_app.
jmp 0x14000273b
mov rdx, rsi
lea rcx, str.Process__s_found__n
call fcn.140004350
mov edx, ebx
lea rcx, str.PID___d_n_n
call fcn.140004350
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14000b0e8], rax
test rax, rax
jne 0x140002748
lea rcx, str.OpenProcess_error__n
call sub.ucrtbase.dll_puts
mov edx, 0x10
lea rcx, str.OpenProcess_error_
call fcn.140002398
or eax, 0xffffffff
jmp 0x14000293a
lea rcx, str.OpenProcess_is_OK_n
call sub.ucrtbase.dll_puts
mov edx, ebx
mov rcx, rsi
call fcn.1400020a9
mov rbx, rax
test rax, rax
jne 0x140002780
lea rcx, str.GetModuleBase_error__n
call sub.ucrtbase.dll_puts
mov edx, 0x10
lea rcx, str.GetModuleBase_error_
jmp 0x14000273b
lea rcx, str.GetModuleBase_is_OK
call sub.ucrtbase.dll_puts
mov rdx, rbx
lea rcx, str.BaseAddress___llx_n_n
call fcn.140004350
lea rdx, [0x140006a31]
mov r8d, 0xa
mov rcx, rbx
call fcn.140002231
mov qword [0x14000b0e0], rax
mov rdx, rax
test rax, rax
je 0x14000291d
lea rcx, str.Found_pattern_address___llx_n
call fcn.140004350
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, qword [0x14000b0e8]
lea rdx, [rbx - 0x1000]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea rcx, str.New_memory_region_address___llx_n
mov rdx, rax
mov qword [0x14000b0d8], rax
call fcn.140004350
mov rcx, qword [0x14000b0d8]
mov rax, qword [0x14000b0e0]
lea edx, [rcx - 5]
sub edx, eax
sub eax, 0x29
sub eax, ecx
lea rcx, str.jmp_offset_
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], eax
call fcn.140004350
mov edx, 4
lea rcx, [rsp + 0x30]
call fcn.140002193
mov ecx, 0xa
call sub.ucrtbase.dll_putchar
lea rcx, str.jmp_return_offset_
call fcn.140004350
mov edx, 4
lea rcx, [rsp + 0x34]
call fcn.140002193
mov ecx, 0xa
call sub.ucrtbase.dll_putchar
mov r9d, 0x32
lea r8, [rsp + 0x5e]
movabs rax, 0x2a15110ff3
mov qword [rsp + 0x5e], rax
movaps xmm0, xmmword [0x140006b50]
movabs rax, 0x13895110f41f3
mov qword [rsp + 0x66], rax
mov eax, dword [rsp + 0x34]
movups xmmword [rsp + 0x6f], xmm0
mov rdx, qword [0x14000b0d8]
mov rcx, qword [0x14000b0e8]
mov dword [rsp + 0x8c], eax
lea rax, [rsp + 0x38]
movups xmmword [rsp + 0x7b], xmm0
mov byte [rsp + 0x6e], 0
mov byte [rsp + 0x8b], 0xe9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rsp + 0x45]
mov r8d, 9
mov rcx, qword [0x14000b0e0]
mov dword [0x14000b0d4], eax
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x45], 0xe9
mov dword [rsp + 0x46], eax
mov dword [rsp + 0x4a], 0x90909090
call fcn.1400022e4
xor eax, eax
jmp 0x14000293a
lea rcx, str.Pattern_not_found_in_memory__n
call sub.ucrtbase.dll_puts
mov edx, 0x10
lea rcx, str.Pattern_not_found_in_memory__n_nProcess_already_patched_or_this_app_may_not_be_compatible_with_your_version_of_the_game.
jmp 0x14000273b
add rsp, 0x98
pop rbx
pop rsi
ret