Function at 0x403870
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
lea rax, [0x00401550]
mov edx, 0x7f00
mov rsi, qword [sym.imp.USER32.dll_LoadIconA]
lea rdi, [0x00404010]
mov qword [rsp + 0x118], rax
mov ebx, r9d
mov rbp, rcx
movabs rax, 0x800000050
mov qword [rsp + 0x128], rcx
xor ecx, ecx
mov qword [rsp + 0x150], rdi
mov qword [rsp + 0x110], rax
call rsi
xor ecx, ecx
mov edx, 0x7f00
mov qword [rsp + 0x130], rax
call rsi
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x158], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x140], 1
call qword [sym.imp.USER32.dll_RegisterClassExA]
xor edx, edx
test ax, ax
jne 0x4016d0
mov eax, edx
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 1
mov r12, qword [sym.imp.USER32.dll_GetSystemMetrics]
call r12
xor ecx, ecx
mov esi, eax
call r12
sar esi, 1
mov rdx, rdi
xor ecx, ecx
sar eax, 1
sub esi, 0x96
mov qword [rsp + 0x50], rbp
mov r9d, 0xa0000
mov dword [rsp + 0x28], esi
sub eax, 0xfa
lea r8, [0x00405095]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x12c
mov dword [rsp + 0x30], 0x1f4
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, str.SnowRunner.exe
mov qword [rsp + 0x88], 0
mov rsi, rax
mov dword [rsp + 0x7c], 0x41500000
call fcn.00401cc0
lea rdx, str.SnowRunner.exe
test eax, eax
mov ebp, eax
je 0x401c45
lea rcx, str.Process__s_found__n
call sub.msvcrt.dll_printf
lea rcx, str.PID___d_n_n
mov edx, ebp
call sub.msvcrt.dll_printf
xor edx, edx
mov r8d, ebp
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rdi, rax
je 0x401c93
lea rcx, str.OpenProcess_is_OK
call sub.msvcrt.dll_puts
lea rcx, str.Handle_of_process___d_n_n
mov rdx, rdi
call sub.msvcrt.dll_printf
lea rcx, str.SnowRunner.exe
mov edx, ebp
call fcn.00401d50
test rax, rax
mov rbp, rax
je 0x401c6c
lea rcx, str.GetModuleBase_is_OK
call sub.msvcrt.dll_puts
lea rcx, str.BaseAddress___llx_n_n
mov rdx, rbp
call sub.msvcrt.dll_printf
mov r9d, 0xa
mov rdx, rbp
mov rcx, rdi
lea r8, [0x004051eb]
call fcn.00401ef0
test rax, rax
mov r13, rax
je 0x401c1e
lea rcx, str.Found_pattern_address___llx_n
mov rdx, rax
movabs r12, 0x101010101010101
call sub.msvcrt.dll_printf
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rdi
lea rdx, [rbp - 0x1000]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea rcx, str.New_memory_region_address___llx_n
lea rbp, [rsp + 0xd0]
mov r14, rax
mov rdx, rax
call sub.msvcrt.dll_printf
lea rcx, str.jmp_offset_
mov eax, r14d
lea r15, [0x00405468]
sub eax, r13d
sub eax, 5
mov dword [rsp + 0x80], eax
lea eax, [r13 - 0x29]
sub eax, r14d
mov dword [rsp + 0x84], eax
call sub.msvcrt.dll_printf
mov edx, 4
lea rcx, [rsp + 0x80]
call fcn.00401e20
mov ecx, 0xa
call sub.msvcrt.dll_putchar
lea rcx, str.jmp_return_offset_
call sub.msvcrt.dll_printf
mov edx, 4
lea rcx, [rsp + 0x84]
call fcn.00401e20
mov ecx, 0xa
call sub.msvcrt.dll_putchar
mov eax, dword [rsp + 0x80]
mov rdx, r13
mov rcx, rdi
mov r9d, 9
mov byte [rsp + 0x97], 0xe9
lea r8, [rsp + 0x97]
mov dword [rsp + 0x9c], 0x90909090
mov dword [rsp + 0x98], eax
call fcn.00401fd0
mov rcx, rsi
mov dword [rsp + 0x6c], eax
lea rax, [0x0040525d]
movzx edx, al
mov dword [rsp + 0x68], eax
movzx eax, al
imul rdx, r12
imul eax, eax, 0x1010101
mov qword [rsp + 0xda], rdx
mov dword [rbp + 0x2a], eax
mov rax, qword [0x0040525f]
mov qword [rbp + 0x12], rdx
mov qword [rbp + 0x1a], rdx
mov qword [rbp + 0x22], rdx
mov edx, ebx
mov qword [rsp + 0xd0], rax
movzx eax, word [0x00405267]
mov byte [rsp + 0xfd], 0xe9
mov word [rsp + 0xd8], ax
movzx eax, byte [0x00405269]
mov byte [rsp + 0xda], al
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0xfe], eax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [sym.imp.USER32.dll_RegisterHotKey]
mov r9d, 0x6a
xor ecx, ecx
mov r8d, 0x4002
mov edx, 1
call rbx
mov r9d, 0x6f
mov r8d, 0x4002
xor ecx, ecx
mov edx, 2
call rbx
mov r9d, 0x6d
mov r8d, 0x4002
xor ecx, ecx
mov edx, 3
call rbx
mov r9d, 0x6b
mov r8d, 0x4002
xor ecx, ecx
mov edx, 4
call rbx
mov r9d, 0x60
mov r8d, 0x4002
xor ecx, ecx
mov edx, 5
call rbx
movzx eax, byte [rsp + 0x68]
lea rbx, [rsp + 0xa0]
mov rsi, qword [sym.imp.USER32.dll_GetMessageA]
imul r12, rax
jmp 0x401a52
mov rcx, rbx
call qword [sym.imp.USER32.dll_TranslateMessage]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
je 0x401be5
cmp dword [rsp + 0xa8], 0x312
jne case.0x401a8e.0
cmp qword [rsp + 0xb0], 5
ja case.0x401a8e.0
mov rax, qword [rsp + 0xb0]
movsxd rax, dword [r15 + rax*4]
add rax, r15
jmp rax
lea rcx, str._nCtrl__NumPad0_hotkey_press_has_been_detected_
call sub.msvcrt.dll_puts
jmp case.0x401a8e.0
lea rcx, str._nCtrl__NumPad_hotkey_press_has_been_detected_
call sub.msvcrt.dll_puts
movss xmm1, dword [0x00405484]
lea rcx, [rsp + 0x7c]
call fcn.004020c0
mov eax, dword [rsp + 0x7c]
mov r8, rbp
mov rdx, r14
mov r9d, 0x32
mov rcx, rdi
mov dword [rsp + 0xd7], eax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x6c], eax
jmp case.0x401a8e.0
lea rcx, str._nCtrl__NumPad__hotkey_press_has_been_detected_
call sub.msvcrt.dll_puts
lea rcx, [rsp + 0x7c]
movss xmm1, dword [0x00405480]
jmp 0x401ab9
lea rcx, [0x00405370]
call sub.msvcrt.dll_puts
mov rax, qword [0x004053a0]
mov qword [rbp + 8], r12
movzx ecx, byte [rsp + 0x68]
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r12
mov qword [rbp], rax
movzx eax, byte [0x004053a8]
mov edx, ecx
mov qword [rbp + 0x28], r12
shl edx, 8
add edx, ecx
mov byte [rbp + 8], al
mov eax, dword [rsp + 0x6c]
mov word [rbp + 0x30], dx
test eax, eax
je case.0x401a8e.0
lea rcx, str.SnowRunner_timer_has_been_started_
call sub.msvcrt.dll_puts
jmp case.0x401a8e.0
lea rcx, [0x00405318]
call sub.msvcrt.dll_puts
mov qword [rbp], r12
mov r8, rbp
mov rcx, rdi
movzx edx, byte [rsp + 0x68]
mov qword [rbp + 8], r12
mov r9d, 0x32
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r12
mov eax, edx
mov qword [rbp + 0x28], r12
shl eax, 8
add eax, edx
mov rdx, r14
mov word [rbp + 0x30], ax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
mov dword [rsp + 0x6c], eax
je case.0x401a8e.0
lea rcx, str.SnowRunner_timer_has_been_stopped_
call sub.msvcrt.dll_puts
jmp case.0x401a8e.0
mov r9d, 9
mov rdx, r13
mov rcx, rdi
lea r8, [0x004053a0]
call fcn.00401fd0
mov rdx, r14
xor r8d, r8d
mov rcx, rdi
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, dword [rsp + 0xb0]
jmp 0x4016b8
lea rcx, str.Pattern_not_found_in_memory__n
call sub.msvcrt.dll_puts
mov edx, 0x10
lea rcx, str.Pattern_not_found_in_memory__n_nProcess_SnowRunner.exe_already_patched_or_this_app_may_not_be_compatible_with_your_version_of_the_game.
call fcn.004020a0
mov edx, 0xffffffff
jmp 0x4016b8
lea rcx, str.Process__s_not_found__n_n
call sub.msvcrt.dll_printf
mov edx, 0x10
lea rcx, str.SnowRunner.exe_not_found_in_memory__n_nPlease_launch_SnowRunner_before_this_app.
call fcn.004020a0
mov edx, 0xffffffff
jmp 0x4016b8
lea rcx, str.GetModuleBase_error__n
call sub.msvcrt.dll_puts
mov edx, 0x10
lea rcx, str.GetModuleBase_error_
call fcn.004020a0
mov edx, 0xffffffff
jmp 0x4016b8
lea rcx, str.OpenProcess_error__n
call sub.msvcrt.dll_puts
mov edx, 0x10
lea rcx, str.OpenProcess_error_
call fcn.004020a0
mov edx, 0xffffffff
jmp 0x4016b8
sub rsp, 0x28
call fcn.004021a0
mov rax, qword [0x004058f0]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x004058e0]
mov r8, qword [rax]
mov rax, qword [0x004058d0]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x4015f0