Function at 0x1800033a0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r15
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1801100c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea r8, str.Bypassing..
xor edx, edx
xor ecx, ecx
call fcn.180003340
inc eax
movsxd rbx, eax
mov rcx, rbx
call fcn.1800d5c08
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x38], rdi
lea r8, str.Bypassing..
mov rdx, rbx
mov rcx, rdi
call fcn.180003340
lea r8, [rbx - 1]
add r8, rdi
lea r9, [rbp - 0x40]
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.180003af0
nop
mov rbx, qword [str.Info]
mov esi, 0x90
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Minty::
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800038b0
mov rcx, rax
mov rdx, rbx
call fcn.1800038b0
mov rcx, rax
lea rdx, [0x1800eab64]
call fcn.1800038b0
mov ecx, 0xfffffff5
mov r15d, 7
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1800eab60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800038b0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
mov rcx, rax
call fcn.180003c20
lea rdx, [0x180003de0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x18000350f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000350a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000350a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d5bd4
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov rcx, rdi
call fcn.1800d5bd4
nop dword [rax + rax]
lea rcx, str.starrailbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x180112280], rax
test rax, rax
je 0x180003530
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp - 0x30], Ordinal_32
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1800035c1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp - 0x24], eax
jne 0x1800035b0
mov r8d, dword [rbp - 0x28]
cmp r8d, esi
je 0x1800035b0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x1800035b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180003577
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x180112280]
lea r9, [rbp - 0x38]
mov edx, 4
lea r8d, [rdx + 0x3c]
lea rcx, [rbx + 0xfcdc0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbx + 0xfcdc0], 0xccc3c031
lea r9, [rbp - 0x38]
mov r8d, dword [rbp - 0x38]
mov edx, 4
lea rcx, [rbx + 0xfcdc0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [0x180112280]
lea r9, [rbp - 0x38]
mov edx, 1
lea r8d, [rdx + 0x3f]
lea rcx, [rbx + 0xf9940]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx + 0xf9940], 0xc3
lea r9, [rbp - 0x38]
mov r8d, dword [rbp - 0x38]
mov edx, 1
lea rcx, [rbx + 0xf9940]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [0x180112280]
lea r9, [rbp - 0x38]
mov edx, 2
lea r8d, [rdx + 0x3e]
lea rcx, [rbx + 0x1bcba0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov word [rbx + 0x1bcba0], 0xfeeb
lea r9, [rbp - 0x38]
mov r8d, dword [rbp - 0x38]
mov edx, 2
lea rcx, [rbx + 0x1bcba0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp - 0x30], Ordinal_32
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18000370d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp - 0x24], eax
jne 0x1800036fc
mov r8d, dword [rbp - 0x28]
cmp r8d, esi
je 0x1800036fc
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x1800036fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1800036c3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.Bypassed_succesfully_
xor edx, edx
xor ecx, ecx
call fcn.180003340
inc eax
movsxd rbx, eax
mov rcx, rbx
call fcn.1800d5c08
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x38], rdi
lea r8, str.Bypassed_succesfully_
mov rdx, rbx
mov rcx, rdi
call fcn.180003340
lea r8, [rbx - 1]
add r8, rdi
lea r9, [rbp - 0x40]
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.180003af0
nop
mov rbx, qword [str.Success]
mov esi, 0xa0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Minty::
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800038b0
mov rcx, rax
mov rdx, rbx
call fcn.1800038b0
mov rcx, rax
lea rdx, [0x1800eab64]
call fcn.1800038b0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x1800eab60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1800038b0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
mov rcx, rax
call fcn.180003c20
lea rdx, [0x180003de0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x180003855
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003850
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003850
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d5bd4
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov rcx, rdi
call fcn.1800d5bd4
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800d5730
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret