Function at 0x140001450
Capabilities:
Acquire debug privileges
Check os version
Get common file path
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x20028
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400014fa
lea r8, [rsp + 0x50]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400014fa
mov rax, qword [rsp + 0x50]
lea r9d, [rbx + 0x10]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x5c], rax
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x64], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400014fa
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Grim_Dawn
lea rcx, str.Grim_Dawn
call qword [sym.imp.USER32.dll_FindWindowA]
mov r12, rax
test rax, rax
jne 0x140001535
xor r9d, r9d
lea rdx, [0x140003438]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [r12 + 1]
jmp 0x1400018f1
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x5f8], r14
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x140001583
xor r9d, r9d
lea rdx, [0x140003448]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [r14 + 2]
jmp 0x1400018e9
lea rcx, str.kernel32
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001628
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
call rax
movzx eax, word [rsp + 0x68]
cmp ax, 6
je 0x1400015d2
cmp ax, 9
jne 0x140001628
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000163d
lea rdx, [rsp + 0x50]
mov rcx, r14
call rax
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x14000161f
xor r9d, r9d
lea rdx, [0x140003408]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [rsp + 0x50]
test ecx, ecx
mov eax, ebx
sete al
jmp 0x140001641
xor r9d, r9d
lea rdx, [0x1400033d8]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x140001658
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 3
jmp 0x1400018e9
lea rdx, [rbp + 0xc0]
mov qword [rsp + 0x5f0], r15
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0xc0]
mov edx, 0x104
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.GDCheater64.dll
mov edx, 0x104
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
xor r9d, r9d
lea rax, [0x1400034a8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x208
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov r15, rax
test rax, rax
je 0x140001967
xor r8d, r8d
mov qword [rsp + 0x620], rsi
mov edx, 0xf001f
mov qword [rsp + 0x20], 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x140001719
lea r8, [rbp + 0xc0]
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor edx, edx
mov dword [rbp - 0x60], 0x11c
mov r8d, 0x100
mov qword [rbp - 0x54], rbx
lea rcx, [rbp - 0x4c]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov word [rbp + 0xb6], bx
mov r8b, 3
mov dword [rbp + 0xb8], eax
xor ecx, ecx
lea edx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 0x23
mov qword [rbp - 0x5c], 6
mov r8, rax
mov word [rbp + 0xb4], bx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001948
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x2d0]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov qword [rsp + 0x628], rdi
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x630], r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [rsp + 0x40]
lea r9, [rsp + 0x50]
mov r13, rax
mov r8d, ebx
xor eax, eax
mov rdx, r13
mov rcx, rdi
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdi, qword [rsp + 0x628]
test eax, eax
je 0x14000190c
mov r8d, ebx
mov rdx, r13
mov rcx, r14
call fcn.140001320
mov rbx, rax
test rax, rax
je 0x14000190c
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r9d, r9d
lea r8, str.GDCheater
lea rdx, [0x140003520]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 1
mov rcx, r12
call qword [sym.imp.USER32.dll_SwitchToThisWindow]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x1400018c6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov r13, qword [rsp + 0x630]
mov rsi, qword [rsp + 0x620]
mov r15, qword [rsp + 0x5f0]
mov r14, qword [rsp + 0x5f8]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.1400019a0
add rsp, 0x600
pop r12
pop rbx
pop rbp
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140001923
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea rdx, [0x1400034e8]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 6
jmp 0x1400018d1
xor r9d, r9d
lea rdx, [0x1400034d0]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 5
jmp 0x1400018d9
xor r8d, r8d
lea rdx, [0x1400034c0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 4
jmp 0x1400018e1