Function at 0x140001390
Capabilities:
Enumerate process modules
Enumerate processes
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x560
mov rax, qword [0x14001c010]
xor rax, rsp
mov qword [rsp + 0x550], rax
xor r14d, r14d
mov r15d, r14d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001430
mov dword [rsp + 0x100], 0x238
lea rdx, [rsp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001430
lea rdx, str.Total_War_ROME_REMASTERED.exe
lea rcx, [rsp + 0x12c]
call fcn.140007218
test eax, eax
je 0x140001428
lea rdx, [rsp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1400013f9
mov r15d, dword [rsp + 0x108]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x1400018cd
mov r13, r14
mov edx, r15d
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400014af
mov dword [rsp + 0x100], 0x438
lea rdx, [rsp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400014af
lea rdx, str.Total_War_ROME_REMASTERED.exe
lea rcx, [rsp + 0x130]
call fcn.140007218
test eax, eax
je 0x1400014a7
lea rdx, [rsp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x140001478
mov r13, qword [rsp + 0x118]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x1400018ef
lea r12, [r13 + 0x151d704]
nop dword [rax + rax]
xor r8d, r8d
xor edx, edx
call fcn.140001bc0
xor r8d, r8d
xor edx, edx
call fcn.1400019f0
mov edx, r15d
mov rcx, r12
call fcn.140001db0
test al, al
je 0x140001911
mov rcx, qword [0x14001ca08]
sub rcx, qword [0x14001ca00]
sar rcx, 2
cmp rcx, 0x1f
jne 0x1400014d0
mov rax, qword [0x14001ca20]
sub rax, qword [0x14001ca18]
sar rax, 3
cmp rcx, rax
jne 0x140001933
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400019b4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe4], xmm0
mov qword [rsp + 0xf4], r14
mov dword [rsp + 0xe0], 0x1c
lea rdx, [rsp + 0xe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400019b4
nop word [rax + rax]
cmp dword [rsp + 0xec], r15d
jne 0x14000164f
mov r8d, dword [rsp + 0xe8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x14000164f
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1400015c6
mov rcx, r14
jmp 0x140001612
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400015e0
mov rcx, r14
jmp 0x140001612
mov qword [rsp + 0x548], r14
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rsp + 0x548]
lea edx, [r9 + 1]
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0x548]
test eax, eax
cmovne rcx, r14
cmp r12, rcx
jne 0x14000164f
mov ebx, 0x1c
nop dword [rax]
mov rcx, qword [0x14001ca00]
mov eax, dword [rsp + 0xe8]
cmp dword [rbx + rcx], eax
jne 0x14000163c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
add rbx, 4
cmp rbx, 0x58
jle 0x140001620
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140001580
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14000195b
mov byte [rsp + 0x542], 0x88
mov byte [rsp + 0x543], 1
mov byte [rsp + 0x540], 0xc3
mov byte [rsp + 0x541], 0
lea r8, [rsp + 0x540]
lea rdx, [r13 + 0x1b8690]
mov rcx, r14
call fcn.140001270
lea r8, [rsp + 0x541]
lea rdx, [r13 + 0x1b813f]
mov rcx, r14
call fcn.140001270
mov ecx, 0x10
call qword [sym.imp.USER32.dll_MessageBeep]
mov r9d, 0x40
lea r8, str.DONE_
lea rdx, str.Close_me_BEFORE_exiting_the_game__or_when_you_want_disable___nFor_close___click_OK
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea r8, [rsp + 0x542]
lea rdx, [r13 + 0x1b8690]
mov rcx, r14
call fcn.140001270
lea r8, [rsp + 0x543]
lea rdx, [r13 + 0x1b813f]
mov rcx, r14
call fcn.140001270
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140001983
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe4], xmm0
xor r13d, r13d
mov qword [rsp + 0xf4], r13
mov dword [rsp + 0xe0], 0x1c
lea rdx, [rsp + 0xe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x140001983
nop dword [rax]
nop word [rax + rax]
cmp dword [rsp + 0xec], r15d
jne 0x14000185f
mov r8d, dword [rsp + 0xe8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x14000185f
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1400017d6
mov rcx, r13
jmp 0x140001822
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017f0
mov rcx, r13
jmp 0x140001822
mov qword [rsp + 0x548], r13
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x548]
lea edx, [r9 + 1]
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0x548]
test eax, eax
cmovne rcx, r13
cmp r12, rcx
jne 0x14000185f
mov ebx, 0x1c
nop dword [rax]
mov rcx, qword [0x14001ca00]
mov eax, dword [rsp + 0xe8]
cmp dword [rbx + rcx], eax
jne 0x14000184c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add rbx, 4
cmp rbx, 0x58
jle 0x140001830
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140001790
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
jmp 0x14000189b
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.140002420
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rdx, str.Failed_to_get_Process_ID.
lea rcx, [rsp + 0x38]
call fcn.1400011c0
lea rdx, [0x14001a6e8]
lea rcx, [rsp + 0x38]
call fcn.140003bdc
lea rdx, str.Failed_to_get_Process_Base_Address.
lea rcx, [rsp + 0x50]
call fcn.1400011c0
lea rdx, [0x14001a6e8]
lea rcx, [rsp + 0x50]
call fcn.140003bdc
lea rdx, str.Failed_to_get_Thread_Start_Time_and_IDs.
lea rcx, [rsp + 0x68]
call fcn.1400011c0
lea rdx, [0x14001a6e8]
lea rcx, [rsp + 0x68]
call fcn.140003bdc
lea rdx, str.Amount_of_Thread_IDs___amount_of_Thread_Start_Times.
lea rcx, [rsp + 0x80]
call fcn.1400011c0
lea rdx, [0x14001a6e8]
lea rcx, [rsp + 0x80]
call fcn.140003bdc
lea rdx, str.Failed_to_Open_Process.
lea rcx, [rsp + 0x98]
call fcn.1400011c0
lea rdx, [0x14001a6e8]
lea rcx, [rsp + 0x98]
call fcn.140003bdc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Failed_to_Resume_one__or_more__Thread_s_.
lea rcx, [rsp + 0xb0]
call fcn.1400011c0
lea rdx, [0x14001a6e8]
lea rcx, [rsp + 0xb0]
call fcn.140003bdc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Failed_to_Suspend_Threads.
lea rcx, [rsp + 0xc8]
call fcn.1400011c0
lea rdx, [0x14001a6e8]
lea rcx, [rsp + 0xc8]
call fcn.140003bdc
int3