Function at 0x140001980
Capabilities:
Check internet connectivity via wininet
Create thread
Execute command
Get common file path
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x5e0]
sub rsp, 0x6e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rdx, str.AntiCheat_Protector
lea rcx, [rbp + 0x1b0]
call fcn.140002020
nop
lea rdx, str.VAC_Secure_Console
lea rcx, [rbp + 0x1d0]
call fcn.140002020
nop
lea rdx, str.Fair_Play_Terminal
lea rcx, [rbp + 0x1f0]
call fcn.140002020
nop
lea rdx, str.Guardian_of_Fairness
lea rcx, [rbp + 0x210]
call fcn.140002020
nop
lea rdx, str.Anti_Hack_Central
lea rcx, [rbp + 0x230]
call fcn.140002020
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
movsxd rax, r8d
shl rax, 5
lea rcx, [rbp + 0x1b0]
add rcx, rax
cmp qword [rcx + 0x18], 7
jbe 0x140001a67
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea r9, [0x140001fb0]
mov edx, 0x20
lea r8d, [rdx - 0x1b]
lea rcx, [rbp + 0x1b0]
call fcn.140002e4c
mov dword [rbp + 0x180], ebx
xor edx, edx
lea rcx, [rbp + 0x180]
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x140001aae
lea rdx, str.Error:_No_internet_connection._Please_check_your_connection_and_try_again.
jmp 0x140001d59
mov qword [rbp + 0x180], 3
lea rcx, [rbp + 0x180]
call fcn.1400028c0
lea rcx, str.start_steam:__run_730
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp + 0x180], 5
lea rcx, [rbp + 0x180]
call fcn.1400028c0
lea rdx, str.Searching_for_process:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002220
mov rcx, rax
lea r14, str.cs2.exe
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x14000564c]
call fcn.140002220
mov rcx, rax
lea rdx, [0x1400023f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rsp + 0x40], 0x238
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
lea rax, [rsp + 0x6c]
nop dword [rax + rax]
movzx edx, word [rax + rcx*2]
inc rcx
cmp dx, word [r14 + rcx*2 - 2]
jne 0x140001d04
cmp rcx, 8
jne 0x140001b60
mov esi, dword [rsp + 0x48]
lea rdx, str.Process_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002220
mov rcx, rax
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str.._Process_ID:
call fcn.140002220
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400023f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Process_executable_path:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002430
mov rcx, rax
lea rdx, [rsp + 0x6c]
call fcn.1400026a0
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Parent_process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002430
mov rcx, rax
mov edx, dword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Thread_count:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002430
mov rcx, rax
mov edx, dword [rsp + 0x5c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Process_priority_class:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002430
mov rcx, rax
mov edx, dword [rsp + 0x64]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x1400023f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140001d52
lea rdx, str.Select_which_hack_to_inject:__K_L_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002220
mov rcx, rax
lea rdx, [0x1400023f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400029c0
movzx ecx, byte [rsp + 0x30]
lea eax, [rcx - 0x4b]
test al, 0xdf
je 0x140001daf
sub cl, 0x4c
test cl, 0xdf
je 0x140001da6
lea rdx, str.Error:_Invalid_choice._Exiting.
jmp 0x140001d59
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001b50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Error:_Process_not_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002220
mov rcx, rax
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400023f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Error:_Counter_Strike_2_process_not_found._Please_make_sure_the_game_is_running.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002220
lea rdx, [0x1400023f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.140002df0
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdi, str.2.dll
jmp 0x140001db6
lea rdi, str.1.dll
lea rdx, str.Injecting_cheat_into_the_game_Counter_Strike_2_with_process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002220
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000564c]
call fcn.140002220
mov rcx, rax
lea rdx, [0x1400023f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x3c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140001f78
mov r9, rdi
lea r8, [rbp + 0x3c0]
lea rdx, str._s_s
lea rcx, [rbp + 0x1b0]
call fcn.140002a80
mov ecx, 0x20
call fcn.140002e10
mov dword [rax], 0x14
lea rcx, [rbp + 0x1b0]
mov qword [rax + 8], rcx
mov dword [rax + 0x10], esi
lea rcx, [0x1400018e0]
mov qword [rax + 0x18], rcx
mov qword [rbp + 0x1a0], rax
lea rcx, [rbp + 0x198]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140002da0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x190], rax
test rax, rax
je 0x140001f66
movabs rsi, 0x7ffffffffa0a1eff
movabs rdi, 0x7fffffffffffffff
mov ecx, ebx
call fcn.140001820
lea rcx, [rbp + 0x1a0]
call fcn.1400012c0
mov rax, qword [rbp + 0x1a0]
cmp rax, rsi
jge 0x140001ed0
add rax, 0x5f5e100
mov qword [rbp + 0x180], rax
jmp 0x140001ed7
mov qword [rbp + 0x180], rdi
lea rcx, [rbp + 0x180]
call fcn.140002c40
add ebx, 2
cmp ebx, 0x64
jl 0x140001ea2
mov ecx, 0x64
call fcn.140001820
cmp dword [rbp + 0x198], 0
jne 0x140001f0a
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp + 0x198], eax
jne 0x140001f24
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x1a0], xmm0
xor edx, edx
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x140001f52
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x140001d7a
mov dword [rbp + 0x198], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, str.Error:_Failed_to_get_the_temporary_directory_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002220
mov rcx, rax
lea rdx, [0x1400023f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x140001d7a