Function at 0x140001e40
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Create thread
Get common file path
Get file attributes
Inject thread
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push r13
lea rbp, [rsp - 0x2e8]
sub rsp, 0x3e8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
lea rdx, [rbp + 0x1a0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rbp + 0x90]
xor r8d, r8d
lea rdx, str.edge
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
xor r13d, r13d
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001ef7
lea r9, [rbp - 0x68]
mov qword [rsp + 0x20], r13
mov r8d, 0x32000
lea rdx, [0x140004590]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x410], rdi
lea r8, str.game_path
mov qword [rsp + 0x418], r12
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x420], r14
mov qword [rsp + 0x3e0], r15
movaps xmmword [rsp + 0x3d0], xmm6
movaps xmmword [rsp + 0x3c0], xmm7
call fcn.140001cb0
mov rsi, 0xffffffffffffffff
cmp qword [rbp - 0x50], r13
je 0x140001f65
cmp qword [rbp - 0x48], 0xf
lea rcx, [rbp - 0x60]
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140001f65
test al, 0x10
je 0x1400023fa
lea r8, str.install_path
lea rcx, [rbp]
call fcn.140001cb0
lea r8, str.executable_name
lea rcx, [rbp - 0x20]
call fcn.140001cb0
mov r14, qword [rbp + 0x10]
movabs rcx, 0x8000000000000000
mov rax, qword [rbp + 0x18]
movabs r15, 0x7fffffffffffffff
mov r12, qword [rbp]
mov r8d, 0x16
mov qword [rsp + 0x78], rax
test r14, r14
je 0x1400021c2
mov r13, qword [rbp - 0x10]
test r13, r13
je 0x1400021c2
cmp r14, r15
je 0x14000270c
cmp rax, 0xf
lea rdx, [rbp]
lea rax, [r14 + 1]
mov ebx, 0xf
cmova rdx, r12
lea rdi, [rsp + 0x58]
mov qword [rbp - 0x68], rdx
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x58], xmm0
movdqu xmmword [rsp + 0x68], xmm1
cmp rax, rbx
jbe 0x14000207e
mov rbx, rax
or rbx, 0xf
cmp rbx, r15
jbe 0x14000203d
mov rbx, r15
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140002ca4
test rax, rax
je 0x1400021b4
mov rdx, qword [rbp - 0x68]
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
lea rax, [r14 + 1]
jmp 0x140002079
cmp rbx, r8
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002060
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002700
jmp 0x140002016
test rcx, rcx
je 0x140002077
call fcn.140002ca4
mov rdx, qword [rbp - 0x68]
mov rdi, rax
lea rax, [r14 + 1]
jmp 0x140002079
xor edi, edi
mov qword [rsp + 0x58], rdi
mov r8, r14
mov qword [rsp + 0x68], rax
mov rcx, rdi
mov qword [rsp + 0x70], rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0x5c
lea r9, [rbp - 0x20]
mov byte [rdi + r14 + 1], 0
mov rdi, qword [rbp - 8]
mov rcx, qword [rsp + 0x68]
cmp rdi, 0xf
mov rdx, qword [rsp + 0x70]
mov r14, qword [rbp - 0x20]
mov rax, rdx
cmova r9, r14
mov qword [rbp - 0x68], rdi
sub rax, rcx
mov qword [rsp + 0x50], rcx
cmp r13, rax
ja 0x14000210a
cmp rdx, 0xf
lea rax, [rcx + r13]
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x68], rax
cmova rbx, qword [rsp + 0x58]
mov r8, r13
add rcx, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x50]
add rax, rbx
mov byte [rax + r13], 0
lea rax, [rsp + 0x58]
jmp 0x140002128
mov rdx, r13
mov qword [rsp + 0x20], r13
lea rcx, [rsp + 0x58]
call fcn.140002820
mov rdi, qword [rbp - 8]
mov r14, qword [rbp - 0x20]
mov qword [rbp - 0x68], rdi
movups xmm6, xmmword [rax]
xor r13d, r13d
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140002178
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002173
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400021b4
call fcn.140002c9c
mov rdx, qword [rsp + 0x70]
movups xmmword [rbp - 0x60], xmm6
movups xmmword [rbp - 0x50], xmm7
cmp rdx, 0xf
jbe 0x1400021ce
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021bb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002c9c
jmp 0x1400021ce
mov rdi, qword [rbp - 8]
mov r14, qword [rbp - 0x20]
mov qword [rbp - 0x68], rdi
cmp qword [rbp - 0x48], 0xf
lea rcx, [rbp - 0x60]
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400021eb
test al, 0x10
je 0x140002258
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], r13
call fcn.140001660
cmp eax, 1
jne 0x1400025fe
mov r9, qword [rsp + 0x50]
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp byte [r9 + rdi], 0
jne 0x140002210
mov rax, qword [rbp - 0x48]
cmp rdi, rax
ja 0x140002248
cmp rax, 0xf
mov qword [rbp - 0x50], rdi
lea rbx, [rbp - 0x60]
mov r8, rdi
cmova rbx, qword [rbp - 0x60]
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140002254
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.1400029b0
mov rdi, qword [rbp - 0x68]
cmp qword [rbp - 0x48], 0xf
lea rcx, [rbp - 0x60]
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400025fe
test al, 0x10
jne 0x1400025fe
cmp qword [rbp - 0x48], 0xf
lea rdi, [rbp - 0x60]
mov rbx, qword [rbp - 0x50]
xorps xmm0, xmm0
cmova rdi, qword [rbp - 0x60]
movups xmmword [rbp - 0x20], xmm0
cmp rbx, r15
ja 0x1400026fa
cmp rbx, 0xf
ja 0x1400022bd
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 0xf
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x20], xmm0
jmp 0x140002352
mov rax, rbx
or rax, 0xf
cmp rax, r15
jbe 0x1400022f5
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002ca4
mov rcx, rax
test rax, rax
je 0x140002321
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002337
cmp rax, 0x16
mov r15, rax
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140002328
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002706
jmp 0x1400022d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002334
call fcn.140002ca4
jmp 0x140002337
mov rax, r13
lea r8, [rbx + 1]
mov qword [rbp - 0x20], rax
mov rdx, rdi
mov qword [rbp - 0x10], rbx
mov rcx, rax
mov qword [rbp - 8], r15
call sub.VCRUNTIME140.dll_memcpy
xorps xmm0, xmm0
lea rdx, str.game_path
xorps xmm1, xmm1
lea rcx, [rbp]
mov r8d, 9
movups xmmword [rbp], xmm0
movdqu xmmword [rbp + 0x10], xmm1
call fcn.140002720
lea r8, [rbp - 0x20]
lea rdx, [rbp]
call fcn.140001ab0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400023be
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x1400023b6
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026a0
mov rcx, r14
call fcn.140002c9c
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400023fa
inc rdx
mov rax, r12
cmp rdx, 0x1000
jb 0x1400023f2
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026a0
mov rcx, r12
call fcn.140002c9c
xorps xmm0, xmm0
mov qword [rbp - 0x30], r13
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x28], r13
lea rax, [rbp + 0x90]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140002410
mov r8, rsi
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x40]
call fcn.140002720
cmp qword [rbp - 0x30], 0
je 0x1400025ac
cmp qword [rbp - 0x28], 0xf
lea rcx, [rbp - 0x40]
cmova rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400025ac
test al, 0x10
jne 0x1400025ac
xorps xmm0, xmm0
lea rcx, [rbp - 0x60]
xor eax, eax
cmp qword [rbp - 0x48], 0xf
mov qword [rbp + 0x80], rax
cmova rcx, qword [rbp - 0x60]
xor r9d, r9d
mov qword [rbp - 0x70], rax
xor r8d, r8d
lea rax, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r13d
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400025a7
mov rcx, qword [rbp - 0x80]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x14000256e
cmp qword [rbp - 0x28], 0xf
lea r8, [rbp - 0x40]
mov r9, qword [rbp - 0x30]
mov rdx, rax
cmova r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000256e
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
mov rcx, qword [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
je 0x14000256e
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x14000256e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14000257d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400025a7
test rbx, rbx
je 0x1400025a1
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r13d
jmp 0x1400025b1
mov ebx, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400025ec
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025e7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026a0
call fcn.140002c9c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
jmp 0x14000266e
cmp rdi, 0xf
jbe 0x140002631
lea rdx, [rdi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140002629
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026a0
mov rcx, r14
call fcn.140002c9c
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140002669
inc rdx
mov rax, r12
cmp rdx, 0x1000
jb 0x140002661
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026a0
mov rcx, r12
call fcn.140002c9c
mov ebx, 1
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400026ac
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026a7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400026a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002c9c
movaps xmm7, xmmword [rsp + 0x3c0]
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x3d0]
mov r15, qword [rsp + 0x3e0]
mov r14, qword [rsp + 0x420]
mov r12, qword [rsp + 0x418]
mov rdi, qword [rsp + 0x410]
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.140002b00
add rsp, 0x3e8
pop r13
pop rsi
pop rbx
pop rbp
ret
call fcn.140001a90
int3
call fcn.1400019f0
int3
call fcn.1400019f0
int3
call fcn.140001a90
int3