Function at 0x140002d60
Capabilities:
Execute command
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp - 8], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x140005bb4]
lea rdx, str.conout_
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x140005bc0]
lea rdx, str.conin_
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
lea rcx, str.Color_0B
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.Anticheat_currently_protecting:
lea rcx, [rbp - 0x28]
call fcn.140001860
mov rcx, qword [rbp - 0x10]
xor r14d, r14d
mov rdi, qword [rbp - 0x18]
mov rax, rcx
sub rax, rdi
cmp rax, 0xa
jb 0x140002e4f
cmp rcx, 7
lea rax, [rdi + 0xa]
lea rbx, [rbp - 0x28]
mov qword [rbp - 0x18], rax
cmova rbx, qword [rbp - 0x28]
lea rdx, str.Client.exe
mov r8d, 0x14
lea rcx, [rbx + rdi*2]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2 + 0x14], r14w
jmp 0x140002e66
mov edx, 0xa
mov qword [rsp + 0x20], 0xa
lea rcx, [rbp - 0x28]
call fcn.1400025e0
cmp qword [rbp - 0x10], 7
lea rcx, [rbp - 0x28]
cmova rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call fcn.140003200
test eax, eax
jne 0x140002e9e
xor ecx, ecx
call fcn.140001cf0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003200
test eax, eax
je 0x140002e83
call fcn.1400032c0
test eax, eax
jne 0x140002ec1
call fcn.140003200
test eax, eax
je 0x1400031cc
call fcn.1400032c0
test eax, eax
je 0x1400031cc
call fcn.1400032c0
mov r8d, eax
mov dword [0x1400087c0], eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400087b8], rax
cmp rax, 0xffffffffffffffff
jne 0x140002f07
mov r8d, dword [0x1400087c0]
xor edx, edx
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, 0xffffffffffffffff
je 0x1400031d7
call fcn.140001210
test al, al
jne 0x140002f4d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.____Driver_load_failed__trying_again...
call fcn.140001a10
mov rcx, rax
lea rdx, [0x140001bf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140001690
test al, al
je 0x1400031e2
call fcn.140001210
test al, al
je 0x1400031e2
mov qword [rsp + 0x30], r14
lea rcx, str.._acDriverDevice
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov edx, 0x10000000
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x38], r14
lea r8, [rbp - 0x38]
mov rbx, rax
mov qword [rsp + 0x30], r14
lea rax, [rbp - 0x38]
mov dword [rsp + 0x28], 0xc
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov qword [rbp - 0x38], r14
mov edx, 0x22400c
mov dword [rbp - 0x30], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140002fc2
cmp dword [rbp - 0x30], 4
je 0x14000300f
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x38]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x38]
mov dword [rsp + 0x28], 0xc
mov r9d, 0xc
mov edx, 0x22400c
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov qword [rbp - 0x38], r14
mov dword [rbp - 0x30], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400031c1
cmp dword [rbp - 0x30], 4
jne 0x1400031c1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Driver_connection_established...
call fcn.140001a10
lea rdx, [0x140001bf0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x90], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [0x1400087c0]
lea r8, [rbp - 0x38]
mov qword [rsp + 0x38], r14
mov edi, eax
mov dword [rbp - 0x38], eax
mov r9d, 0xc
lea rax, [rbp - 0x38]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xc
mov edx, 0x224010
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x30], r14d
mov dword [rbp - 0x34], esi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14000308f
cmp dword [rbp - 0x30], 1
je 0x1400030de
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x38]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x38]
mov dword [rsp + 0x28], 0xc
mov r9d, 0xc
mov edx, 0x224010
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov dword [rbp - 0x30], r14d
mov dword [rbp - 0x38], edi
mov dword [rbp - 0x34], esi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400031b6
cmp dword [rbp - 0x30], 1
jne 0x1400031b6
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Processes_protected_by_ObRegisterCallbacks_
call fcn.140001a10
lea rdx, [0x140001bf0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x1400087b8]
call fcn.140002800
test eax, eax
je 0x1400031ed
call fcn.140003200
test eax, eax
je 0x140003134
nop
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003200
test eax, eax
jne 0x140003120
call fcn.140001690
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x140003187
mov rcx, qword [rbp - 0x28]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003182
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003182
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000366c
mov rsi, qword [rsp + 0x90]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400033d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 0xd
call fcn.140001eb0
int3
mov ecx, 2
call fcn.140001eb0
int3
mov ecx, 3
call fcn.140001eb0
int3
mov ecx, 4
call fcn.140001eb0
int3
mov ecx, 0xb
call fcn.140001eb0
int3
mov ecx, 8
call fcn.140001eb0
int3