Function at 0x140001d90
Capabilities:
Create process on windows
Create process suspended
Enumerate gui resources
Execute command
Get common file path
Read .ini file
Resume thread
Self delete
Set console window title
Set current directory
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x550]
sub rsp, 0x650
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x540], rax
lea rcx, str.Pipsi_ZZZ_:_Jul__9_2024
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
test eax, eax
je 0x140002487
xor edx, edx
lea rcx, [rbp + 0x320]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x100]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140001e6d
lea r9, [rbp - 0x10]
mov edx, 0x104
lea r8, str._sSettings.ini
lea rcx, [rbp + 0x100]
call fcn.140001010
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x320]
lea r8, [0x140004780]
mov dword [rsp + 0x20], 0x104
lea rdx, str.Executable
lea rcx, str.Settings
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x140001f95
lea rcx, str.Select_the_executable_game_file.._n
call fcn.1400010d0
lea rdx, [rbp + 0x100]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x14000248e
xorps xmm0, xmm0
mov dword [rbp - 0x10], 0x98
movups xmmword [rbp + 0x18], xmm0
lea rax, [rbp + 0x320]
mov dword [rbp + 0x1c], 1
mov qword [rbp + 0x20], rax
lea rcx, [rbp - 0x10]
lea rax, str.Executable_File__ZenlessZoneZero.exe_
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 8], rax
movups xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x28], 0x104
movups xmmword [rbp + 0x48], xmm0
mov dword [rbp + 0x50], 0x1800
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
test eax, eax
je 0x14000248e
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x14000248e
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x100]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x100]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x14000246e
lea r9, [rbp + 0x100]
mov edx, 0x104
lea r8, str._sSettings.ini
lea rcx, [rbp - 0x10]
call fcn.140001010
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x320]
lea rdx, str.Executable
lea rcx, str.Settings
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
je 0x14000246e
xor edx, edx
mov qword [rsp + 0x660], rbx
mov r8d, 0x104
lea rcx, [rbp + 0x210]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x430]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x320]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001fd3
cmp ebx, 0x104
jae 0x140002017
lea r8, [rbp + 0x320]
mov edx, 0x104
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
sub ebx, 1
movsxd rax, ebx
js 0x140002017
cmp byte [rbp + rax + 0x210], 0x5c
je 0x14000203a
dec ebx
sub rax, 1
jns 0x140002005
lea rcx, str.Failed_to_remove_file_specification_from_the_path._n
call fcn.1400010d0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0xffffffff
jmp 0x140002410
movsxd rax, ebx
lea r8, [rbp + 0x210]
mov edx, 0x104
mov qword [rsp + 0x668], rdi
lea rcx, [rbp + 0x430]
mov byte [rbp + rax + 0x210], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, str.GameAssembly.dll
mov edx, 0x104
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, str.UnityPlayer.dll
mov edx, 0x104
lea rcx, [rbp + 0x430]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
xor edi, edi
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x210]
mov dword [rsp + 0x50], edi
call fcn.140002590
test eax, eax
jne 0x1400020d8
lea rdx, [rbp + 0x210]
lea rcx, str.Failed_to_calculate_checksum_for__s_n
call fcn.1400010d0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140002403
mov r9d, dword [rsp + 0x50]
cmp r9d, 0x165d4073
je 0x140002111
mov r8d, 0x165d4073
lea rdx, [rbp + 0x210]
lea rcx, str.Invalid_checksum_for__s._Expected_0x_X__got_0x_X._n
call fcn.1400010d0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140002403
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x430]
call fcn.140002590
test eax, eax
jne 0x14000214b
lea rdx, [rbp + 0x430]
lea rcx, str.Failed_to_calculate_checksum_for__s_n
call fcn.1400010d0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140002403
mov eax, dword [rsp + 0x50]
cmp eax, 0x52cbf1a
je 0x140002192
cmp eax, 0x52fbf36
je 0x140002192
mov r9d, 0x52fbf36
mov dword [rsp + 0x20], eax
mov r8d, 0x52cbf1a
lea rdx, [rbp + 0x430]
lea rcx, str.Invalid_checksum_for__s._Expected_0x_X_0x_X__got_0x_X._n
call fcn.1400010d0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140002403
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x100]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x100]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x1400021d9
lea rcx, str.Unable_to_retrieve_delay_setting_from_settings._n
jmp 0x14000245a
lea r9, [rbp + 0x100]
mov edx, 0x104
lea r8, str._sSettings.ini
lea rcx, [rbp - 0x10]
call fcn.140001010
lea r9, [rbp - 0x10]
mov r8d, 0x61a8
lea rdx, str.Delay
lea rcx, str.Settings
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea rdx, [rbp + 0x320]
mov ebx, eax
lea rcx, str.Launching_executable__s.._n
call fcn.1400010d0
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x68
xor eax, eax
lea rcx, [rbp + 0x100]
xor edx, edx
mov qword [rsp + 0x68], rax
mov r8d, 0x104
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rsp + 0x58], xmm0
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x320]
lea rdx, [0x140004b1c]
lea rcx, [rbp + 0x100]
call fcn.140001070
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x100]
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400022d2
lea rcx, str.Failed_to_launch_the_executable_file._n
jmp 0x14000245a
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140002453
cmp qword [rsp + 0x60], rdi
je 0x140002453
lea rdx, str.Bypass.dll
call fcn.140001be0
test eax, eax
je 0x1400023c4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140002439
lea rcx, str.Waiting_for_the_game_window_to_initialize.._n
call fcn.1400010d0
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x70]
lea rcx, [0x1400026a0]
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x78], rdi
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x78], rdi
jne 0x140002399
nop word [rax + rax]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140002430
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x70]
lea rcx, [0x1400026a0]
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x78], rdi
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x78], rdi
je 0x140002350
mov edx, ebx
lea rcx, str.Waiting__i_ms_for_game_to_initialize.._n
call fcn.1400010d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x58]
lea rdx, str.Cheat.dll
call fcn.140001be0
test eax, eax
jne 0x140002439
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rcx, str.Failed_to_inject_the_DLL_into_the_process._n
call fcn.1400010d0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x668]
mov rbx, qword [rsp + 0x660]
mov rcx, qword [rbp + 0x540]
xor rcx, rsp
call fcn.140002710
add rsp, 0x650
pop rbp
ret
lea rcx, str.The_process_has_terminated_before_the_game_window_was_initialized._n
jmp 0x1400023db
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002408
lea rcx, str.Invalid_process_or_thread_handle._n
call fcn.1400010d0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x140002403
lea rcx, str.Failed_to_update_executable_path_in_settings._n
call fcn.1400010d0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0xffffffff
jmp 0x140002418
lea rcx, str.No_executable_file_selected._n
jmp 0x140002475