Function at 0x180004b70
Capabilities:
Execute command
Parse pe header
Self delete
Terminate process

Disassembly:
push rbx
sub rsp, 0xa0
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x180004ba9
mov r9d, 0x10
lea r8, str.rust
lea rdx, str.____CLOSE_GAME____
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.taskkill__f__im_RustClient.exe___nul
mov qword [rsp + 0xb8], rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x180007bb0]
lea rdx, str.C:WindowsSystem32_symsrv.dll
xor ebx, ebx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
movdqu xmmword [rsp + 0x40], xmm0
lea r8d, [rbx + 0x1e]
call fcn.180004e70
lea rcx, [rsp + 0x30]
call fcn.180004a00
movdqa xmm0, xmmword [0x180007bb0]
lea r8d, [rbx + 0x1f]
lea rdx, str.C:WindowsSystem32dbghelp.dll
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
call fcn.180004e70
lea rcx, [rsp + 0x30]
call fcn.180004890
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180002760
mov eax, 0x5a4d
cmp word [0x180186ee0], ax
jne 0x180004e37
movsxd rdi, dword [0x180186f1c]
lea rbx, [0x180186ee0]
add rdi, rbx
lea rax, [0x180186f20]
cmp rdi, rax
jb 0x180004e37
lea rax, [rdi + 0x108]
lea rcx, [0x180187ee0]
cmp rax, rcx
ja 0x180004e37
cmp dword [rdi], 0x4550
jne 0x180004e37
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x180004e37
cmp word [rdi + 0x5c], 1
jne 0x180004e37
lea rcx, str.CheckAndGetHeader_ok_n
mov qword [rsp + 0xb0], rsi
call fcn.180001020
lea rcx, [rsp + 0x70]
call fcn.180002450
mov dl, 1
lea rcx, [rsp + 0x70]
call fcn.180003110
lea rcx, str.load_vul_driver_ok_n
call fcn.180001020
call fcn.1800019c0
lea rcx, str.init_kernel_mgr_ok_n
call fcn.180001020
call fcn.1800029a0
lea rcx, str.clear_TRASH_ok_n
call fcn.180001020
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.180003110
mov ecx, dword [rdi + 0x50]
call fcn.1800044d0
mov r8, rbx
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call fcn.180003840
mov rdx, rdi
mov rcx, rbx
call fcn.1800039c0
test al, al
jne 0x180004d69
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.180003110
mov r9d, 0x10
lea r8, str.rust
lea rdx, str.FAILED_TO_RESOLVE_IMPORTS
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 4
lea rcx, str.ERR:_Import_failed
call fcn.180002600
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.180003c90
mov ebx, dword [rdi + 0x28]
lea rdx, [0x180007470]
xor r8d, r8d
add rbx, rsi
call fcn.180001d20
mov r9, rax
mov r8, rsi
mov rdx, rbx
call fcn.180005200
mov rdx, rdi
mov rcx, rsi
mov rbx, rax
call fcn.180004050
call fcn.180001ad0
mov r8, rbx
lea rdx, str.Load_OK:__x
lea rcx, [rsp + 0x50]
call fcn.1800052e0
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.180002600
lea rcx, str.taskkill__f__im_NVDisplay.Container.exe__t
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x41a
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x180007b00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.del_C:WindowsSystem32_symsrv.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x40
lea r8, str.rust
lea rdx, str.SUCCES_::_START_GAME
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rsi, qword [rsp + 0xb0]
mov r9d, 0x10
lea r8, str.rust
lea rdx, str.FAILED_TO_parse_file___bytes
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdi, qword [rsp + 0xb8]
mov eax, 0xffffffff
add rsp, 0xa0
pop rbx
ret