Function at 0x14000d0c0
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x140063010]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, [0x140057a24]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor r13d, r13d
mov r12d, r13d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r15, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14000db65
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x14000db65
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r14 + rbx*4]
mov r9d, dword [rcx + r11]
add r9, r11
mov r10d, 0x3d566c3d
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14000db5d
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14000d173
cmp r10d, 0x486d6568
jne 0x14000db5d
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
mov edx, 5
mov rcx, r15
call r8
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], 1
mov word [rsp + 0xc2], 0
mov byte [rsp + 0xc4], 0
mov word [rsp + 0xac], 0
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtQueryCompositionSurfaceStatistics
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x90]
call rax
test r12, r12
jne 0x14000d412
lea rcx, str.Rust
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov r15, rax
lea rcx, str.UnityWndClass
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov r12, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14000d40a
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x14000d40a
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r14 + rbx*4]
mov r8d, dword [rcx + r11]
add r8, r11
mov r10d, 0x4fc6a61a
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x14000d402
movsx ecx, r9b
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r9d, byte [r8]
lea r8, [r8 + 1]
test r9b, r9b
jne 0x14000d2e3
cmp r10d, 0xdde978c
jne 0x14000d402
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov r8d, dword [rcx + rax*4]
add r8, r11
mov rdx, r15
mov rcx, r12
call r8
mov r12, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000d3fa
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x14000d3fa
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rax, [r14 + rbx*4]
mov r9d, dword [rax + r10]
add r9, r10
mov r11d, 0x34c8ba30
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14000d3f6
nop
movsx eax, r8b
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
cmova edx, eax
xor edx, r11d
imul r11d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14000d3a0
cmp r11d, 0x3ca554c3
jne 0x14000d3f6
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + rbx*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x32
call rdx
jmp 0x14000d251
test ebx, ebx
jne 0x14000d380
mov rcx, qword [rcx]
jmp 0x14000d350
test ebx, ebx
jne 0x14000d2c0
mov rax, qword [rax]
jmp 0x14000d290
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14000db55
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x14000db55
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r14 + rbx*4]
mov r9d, dword [rcx + r11]
add r9, r11
mov r10d, 0x300b3ec3
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14000db4d
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14000d483
cmp r10d, 0xae2f103
jne 0x14000db4d
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov edx, dword [rcx + rax*4]
add rdx, r11
mov ecx, 0x74
call rdx
test ax, ax
je 0x14000da7d
mov ecx, 0x10
call fcn.14004ebf0
mov qword [rax], r13
mov qword [rax + 8], r13
mov rbx, qword [0x1400ad778]
mov qword [0x1400ad778], rax
test rbx, rbx
je 0x14000d52d
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x14000d513
call fcn.14000e7b0
mov rdx, qword [rbx]
test rdx, rdx
je 0x14000d520
call fcn.14000e7b0
mov edx, 0x10
mov rcx, rbx
call fcn.14004ee7c
lea rcx, [rsp + 0x30]
call fcn.14000f850
mov rdx, qword [0x1400ad778]
cmp rdx, rax
je 0x14000d55c
mov rcx, qword [rax]
mov qword [rax], r13
mov rax, qword [rdx]
mov qword [rdx], rcx
test rax, rax
je 0x14000d55c
mov rdx, rax
call fcn.14000e7b0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14000d56b
call fcn.14000e7b0
lea rcx, [rsp + 0x40]
call fcn.14000f850
mov rdx, qword [0x1400ad778]
add rdx, 8
cmp rdx, rax
je 0x14000d59e
mov rcx, qword [rax]
mov qword [rax], r13
mov rax, qword [rdx]
mov qword [rdx], rcx
test rax, rax
je 0x14000d59e
mov rdx, rax
call fcn.14000e7b0
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14000d5ad
call fcn.14000e7b0
mov ecx, 0x18
call fcn.14004ebf0
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov rdx, qword [0x1400ad798]
mov qword [0x1400ad798], rax
test rdx, rdx
je 0x14000d5da
call fcn.14000e6e0
mov ecx, 0x18
call fcn.14004ebf0
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov rdx, qword [0x1400ad790]
mov qword [0x1400ad790], rax
test rdx, rdx
je 0x14000d607
call fcn.14000e640
mov ecx, 0x18
call fcn.14004ebf0
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov rdx, qword [0x1400ad780]
mov qword [0x1400ad780], rax
test rdx, rdx
je 0x14000d634
call fcn.14000e640
mov ecx, 0x18
call fcn.14004ebf0
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov rdx, qword [0x1400ad768]
mov qword [0x1400ad768], rax
test rdx, rdx
je 0x14000d661
call fcn.14000e640
mov ecx, 0x10
call fcn.14004ebf0
mov qword [rax], r13
mov qword [rax + 8], r13
mov rbx, qword [0x1400a93f8]
mov qword [0x1400a93f8], rax
test rbx, rbx
je 0x14000d6b8
lea rcx, [rbx + 8]
call fcn.14000e060
mov rdi, qword [rbx]
test rdi, rdi
je 0x14000d6ab
mov rcx, rdi
call fcn.140003890
mov edx, 0x88
mov rcx, rdi
call fcn.14004ee7c
mov edx, 0x10
mov rcx, rbx
call fcn.14004ee7c
lea rcx, str.RustClient.exe
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov r14, rax
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000d6d0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d6f2
mov rcx, rax
jmp 0x14000d76f
mov dword [rsp + 0x100], 0x238
lea rdx, [rsp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x14000d767
lea rax, [rsp + 0x12c]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x14000d722
mov r8, rdi
cmp rsi, rdi
cmovb r8, rsi
lea rdx, [rsp + 0x12c]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000d6fd
cmp rdi, rsi
jb 0x14000d6fd
ja 0x14000d6fd
mov edi, dword [rsp + 0x108]
test rbx, rbx
je 0x14000d778
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000d778
test rbx, rbx
je 0x14000d775
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r13d
mov dword [0x14007922c], edi
lea rdx, str.PID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f4e0
mov edx, dword [0x14007922c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
lea rdx, [0x14000f6b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.GameAssembly.dll
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov rcx, rax
call fcn.140001b50
mov qword [0x1400ad788], rax
lea rdx, str.GameAssemblyBase:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f4e0
mov rdx, qword [0x1400ad788]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14000f6b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.UnityPlayer.dll
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov rcx, rax
call fcn.140001b50
mov qword [0x1400ad770], rax
lea rdx, str.UnityPlayerBase:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f4e0
mov rdx, qword [0x1400ad770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14000f6b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 8
call fcn.14004ebf0
lea rcx, [0x14004ae90]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400112b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000da6c
mov ecx, 8
call fcn.14004ebf0
lea rcx, [0x14000bba0]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400112b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000da58
mov ecx, 8
call fcn.14004ebf0
lea rcx, [0x140005780]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400112b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000da47
mov ecx, 8
call fcn.14004ebf0
lea rcx, [0x14000af70]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400112b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000da36
cmp dword [rsp + 0x58], 0
jne 0x14000d98e
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x58], eax
jne 0x14000d9a5
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x14000d9cc
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
cmp dword [rsp + 0x68], 0
je 0x14000d9e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp dword [rsp + 0x78], 0
je 0x14000d9f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp dword [rsp + 0x88], 0
je 0x14000da02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14004ebd0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov dword [rsp + 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x88], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x58], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14000db45
mov ebx, dword [rdi + 0x18]
test ebx, ebx
je 0x14000db45
mov r14d, dword [rdi + 0x20]
nop dword [rax + rax]
dec ebx
lea rcx, [r11 + rbx*4]
mov r9d, dword [rcx + r14]
add r9, r11
mov r10d, 0x30fc35cc
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14000db3d
nop
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14000dae0
cmp r10d, 0xdeeb1e4f
jne 0x14000db3d
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + rbx*2]
mov edx, dword [rcx + rax*4]
add rdx, r11
mov ecx, 0x32
call rdx
mov byte [0x1400ad8f1], 1
jmp 0x14000d412
test ebx, ebx
jne 0x14000dac0
mov rax, qword [rax]
jmp 0x14000da90
test ebx, ebx
jne 0x14000d460
mov rax, qword [rax]
jmp 0x14000d430
test ebx, ebx
jne 0x14000d150
mov rax, qword [rax]
jmp 0x14000d120