Function at 0x140004350
Capabilities:
Create thread
Execute command
Inject dll
Inject thread
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x288], rax
xor esi, esi
mov dword [rsp + 0x40], esi
lea rcx, str.LoginRose
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x48], rax
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140007800]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
call sub.MSVCP140.dll__Xtime_get_ticks
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rcx, rdx, 0x2710
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
movups xmmword [rsp + 0x270], xmm0
mov r9d, dword [rax + 0x10]
inc r9d
mov r8d, dword [rax + 0x14]
add r8d, 0x76c
mov ecx, dword [rax + 8]
mov dword [rsp + 0x28], ecx
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
lea rdx, str._04d_02d_02d_02d
lea rcx, [rsp + 0x260]
call fcn.140004c70
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
cmp eax, 0x78a55495
jle 0x1400044c1
lea rdx, str._n_Execution_failed__an_error_occurred...._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
lea rdx, [0x1400079d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
mov rbx, rax
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
jmp 0x140004bff
lea rax, [0x140007748]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0xe8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x40], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea r13, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x60], r13
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xd0], rsi
mov dword [rsp + 0xd8], 4
lea rcx, [rsp + 0x240]
call fcn.140004280
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140004569
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140001580
lea rdx, str.Rose_1_1_5
mov rcx, rax
call fcn.140001120
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 0xf
jbe 0x1400045cc
inc rdx
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005348
lea rdx, str._n_File_extraction_directory_is:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
mov rbx, rax
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x60]
call fcn.140004090
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140004603
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140001580
lea rdx, [0x1400079ec]
mov rcx, rax
call fcn.140001120
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 0xf
jbe 0x140004664
inc rdx
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000465f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000465f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005348
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x60]
call fcn.140004090
nop
lea rax, [rsp + 0x240]
mov qword [rsp + 0x50], rax
lea r15, [rsp + 0x260]
cmp qword [rsp + 0x278], 0xf
cmova r15, qword [rsp + 0x260]
mov r14, qword [rsp + 0x270]
call fcn.140004da0
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
mov qword [rsp + 0x250], rsi
mov edi, 7
mov edx, edi
mov qword [rsp + 0x258], rdx
mov word [rsp + 0x240], si
mov dword [rsp + 0x40], 9
test r14, r14
je 0x14000476f
cmp r14, 0x7fffffff
ja 0x140004c33
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140004dc8
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140004c3d
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x240]
call fcn.140003d00
lea r9, [rsp + 0x240]
cmp qword [rsp + 0x258], rdi
cmova r9, qword [rsp + 0x240]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140004dc8
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140004c48
mov rdx, qword [rsp + 0x258]
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x240]
cmp rdx, 7
cmova rcx, qword [rsp + 0x240]
call fcn.140004edc
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140004c52
mov rdx, qword [rsp + 0x258]
cmp rdx, 7
jbe 0x1400047e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400047e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005348
nop
jmp 0x1400047f7
lea r12, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
lea r14, [0x140007748]
call fcn.140002db0
mov edx, 6
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rbx, str.RDR2.exe
mov rcx, rbx
call fcn.140002ce0
test eax, eax
jne 0x140004844
lea rbx, str.rdr2.exe
mov rcx, rbx
call fcn.140002ce0
test eax, eax
je 0x140004b17
mov rcx, rbx
call fcn.140002ce0
test eax, eax
je 0x140004b17
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov qword [rsp + 0x150], r14
lea rcx, [rsp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or edi, 0x10
mov dword [rsp + 0x40], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x150]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x150]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x150], r13
mov rax, qword [rsp + 0x150]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x14c], edx
lea rcx, [rsp + 0x158]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x1c0], rsi
mov dword [rsp + 0x1c8], 4
lea rcx, [rsp + 0x240]
call fcn.140004280
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140004914
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.140001580
lea rdx, str.Rose_1_1_5_
mov rcx, rax
call fcn.140001120
mov rcx, rax
lea rdx, str.RoseMenu
call fcn.140001120
mov rcx, rax
lea rdx, str..dll
call fcn.140001120
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 0xf
jbe 0x140004998
inc rdx
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004993
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005348
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x150]
call fcn.140004090
mov rdi, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400049ba
mov rdi, qword [rax]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdi + r8], 0
jne 0x1400049c4
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
jne 0x1400049f3
mov bl, 1
jmp 0x140004a6b
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400049f3
mov r9, rbx
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140004a1b
mov bl, 1
jmp 0x140004a6b
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140004a60
mov bl, 1
jmp 0x140004a6b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rsp + 0x258]
cmp rdx, 0xf
jbe 0x140004ab1
inc rdx
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004aac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004aac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005348
test bl, bl
je 0x140004abf
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0x150]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x150], r13
mov rax, qword [rsp + 0x150]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x14c], edx
lea rcx, [rsp + 0x158]
call fcn.140002800
lea rcx, [rsp + 0x160]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140004b59
lea rdx, str._n_Failed__game_not_detected...._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
lea rdx, [0x1400079d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
mov rbx, rax
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
nop
mov rdx, qword [rsp + 0x278]
cmp rdx, 0xf
jbe 0x140004b9f
inc rdx
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005348
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], 0xf
mov byte [rsp + 0x260], 0
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x60], r13
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x68]
call fcn.140002800
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0xe8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140005460
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov ecx, 0x16
call fcn.1400034b0
shr rbx, 0x20
mov ecx, ebx
call fcn.1400034f0
shr rcx, 0x20
call fcn.1400034f0
nop
shr rdx, 0x20
lea r8, [rsp + 0x240]
lea rcx, str.create_directory
call fcn.140003440
int3