Function at 0x14001b690
Capabilities:
Create thread
Inject thread
Resume thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x1400a13c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
test rdx, rdx
je 0x14001b9ad
test ecx, ecx
je 0x14001b9ad
mov rbx, rdx
call fcn.14001b9d0
mov rsi, rax
cmp byte [0x14015fe2e], 1
je 0x14001b6fc
mov byte [0x14015fe2e], 1
movabs rax, 0x7262694c64616f4c
mov qword [0x14015fe20], rax
mov dword [0x14015fe28], 0x57797261
mov word [0x14015fe2c], 0x6100
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14015fe20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001b82e
mov r15, rax
mov rcx, rbx
call fcn.14005c350
lea rdi, [rax*2 + 2]
mov dword [rsp + 0x20], 4
mov rcx, rsi
xor edx, edx
mov r8, rdi
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x14001b86b
mov r14, rax
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rax
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14001b8d4
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
xor edi, edi
mov rcx, rsi
xor edx, edx
xor r8d, r8d
mov r9, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14001b93a
mov rbx, rax
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x32
call r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0x23
call r15
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
mov r9d, 0xc000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [rsp + 0x44], 0
lea rdx, [rsp + 0x44]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [rsp + 0x44]
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
cmp ebx, 0x103
jne 0x14001b9ad
lea rcx, str.successful.wav
call fcn.140015250
mov edi, 1
jmp 0x14001b9ad
cmp byte [0x14015fe44], 1
je 0x14001b856
mov byte [0x14015fe44], 1
movaps xmm0, xmmword [0x14008d1c0]
movaps xmmword [0x14015fe30], xmm0
mov dword [0x14015fe40], 0x21ad0000
lea rdx, [0x14015fe30]
xor edi, edi
xor ecx, ecx
call fcn.140013190
jmp 0x14001b9ad
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
mov esi, eax
call rdi
cmp byte [0x14015fe7e], 0
jne 0x14001b8c8
mov byte [0x14015fe7e], 1
movaps xmm0, xmmword [0x14008d1b0]
movaps xmmword [0x14015fe50], xmm0
movaps xmm0, xmmword [0x14008d190]
movaps xmmword [0x14015fe60], xmm0
movabs rcx, 0x29003000200058
mov qword [0x14015fe70], rcx
mov dword [0x14015fe78], 0xa
mov word [0x14015fe7c], 0xedbd
lea rdx, [0x14015fe50]
jmp 0x14001b99e
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
mov esi, eax
call rdi
cmp byte [0x14015feae], 0
jne 0x14001b931
mov byte [0x14015feae], 1
movaps xmm0, xmmword [0x14008d1a0]
movaps xmmword [0x14015fe80], xmm0
movaps xmm0, xmmword [0x14008d190]
movaps xmmword [0x14015fe90], xmm0
movabs rcx, 0x29003000200058
mov qword [0x14015fea0], rcx
mov dword [0x14015fea8], 0xa
mov word [0x14015feac], 0x3cdf
lea rdx, [0x14015fe80]
jmp 0x14001b99e
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
mov esi, eax
call rdi
cmp byte [0x14015fede], 0
jne 0x14001b997
mov byte [0x14015fede], 1
movaps xmm0, xmmword [str.error_49__i__0x_error_48error_47error_46cant_attach_to_game.._error__i__0x_X_0_]
movaps xmmword [0x14015feb0], xmm0
movaps xmm0, xmmword [0x14008d190]
movaps xmmword [0x14015fec0], xmm0
movabs rcx, 0x29003000200058
mov qword [0x14015fed0], rcx
mov dword [0x14015fed8], 0xa
mov word [0x14015fedc], 0xb534
lea rdx, [0x14015feb0]
xor edi, edi
xor ecx, ecx
mov r8d, eax
mov r9d, esi
call fcn.140013190
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140046610
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret