Function at 0x14002b930
Capabilities:
Create process on windows
Create thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1d0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x14003b010]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rbx, rcx
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rdx, str.cs2.exe
lea rcx, [rbp - 0x78]
call fcn.1400017d0
mov rdx, rax
call fcn.14002b0f0
test eax, eax
je 0x14002b9ad
lea rdx, str.Failed_to_attach__cs2.exe__process.
jmp 0x14002c5c8
lea rdx, str.client.dll
lea rcx, [rbp - 0x78]
call fcn.1400017d0
mov rdx, rax
call fcn.140001970
mov rbx, rax
test rax, rax
je 0x14002c5c1
lea rdx, [0x14003b340]
lea rcx, [rbp + 0x10]
call fcn.14002c8d0
mov rdx, rbx
mov rcx, rax
call fcn.14002d4a0
test rax, rax
je 0x14002c5c1
sub eax, ebx
mov dword [0x14003baa0], eax
lea rdx, [0x14003b380]
lea rcx, [rbp + 0x30]
call fcn.14002c8d0
mov rdx, rbx
mov rcx, rax
call fcn.14002d4a0
test rax, rax
je 0x14002c5c1
sub eax, ebx
mov dword [0x14003baa8], eax
lea rdx, [0x14003b360]
lea rcx, [rbp + 0x60]
call fcn.14002c8d0
mov rdx, rbx
mov rcx, rax
call fcn.14002d4a0
test rax, rax
je 0x14002c5c1
sub eax, ebx
add eax, 0x138
mov dword [0x14003baa4], eax
lea rdx, str.client.dll
lea rcx, [rbp + 0x60]
call fcn.1400017d0
mov rdx, rax
call fcn.140001970
mov qword [0x14003ba60], rax
mov ecx, dword [0x14003baa0]
add rcx, rax
mov qword [0x14003ba68], rcx
mov ecx, dword [0x14003baa8]
add rcx, rax
mov qword [0x14003ba88], rcx
mov ecx, dword [0x14003baa4]
add rcx, rax
mov qword [0x14003ba90], rcx
test rax, rax
jne 0x14002baba
lea rdx, str.Failed_to_call_InitAddress__.
jmp 0x14002c5c8
mov ecx, 8
call fcn.14002d7a0
lea rcx, [0x14002b4b0]
mov qword [rax], rcx
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14002cba0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x58], rax
test rax, rax
je 0x14002c5b1
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rbp - 0x40], 0x50
mov dword [rbp - 0x3c], 0x40
lea rax, [0x14002c720]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm1
lea rbx, [0x140034dcc]
mov qword [rbp], rbx
mov qword [rbp + 8], r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov eax, dword [rbp + 0x5c]
cdq
sub eax, edx
sar eax, 1
lea r9d, [rax - 0x20]
mov eax, dword [rbp + 0x58]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x96
mov qword [rsp + 0x58], r14
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 0x41
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
mov r8, rbx
mov rdx, qword [rbp]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x14003bae8], rax
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14003bae8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [0x14003bae8]
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rcx, rax
mov qword [0x14003bd78], rax
test rax, rax
je 0x14002bc71
mov r15d, 1
mov dword [0x14003bdb8], r15d
mov dword [0x14003bda8], r15d
mov qword [0x14003bdb0], rbx
mov rax, qword [rax]
lea rdx, [0x14003bd80]
mov qword [rsp + 0x30], rdx
lea rdx, [0x14003bd90]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x20
mov r9, rbx
mov r8d, r15d
xor edx, edx
call qword [rax + 0x80]
test eax, eax
je 0x14002bc8d
mov rcx, qword [0x14003bd78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14002c620
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [0x14003bad0]
test rax, rax
je 0x14002bc9f
inc dword [rax + 0x3b4]
mov ecx, 0x3ee8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x68]
mov qword [rbp - 0x80], rcx
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14002bcce
xor edx, edx
mov rcx, rax
call fcn.140001db0
jmp 0x14002bcd1
mov rax, r14
cmp qword [0x14003bad0], 0
jne 0x14002bce2
mov qword [0x14003bad0], rax
mov rcx, rax
call fcn.140007940
xor ecx, ecx
call fcn.14001c800
mov rbx, qword [0x14003bae8]
lea rcx, [0x14003bd70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14002be83
lea rcx, [0x14003bd68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14002be83
mov qword [0x14003bd60], rbx
mov rax, qword [0x14003bad0]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], rbx
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
lea rax, str.xinput1_4.dll
mov qword [rbp + 0x60], rax
lea rax, str.xinput1_3.dll
mov qword [rbp + 0x68], rax
lea rax, str.xinput9_1_0.dll
mov qword [rbp + 0x70], rax
lea rax, str.xinput1_2.dll
mov qword [rbp + 0x78], rax
lea rax, str.xinput1_1.dll
mov qword [rbp + 0x80], rax
mov rbx, r14
nop
mov rcx, qword [rbp + rbx*8 + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14002be4e
inc rbx
cmp rbx, 5
jl 0x14002be30
jmp 0x14002be83
mov qword [0x14003bd48], rdi
lea rdx, str.XInputGetCapabilities
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003bd50], rax
lea rdx, str.XInputGetState
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003bd58], rax
mov rcx, qword [0x14003bd80]
mov rax, qword [0x14003bad0]
lea rdx, str.imgui_impl_dx9
mov qword [rax + 0xe0], rdx
or dword [rax + 0xc], 8
mov qword [0x14003bd30], rcx
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [0x14003bad0]
mov dword [rax + 0x1564], 0x41200000
mov dword [rax + 0x1568], 0x41000000
mov dword [rax + 0x157c], 0x3f000000
mov dword [rax + 0x1580], 0x3f000000
movaps xmm0, xmmword [0x140035040]
movups xmmword [rax + 0x1694], xmm0
movaps xmm1, xmm0
movups xmmword [rax + 0x16a4], xmm0
movups xmmword [rax + 0x16b4], xmm0
movaps xmm1, xmmword [0x140035070]
movups xmmword [rax + 0x16d4], xmm1
movups xmmword [rax + 0x1714], xmm0
movaps xmm1, xmmword [0x140035080]
movups xmmword [rax + 0x1724], xmm1
movaps xmm0, xmmword [0x140035090]
movups xmmword [rax + 0x1734], xmm0
movaps xmm1, xmmword [0x1400350a0]
movups xmmword [rax + 0x1744], xmm1
movaps xmm0, xmmword [0x140035080]
movups xmmword [rax + 0x1754], xmm0
movups xmmword [rax + 0x1764], xmm1
movaps xmm0, xmmword [0x140035020]
movups xmmword [rax + 0x1774], xmm0
movaps xmm1, xmmword [0x140035080]
movups xmmword [rax + 0x1784], xmm1
movaps xmm0, xmmword [0x1400350a0]
movups xmmword [rax + 0x1794], xmm0
movaps xmm1, xmmword [0x140035040]
movups xmmword [rax + 0x17a4], xmm1
movaps xmm0, xmmword [0x140035080]
movups xmmword [rax + 0x17b4], xmm0
movaps xmm1, xmmword [0x1400350a0]
movups xmmword [rax + 0x17c4], xmm1
movaps xmm0, xmmword [0x140035030]
movups xmmword [rax + 0x1914], xmm0
movaps xmm1, xmmword [0x1400350b0]
movups xmmword [rax + 0x17d4], xmm1
movaps xmm0, xmmword [0x140035020]
movups xmmword [rax + 0x1834], xmm0
movaps xmm1, xmmword [0x140035080]
movups xmmword [rax + 0x1844], xmm1
movaps xmm0, xmmword [0x1400350a0]
movups xmmword [rax + 0x1854], xmm0
movaps xmm1, xmmword [0x140035020]
movups xmmword [rax + 0x1864], xmm1
movaps xmm0, xmmword [0x140035030]
movups xmmword [rax + 0x1874], xmm0
xor dil, dil
mov esi, r14d
movss xmm7, dword [0x140034f84]
movss xmm8, dword [0x140034eec]
nop
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x60]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14002c084
nop dword [rax + rax]
lea rcx, [rbp + 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
movzx edi, dil
cmp dword [rbp + 0x68], 0x12
cmove edi, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x60]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14002c040
test dil, dil
jne 0x14002c3f2
inc esi
cmp qword [0x14003bd20], 0
jne 0x14002c09f
cmp qword [0x14003bd30], 0
je 0x14002c09f
call fcn.140026640
call fcn.140026c90
call fcn.1400066c0
mov rax, qword [0x14003bad0]
mov qword [rax + 0x1cc0], r14
mov qword [rax + 0x1cc8], r14
mov dword [rax + 0x1cb4], r15d
or dword [rax + 0x1cb0], 3
mov dword [rax + 0x1cd0], 0x43960000
mov dword [rax + 0x1cd4], 0x42820000
mov dword [rax + 0x1cb8], 2
xor edx, edx
mov r8d, 0x4826
lea rcx, str.xvisual___CS_2_by_xvorost
call fcn.14000b970
mov rcx, qword [0x14003bad0]
mov rax, qword [rcx + 0x1c10]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1c10]
cmp byte [rax + 0x93], 0
jne 0x14002c139
mov qword [rsp + 0x6c], 0
movaps xmm1, xmm7
lea rcx, [rsp + 0x6c]
call fcn.14000e3a0
lea rcx, [0x140034a94]
call fcn.140028ad0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.14000e630
lea rcx, str.Enable_Glow:
call fcn.140028c90
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.14000e630
call fcn.14002a580
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.14000e630
lea rcx, str.
call fcn.140028ad0
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.14000e630
movaps xmm6, xmmword [0x1400350a0]
mov rbx, qword [0x14003bad0]
mov dword [rbp - 0x78], 0x15
movups xmm0, xmmword [rbx + 0x1774]
movups xmmword [rbp - 0x74], xmm0
lea rcx, [rbx + 0x1d38]
lea rdx, [rbp - 0x78]
call fcn.1400149c0
movups xmmword [rbx + 0x1774], xmm6
mov qword [rsp + 0x78], 0
lea rdx, [rsp + 0x78]
lea rcx, [0x140034e1c]
call fcn.140029850
test al, al
je 0x14002c1f5
mov edx, 6
mov rcx, qword [0x14003bae8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [0x14003bad0]
movsxd rax, dword [rbx + 0x1d38]
lea rdx, [rax + rax*4]
mov rcx, qword [rbx + 0x1d40]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [rbx + rax*8 + 0x1624], xmm0
dec dword [rbx + 0x1d38]
movaps xmm1, xmm7
xorps xmm0, xmm0
call fcn.14000e630
movaps xmm6, xmmword [0x1400350a0]
mov dword [rbp - 0x78], 0x15
movups xmm0, xmmword [rbx + 0x1774]
movups xmmword [rbp - 0x74], xmm0
lea rdx, [rbp - 0x78]
lea rcx, [rbx + 0x1d38]
call fcn.1400149c0
movups xmmword [rbx + 0x1774], xmm6
mov qword [rbp - 0x80], 0
lea rdx, [rbp - 0x80]
lea rcx, [0x140030928]
call fcn.140029850
test al, al
jne 0x14002c585
mov r8, qword [0x14003bad0]
movsxd rax, dword [r8 + 0x1d38]
lea rdx, [rax + rax*4]
mov rcx, qword [r8 + 0x1d40]
movsxd rax, dword [rcx + rdx*4 - 0x14]
add rax, rax
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
movups xmmword [r8 + rax*8 + 0x1624], xmm0
dec dword [r8 + 0x1d38]
call fcn.14000dd10
cmp esi, 0x3e8
jl 0x14002c2d7
mov rcx, qword [0x14003bae8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov esi, r14d
call fcn.140008790
mov rcx, qword [0x14003bd80]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x14003bd80]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x14003bd80]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0xae
call qword [rax + 0x1c8]
mov rcx, qword [0x14003bd80]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r14d
movss dword [rsp + 0x28], xmm8
mov dword [rsp + 0x20], 0xff728c99
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x14003bd80]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14002c3a1
call fcn.140008b10
mov rax, qword [0x14003bad0]
mov rax, qword [rax + 0x1dc0]
mov rcx, qword [rax]
add rcx, 0x40
mov rax, r14
cmp byte [rcx], r14b
cmovne rax, rcx
mov rcx, rax
call fcn.140026070
mov rcx, qword [0x14003bd80]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14003bd80]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14002c3de
mov rcx, qword [0x14003bd80]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14002c3de
call fcn.14002c670
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x60]
call fcn.14002c9f0
jmp 0x14002c020
mov rcx, qword [0x14003bd30]
test rcx, rcx
je 0x14002c48f
mov rdx, qword [0x14003bd38]
test rdx, rdx
je 0x14002c425
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14003bd38], r14
mov rcx, qword [0x14003bd30]
mov rdx, qword [0x14003bd28]
test rdx, rdx
je 0x14002c448
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14003bd28], r14
mov rcx, qword [0x14003bd30]
mov rdx, qword [0x14003bd20]
test rdx, rdx
je 0x14002c47d
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14003bd20], r14
mov rax, qword [0x14003bad0]
mov rcx, qword [rax + 0xa8]
mov qword [rcx + 8], r14
mov rcx, qword [0x14003bd30]
test rcx, rcx
je 0x14002c48f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14003bd30], r14
mov rcx, qword [0x14003bd48]
test rcx, rcx
je 0x14002c4a1
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14003bd48], r14
mov qword [0x14003bd50], r14
mov qword [0x14003bd58], r14
mov qword [0x14003bd60], r14
mov qword [0x14003bd68], r14
mov qword [0x14003bd70], r14
mov dword [0x14003b2d0], 9
mov byte [0x14003bd40], 0
mov byte [0x14003b054], 1
mov rbx, qword [0x14003bad0]
mov rcx, rbx
call fcn.140007c30
cmp qword [0x14003bad0], rbx
jne 0x14002c502
mov qword [0x14003bad0], r14
test rbx, rbx
je 0x14002c52a
mov rcx, rbx
call fcn.140015100
mov rax, qword [0x14003bad0]
test rax, rax
je 0x14002c521
dec dword [rax + 0x3b4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14003bd80]
test rcx, rcx
je 0x14002c543
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14003bd80], r14
mov rcx, qword [0x14003bd78]
test rcx, rcx
je 0x14002c55c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14003bd78], r14
mov rcx, qword [0x14003bae8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_UnregisterClassW]
nop
cmp dword [rbp - 0x50], 0
je 0x14002c5dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [0x140034e20]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov dword [rbp - 0x50], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, str.Failed_to_update_offsets.
mov r9d, 0x10
lea r8, str.Error
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14002d780
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret