Function at 0x14004a780
Capabilities:
Enumerate processes
Execute command
Log keystrokes via polling
Set console window title
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x14005e1f8]
xor rax, rsp
mov qword [rbp + 0xb0], rax
lea rcx, str.Rust_Private
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x140054118]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtUserCreateDesktopEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005e660], rax
test rax, rax
je 0x14004a7f8
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Function_Setup_Successful_n
call fcn.140043810
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x140054118]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtUserCreateDesktopEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005e660], rax
test rax, rax
jne 0x14004a856
lea rdx, str.RustClient.exe
lea rcx, [0x14005e1d0]
call fcn.14004a2c0
cmp dword [0x14005e1d0], 0
je 0x14004a856
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x200], rbx
xorps xmm0, xmm0
mov qword [rsp + 0x208], rsi
mov qword [rsp + 0x210], rdi
mov qword [rsp + 0x1d8], r14
xor r14d, r14d
mov qword [rsp + 0x3c], r14
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x60], r14
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x30], 0xa6
mov dword [rsp + 0x34], 0x29a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x38], eax
xor r9d, r9d
lea rax, str.win32u.dll
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
call qword [0x14005e660]
lea rdx, [0x140054420]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp qword [rsp + 0x40], r14
je 0x14004a8f0
lea rdx, str.___Driver_Mapped__Loaded_n
call fcn.140043810
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Please_Launch_RustClient.exe_n
call fcn.140043810
cmp dword [0x14005e1d0], r14d
jne 0x14004ab24
mov qword [rsp + 0x1e8], r12
movabs rsi, 0x311cdad160000
mov qword [rsp + 0x1e0], r13
movabs r12, 0x7fffffffffffffff
mov qword [rsp + 0x1d0], r15
movabs r13, 0x7ffffffffff0bdbe
movaps xmmword [rsp + 0x1c0], xmm6
movabs r15, 0x112e0be826d694b3
movsd xmm6, qword [0x140054548]
nop word [rax + rax]
xor edx, edx
mov dword [rbp - 0x80], 0x130
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004a9fd
lea rdx, [rbp - 0x80]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
lea rdx, str.RustClient.exe
lea rcx, [rbp - 0x54]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rbx
test eax, eax
jne 0x14004a9b8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x78]
jmp 0x14004aa00
lea rdx, [rbp - 0x80]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14004a9f4
nop word [rax + rax]
lea rdx, str.RustClient.exe
lea rcx, [rbp - 0x54]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rbx
test eax, eax
je 0x14004a9ad
lea rdx, [rbp - 0x80]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14004a9d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
mov dword [0x14005e1d0], eax
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14004aa22
imul rax, rax, 0x64
jmp 0x14004aa40
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea rdi, [rax + 0xf4240]
cmp rax, r13
jle 0x14004aa50
mov rdi, r12
nop
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14004aa6c
imul rbx, rax, 0x64
jmp 0x14004aa8d
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rdi, rbx
je 0x14004aaf7
jl 0x14004aaf7
call sub.MSVCP140.dll__Xtime_get_ticks
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x14004aaba
mov rax, rsi
lea r8, [rcx + rsi]
jmp 0x14004aabe
lea r8, [rcx + rax]
add rcx, rax
mov rax, r15
imul rcx
lea rcx, [rsp + 0x68]
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x68], rdx
sub r8d, eax
mov dword [rsp + 0x70], r8d
call sub.MSVCP140.dll__Thrd_sleep
jmp 0x14004aa50
cmp dword [0x14005e1d0], r14d
je 0x14004a970
movaps xmm6, xmmword [rsp + 0x1c0]
mov r15, qword [rsp + 0x1d0]
mov r13, qword [rsp + 0x1e0]
mov r12, qword [rsp + 0x1e8]
lea rdx, str.RustClient.exe
lea rcx, [0x14005e1d0]
call fcn.140049bb0
mov rax, qword [0x14005e1d8]
lea rdx, str.GameAssembly.dll
lea rcx, [0x14005e1d0]
mov qword [0x14005e678], rax
call fcn.140049bb0
mov rax, qword [0x14005e1d8]
lea rdx, str.UnityPlayer.dll
lea rcx, [0x14005e1d0]
mov qword [0x14005e668], rax
call fcn.140049bb0
mov rax, qword [0x14005e1d8]
lea rcx, [0x140054490]
mov qword [0x14005e670], rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [0x14005e678]
lea rcx, str.RustClient.exe__0x_lx_n
call fcn.14001e110
mov rdx, qword [0x14005e668]
lea rcx, str.GameAssembly.dll__0x_lx_n
call fcn.14001e110
mov rdx, qword [0x14005e670]
lea rcx, str.UnityPlayer.dll__0x_lx_n
call fcn.14001e110
mov ecx, 1
call fcn.14004b080
mov rcx, qword [0x14005e6c0]
mov rsi, rax
call fcn.140048dd0
mov r14, qword [rsp + 0x1d8]
cmp eax, 3
je 0x14004abff
lea rcx, str.__render_____failed_to_setup_render._n
call fcn.14001e110
mov rdi, qword [0x14005e6c0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
nop dword [rax + rax]
mov rcx, qword [0x14005e5d0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x14005e5d0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [0x14005e5d0]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14004ac79
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call fcn.14000b350
mov rcx, qword [0x14005e5d0]
mov rbx, rax
mov qword [rax + 0xc8], rcx
lea rcx, [rsp + 0x68]
mov dword [rax + 0x10], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rsp + 0x68]
mov ecx, 1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe00], xmm0
movd xmm1, dword [rsp + 0x6c]
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0xe04], xmm1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14004acef
mov byte [rbx + 0xe08], 1
mov eax, dword [rbx + 0xe04]
mov dword [rbx + 0x36ec], eax
mov byte [rbx + 0x3740], 1
jmp 0x14004acf6
mov byte [rbx + 0xe08], 0
mov rcx, rdi
call fcn.1400470a0
cmp dword [rsp + 0x38], 0x12
jne 0x14004ac20
call fcn.140030010
call fcn.140030540
xor ecx, ecx
call fcn.140008ec0
mov rcx, qword [0x14005e5d0]
call qword [sym.imp.USER32.dll_DestroyWindow]
lea rcx, str.___Render_Setup_n
call fcn.14001e110
mov edx, 1
mov rcx, rsi
call fcn.14004af44
mov rdi, qword [rsp + 0x210]
xor eax, eax
mov rsi, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14004b060
add rsp, 0x1f0
pop rbp
ret