Function at 0x1400923f0
Capabilities:
Create directory
Enumerate process modules
Get common file path

Disassembly:
push rbp
push rbx
push rdi
push r12
push r15
lea rbp, [rsp - 0xe80]
sub rsp, 0xf80
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rbp + 0xe70], rax
xor edx, edx
mov r12, rcx
mov r15d, r9d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, qword [rbp + 0x8e0]
mov rbx, rax
mov dword [rbp + 0xa20], 0x238
nop dword [rax]
lea rdx, str.cs2.exe
lea rcx, [rbp + 0xa4c]
call fcn.1400ae890
test eax, eax
jne 0x14009247d
mov edi, dword [rbp + 0xa28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14012f2d8], rax
lea rdx, [rbp + 0xa20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140092440
test edi, edi
je 0x140092c47
mov edx, edi
mov qword [rsp + 0xfb8], r13
lea ecx, [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x4a0], 0x438
nop dword [rax]
lea rdx, str.client.dll
lea rcx, [rbp + 0x4d0]
call fcn.1400ae890
xor r13d, r13d
mov rcx, rbx
test eax, eax
je 0x1400924f4
lea rdx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400924c0
mov qword [rbp - 0x80], r13
jmp 0x140092505
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x4c8]
mov qword [rbp - 0x80], rax
mov edx, edi
mov ecx, 0x18
mov rbx, r13
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x438
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14009255b
lea rdx, str.client.dll
lea rcx, [rbp + 0x90]
call fcn.1400ae890
test eax, eax
lea rdx, [rbp + 0x60]
mov rcx, rdi
cmove rbx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140092530
xorps xmm0, xmm0
mov qword [rbp - 0x78], rbx
lea rdx, [rbp - 0x60]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
call fcn.140003320
mov rax, qword gs:[0x58]
xorps xmm0, xmm0
mov edx, 4
movups xmmword [rbp - 0x30], xmm0
mov rcx, qword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov eax, dword [rdx + rcx]
cmp dword [0x140164e00], eax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
jle 0x1400925e9
lea rcx, [0x140164e00]
call fcn.1400944d0
cmp dword [0x140164e00], 0xffffffff
jne 0x1400925e9
xor ecx, ecx
call fcn.1400a3964
lea rcx, [0x140164e00]
mov qword [0x140164e08], rax
call fcn.140094470
lea rax, str.In_game
mov qword [rbp - 0x30], rax
lea rcx, [0x140130550]
lea rax, str.cheatlogo
mov qword [rbp - 0x10], rax
mov rax, qword [0x140164e08]
mov qword [rbp - 0x20], rax
lea rax, str.Discord_Community
mov qword [rbp + 0x18], rax
lea rax, str.https:__discord.gg_U6TkyHXBZV
mov qword [rbp + 0x20], rax
call fcn.140095428
test eax, eax
jne 0x140092c54
mov r8d, dword [0x14012b3d4]
lea rcx, [0x140160bc8]
lea eax, [r8 + 1]
mov dword [0x14012b3d4], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call fcn.140006bc0
mov qword [0x140160bc0], rax
lea rcx, [0x140130550]
mov eax, 1
xchg byte [0x14013054e], al
call fcn.14009544c
mov rcx, qword [0x140160758]
test rcx, rcx
je 0x14009268d
add rcx, 0x58
call fcn.1400954d4
xor edx, edx
lea rcx, str.C:_autostop_
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:_autostopconfigs_
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:_autostoploader_
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rbp + 0xc60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xorps xmm0, xmm0
mov qword [rsp + 0x70], r13
mov r8d, 6
mov qword [rsp + 0x78], r13
lea rdx, str._fonts
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.140009bd0
lea rax, [rbp + 0xc60]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], r13w
jne 0x140092703
mov rcx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rax, rcx
sub rax, r8
cmp rbx, rax
ja 0x1400927f6
mov qword [rsp + 0xfb0], rsi
lea rax, [r8 + rbx]
mov qword [rsp + 0x70], rax
lea rsi, [rsp + 0x60]
cmp rcx, 8
mov qword [rsp + 0xfc0], r14
lea rax, [rbp + 0xc60]
cmovae rsi, qword [rsp + 0x60]
lea rax, [rax + rbx*2]
cmp rax, rsi
jbe 0x140092791
lea rax, [rsi + r8*2]
lea rcx, [rbp + 0xc60]
cmp rcx, rax
ja 0x140092791
lea rax, [rbp + 0xc60]
cmp rsi, rax
ja 0x14009277f
mov r14, r13
jmp 0x140092794
lea rax, [rbp + 0xc60]
mov r14, rsi
sub r14, rax
sar r14, 1
jmp 0x140092794
mov r14, rbx
lea rcx, [rsi + rbx*2]
mov rdx, rsi
lea r8, [r8*2 + 2]
call fcn.140099920
lea rdi, [r14 + r14]
mov rcx, rsi
mov r8, rdi
lea rdx, [rbp + 0xc60]
call fcn.140099920
lea rax, [r14 + rbx]
mov r8, rbx
sub r8, r14
lea rdx, [rbp + 0xc60]
add r8, r8
lea rdx, [rdx + rax*2]
lea rcx, [rdi + rsi]
call fcn.140099920
mov r14, qword [rsp + 0xfc0]
lea rax, [rsp + 0x60]
mov rsi, qword [rsp + 0xfb0]
jmp 0x140092814
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x28], rbx
mov rdx, rbx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
call fcn.140092e00
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x8f8], xmm0
movdqu xmmword [rbp + 0x908], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x8f8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x908], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140092890
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009288b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092c5c
call fcn.140094370
cmp qword [rbp + 0x910], 8
lea rcx, [rbp + 0x8f8]
cmovae rcx, qword [rbp + 0x8f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.140092020
xorps xmm0, xmm0
mov dword [rbp + 0x9c8], 0xb000
xor eax, eax
mov dword [rbp + 0x9cc], 0xa000
mov qword [rbp + 0x938], rax
xorps xmm1, xmm1
mov qword [rbp + 0x9f0], rax
mov ecx, 1
mov qword [rbp + 0x9c0], rax
lea rax, [0x140091fa0]
mov qword [rbp + 0x930], rax
lea rax, str.autostop
mov qword [rbp + 0x968], rax
movups xmmword [rbp + 0x948], xmm0
mov qword [rbp + 0x9f8], r13
movups xmmword [rbp + 0x958], xmm0
mov qword [rbp + 0x920], r12
movups xmmword [rbp + 0x970], xmm1
mov dword [rbp + 0x928], 0x50
movups xmmword [rbp + 0x980], xmm0
mov qword [rbp + 0x940], r12
movups xmmword [rbp + 0x990], xmm0
mov dword [rbp + 0x92c], 3
movups xmmword [rbp + 0x9a0], xmm0
movups xmmword [rbp + 0x9b0], xmm0
movdqa xmmword [rbp + 0x9d0], xmm0
movdqa xmmword [rbp + 0x9e0], xmm1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea rcx, [rbp + 0x928]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rbp + 0x940]
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x968]
mov ecx, 0x80028
mov qword [rsp + 0x58], r13
mov r8, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 0x438
mov dword [rsp + 0x30], 0x780
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r9d, 2
mov r8b, 0xff
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xorps xmm0, xmm0
mov qword [rbp + 0x978], rbx
lea rdx, [rbp + 0xa00]
mov rcx, rbx
movups xmmword [rbp + 0xa00], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rbp + 0x978]
lea rdx, [rbp + 0xa10]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa10], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rbp + 0x978]
lea rdx, [rbp + 0x8e0]
mov qword [rbp + 0x8e0], r13
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0x8e0]
mov dword [rbp + 0x8e8], eax
mov eax, dword [rbp + 0x8e4]
mov dword [rbp + 0x8ec], eax
mov eax, dword [rbp + 0xa08]
mov dword [rbp + 0x8f0], eax
mov eax, dword [rbp + 0xa0c]
mov dword [rbp + 0x8f4], eax
mov rcx, qword [rbp + 0x978]
lea rdx, [rbp + 0x8e8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rax, qword [rbp + 0x978]
xor r9d, r9d
mov qword [rbp + 0x9b0], rax
xor r8d, r8d
lea rax, [rbp + 0x9d8]
mov dword [rbp + 0x988], 0x3c
mov qword [rsp + 0x58], rax
xor ecx, ecx
lea rax, [rbp + 0x9f0]
mov dword [rbp + 0x98c], 1
mov qword [rsp + 0x50], rax
lea edx, [r9 + 1]
lea rax, [rbp + 0x9d0]
mov dword [rbp + 0x990], 0x1c
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x9e0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x980]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x9c8]
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x99c], 1
mov dword [rbp + 0x9a4], 0x20
mov dword [rbp + 0x9a8], 2
mov qword [rbp + 0x9b8], 1
mov dword [rbp + 0x9c0], 2
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
mov rcx, qword [rbp + 0x9e0]
lea r9, [rbp + 0x9f8]
lea r8, [0x1401008e0]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rdx, qword [rbp + 0x9f8]
test rdx, rdx
je 0x140092ba6
mov rcx, qword [rbp + 0x9d0]
lea r9, [rbp + 0x9e8]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x9f8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edx, r15d
lea rcx, [rbp + 0x920]
call fcn.140038db0
movups xmm0, xmmword [rbp - 0x80]
lea rdx, [rbp - 0x60]
movsd xmm1, qword [rbp - 0x70]
lea rcx, [rbp + 0x920]
movaps xmmword [rbp - 0x60], xmm0
movsd qword [rbp - 0x50], xmm1
call fcn.140038f90
mov rdx, qword [rbp + 0x910]
cmp rdx, 8
jb 0x140092c19
mov rcx, qword [rbp + 0x8f8]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140092c14
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092c41
call fcn.140094370
mov r13, qword [rsp + 0xfb8]
xor eax, eax
mov rcx, qword [rbp + 0xe70]
xor rcx, rsp
call fcn.1400940b0
add rsp, 0xf80
pop r15
pop r12
pop rdi
pop rbx
pop rbp
ret
call fcn.1400a3d98
int3
mov rcx, 0xffffffffffffffff
call fcn.1400aa4ac
int3
mov ecx, eax
call fcn.140095714
int3
call fcn.1400a3d98
int3