Function at 0x1400017f0
Capabilities:
Accept command line arguments
Delete file
Print debug messages
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0xdf0]
sub rsp, 0xef0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xdc0], rax
lea rcx, [0x140001790]
call fcn.14000c194
lea rcx, [0x1400017c0]
call fcn.14000c248
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140018930
lea rax, [rsp + 0x44]
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x30], rax
lea r8, str.SteamPath
lea rax, [rsp + 0x50]
mov dword [rsp + 0x44], 0x104
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareValveSteam
lea rax, [rsp + 0x48]
mov r9d, 2
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400018b0
mov r9d, 0x10
lea r8, str.x64launcher
lea rdx, str.Failed_to_get_Steam_path_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001ea8
mov qword [rsp + 0xf00], rbx
lea rcx, [rbp + 0x160]
mov qword [rsp + 0xf08], rsi
xor edx, edx
mov qword [rsp + 0xf10], rdi
mov r8d, 0x208
mov qword [rsp + 0xee8], r12
mov qword [rsp + 0xed8], r14
mov qword [rsp + 0xed0], r15
call fcn.140018930
xor edx, edx
lea rcx, [rbp + 0x370]
mov r8d, 0x208
call fcn.140018930
xor edx, edx
lea rcx, [rbp + 0x580]
mov r8d, 0x208
call fcn.140018930
xor edx, edx
lea rcx, [rbp + 0x790]
mov r8d, 0x208
call fcn.140018930
xor edx, edx
lea rcx, [rbp + 0x9a0]
mov r8d, 0x208
call fcn.140018930
xor edx, edx
lea rcx, [rbp + 0xbb0]
mov r8d, 0x208
call fcn.140018930
lea rax, [rsp + 0x50]
mov r12, 0xffffffffffffffff
mov r8, r12
mov qword [rsp + 0x20], rax
lea r9, str._sPatchingDone.bin
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.140001010
mov edi, eax
lea r9, str._sStealthMode.bin
lea rax, [rsp + 0x50]
mov r8, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x370]
call fcn.140001010
mov r14d, eax
lea r9, str._sGameOverlayRenderer64.dll
lea rax, [rsp + 0x50]
mov r8, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x580]
call fcn.140001010
mov r15d, eax
lea r9, str._sDenuvoActivationBypass.dll
lea rax, [rsp + 0x50]
mov r8, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x790]
call fcn.140001010
mov esi, eax
lea r9, str._sDenuvoOfflineActivationBypass.dll
lea rax, [rsp + 0x50]
mov r8, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x9a0]
call fcn.140001010
mov ebx, eax
lea r9, str._sGreenLuma_2023_x64.dll
lea rax, [rsp + 0x50]
mov r8, r12
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0xbb0]
call fcn.140001010
cmp edi, r12d
je 0x1400020db
cmp r14d, r12d
je 0x1400020db
cmp r15d, r12d
je 0x1400020db
cmp esi, r12d
je 0x1400020db
cmp ebx, r12d
je 0x1400020db
cmp eax, r12d
je 0x1400020db
xor edi, edi
mov qword [rsp + 0xee0], r13
mov qword [rsp + 0x30], rdi
lea r8d, [r12 + 2]
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x370]
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor edx, edx
xor r13b, r13b
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x140001ac9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13b, 1
lea rdx, [0x14001a4c0]
mov ecx, 0x1020
call fcn.140002148
mov rbx, rax
test rax, rax
je 0x1400020c2
mov qword [rax], rdi
mov ecx, 0x800
mov qword [rax + 8], rdi
mov dword [rax + 0x10], edi
lea rdi, [rax + 0x18]
xor eax, eax
rep stosb byte [rdi], al
lea rdi, [rbx + 0x818]
mov ecx, 0x800
rep stosb byte [rdi], al
mov byte [rbx + 0x1018], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp byte [rbx + 0x1018], 0
mov rdi, rax
jne 0x140001b43
lea rcx, str.CommandlineLib_is_not_initialized___1__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
test rdi, rdi
jne 0x140001b67
lea rcx, str.Commandline_is_nullptr__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov r8, r12
mov rax, r12
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140001b70
add rax, 2
mov qword [rbx + 8], rax
test rax, 0xfffffffffffffffd
jne 0x140001bac
lea rcx, str.Commandline_length_is_invalid__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov rcx, qword [rbx + 8]
cmp rcx, 0x400
jbe 0x140001bc6
mov qword [rbx + 8], 0x400
mov ecx, 0x400
mov eax, 2
mul rcx
lea rdx, [0x14001a4c0]
mov r14, rax
cmovo r14, r8
mov rcx, r14
call fcn.140002140
mov r15, rax
test rax, rax
je 0x140001c01
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.140018930
mov qword [rbx], r15
xor r15d, r15d
jmp 0x140001c26
xor r15d, r15d
lea rcx, str.Failed_to_allocate_memory_for_commandline__n
mov qword [rbx], r15
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov rdx, qword [rbx + 8]
lea r9, [0x140022984]
mov rcx, qword [rbx]
mov r8, r12
mov qword [rsp + 0x20], rdi
call fcn.140001010
test eax, eax
jne 0x140001c64
lea rcx, str.Failed_to_build_commandline_string__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov rcx, rbx
call fcn.140001080
cmp byte [rbx + 0x1018], 0
jne 0x140001c94
lea rcx, str.CommandlineLib_is_not_initialized___5__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov esi, 1
cmp dword [rbx + 0x10], esi
jle 0x140001cc5
lea rdi, [rbx + 0x20]
mov rdx, qword [rdi]
test rdx, rdx
je 0x140001cba
lea rcx, str._hproc
call fcn.140008b5c
test eax, eax
je 0x140001cc8
inc esi
add rdi, 8
cmp esi, dword [rbx + 0x10]
jl 0x140001ca2
mov esi, r15d
cmp byte [rbx + 0x1018], 0
jne 0x140001cf0
lea rcx, str.CommandlineLib_is_not_initialized___5__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [rbx + 0x10], edi
jle 0x140001d23
lea r14, [rbx + 0x20]
nop
mov rdx, qword [r14]
test rdx, rdx
je 0x140001d18
lea rcx, str._hthread
call fcn.140008b5c
test eax, eax
je 0x140001d26
inc edi
add r14, 8
cmp edi, dword [rbx + 0x10]
jl 0x140001d00
mov edi, r15d
test esi, esi
je 0x140002066
test edi, edi
je 0x140002066
cmp byte [rbx + 0x1018], 0
jne 0x140001d86
lea rcx, str.CommandlineLib_is_not_initialized___6__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov edi, 1
cmp dword [rbx + 0x10], edi
jle 0x140001dbb
lea rsi, [rbx + 0x20]
mov rdx, qword [rsi]
test rdx, rdx
je 0x140001db0
lea rcx, str._hproc
call fcn.140008b5c
test eax, eax
je 0x140001ec2
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x10]
jl 0x140001d94
mov rax, r15
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call fcn.140009568
mov rcx, rbx
movsxd rsi, eax
call fcn.1400013c0
mov rdi, qword [rbx]
mov byte [rbx + 0x1018], 0
test rdi, rdi
je 0x140001e05
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001e05
add rcx, rcx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx]
call fcn.140002130
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov edx, 0x1020
mov rcx, rbx
call fcn.140002130
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x44], r15d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140001e70
cmp dword [rsp + 0x44], 1
je 0x140001e70
lea r8, [rsp + 0x40]
mov byte [rsp + 0x40], 0
lea rdx, [rbp + 0x580]
mov rcx, rsi
call fcn.140001470
cmp byte [rsp + 0x40], 1
jne 0x140001efa
mov r9d, 0x10
lea r8, str.x64launcher
lea rdx, str.Fatal_error_while_injecting_Overlay_dll_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r13, qword [rsp + 0xee0]
mov r14, qword [rsp + 0xed8]
mov r12, qword [rsp + 0xee8]
mov rdi, qword [rsp + 0xf10]
mov rsi, qword [rsp + 0xf08]
mov rbx, qword [rsp + 0xf00]
mov r15, qword [rsp + 0xed0]
xor eax, eax
mov rcx, qword [rbp + 0xdc0]
xor rcx, rsp
call fcn.140002110
add rsp, 0xef0
pop rbp
ret
test edi, edi
je 0x140001dbb
mov eax, dword [rbx + 0x10]
dec eax
cmp edi, eax
je 0x140001dbb
movsxd rax, edi
mov edx, 0xfffd
mov rcx, qword [rbx + rax*8 + 0x20]
movzx eax, word [rcx]
sub ax, 0x2b
test dx, ax
mov rax, r15
cmovne rax, rcx
jmp 0x140001dbe
test r13b, r13b
jne 0x140001e70
lea r8, [rsp + 0x40]
mov byte [rsp + 0x40], r13b
lea rdx, [rbp + 0x790]
mov rcx, rsi
call fcn.140001470
cmp byte [rsp + 0x40], 1
jne 0x140001f3c
mov r9d, 0x10
lea r8, str.x64launcher
lea rdx, str.Fatal_error_while_injecting_Denuvo_dll_
jmp 0x140001e68
lea r8, [rsp + 0x40]
mov byte [rsp + 0x40], 0
lea rdx, [rbp + 0x9a0]
mov rcx, rsi
call fcn.140001470
cmp byte [rsp + 0x40], 1
jne 0x140001f75
mov r9d, 0x10
lea r8, str.x64launcher
lea rdx, str.Fatal_error_while_injecting_Offline_Denuvo_dll_
jmp 0x140001e68
lea r8, [rsp + 0x40]
mov byte [rsp + 0x40], 0
lea rdx, [rbp + 0xbb0]
mov rcx, rsi
call fcn.140001470
cmp byte [rsp + 0x40], 1
jne 0x140001fae
mov r9d, 0x10
lea r8, str.x64launcher
lea rdx, str.Fatal_error_while_injecting_GreenLuma_2023_dll_
jmp 0x140001e68
cmp dword [0x140027cd0], 2
jle 0x140001fd0
lea rdx, str.Dlls_failed_to_load_
mov r9d, 0x10
lea r8, str.x64launcher
jmp 0x140001e68
cmp al, 1
jne 0x140001e70
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x160]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
jne 0x14000204b
nop dword [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x160]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r12
je 0x140002010
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140001e70
mov rcx, rbx
call fcn.1400013c0
mov rdi, qword [rbx]
mov byte [rbx + 0x1018], 0
test rdi, rdi
je 0x14000209c
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000209c
add rcx, rcx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx]
call fcn.140002130
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov edx, 0x1020
mov rcx, rbx
call fcn.140002130
lea rdx, str.Found_no_valid_parameters_
mov r9d, 0x10
lea r8, str.x64launcher
jmp 0x140001e68
mov r9d, 0x10
lea r8, str.x64launcher
lea rdx, str.Failed_to_allocate_memory_for_commandline_class_
jmp 0x140001e68
mov r9d, 0x10
lea r8, str.x64launcher
lea rdx, str.Failed_to_build_file_paths_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001e78