Function at 0x140001d80
Capabilities:
Create process on windows
Create process suspended
Enumerate gui resources
Execute command
Get common file path
Get file size
Read .ini file
Read file on windows
Resume thread
Self delete
Set console window title
Set current directory
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x440], rax
lea rcx, str.Pipsi_ZZZ_:_Nov__7_2024
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
test eax, eax
je 0x140002491
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x220]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x110]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140001e70
lea r9, [rbp]
lea r8, str._sSettings.ini
mov edx, 0x104
lea rcx, [rbp + 0x110]
call fcn.140001010
lea rax, [rbp + 0x110]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0x220]
lea r8, [0x140004530]
lea rdx, str.Executable
lea rcx, str.Settings
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x140001f2d
lea rcx, str.Select_the_executable_game_file.._n
call fcn.140001190
lea rdx, [rbp + 0x110]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140002478
mov dword [rbp], 0x98
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x88], xmm0
lea rax, [rbp + 0x220]
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x38], 0x104
lea rax, str.Executable_File__ZenlessZoneZero.exe_
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x2c], 1
mov dword [rbp + 0x60], 0x1800
lea rcx, [rbp]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
test eax, eax
je 0x140002478
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x140002478
lea r8, [rbp + 0x220]
call fcn.140001070
test eax, eax
je 0x140002074
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x330]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x220]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001f50
cmp ebx, 0x104
jae 0x140001f94
lea r8, [rbp + 0x220]
mov edx, 0x104
lea rcx, [rbp + 0x330]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
sub ebx, 1
movsxd rax, ebx
js 0x140001f94
cmp byte [rbp + rax + 0x330], 0x5c
je 0x140001fa0
dec ebx
sub rax, 1
jns 0x140001f82
lea rcx, str.Failed_to_remove_file_specification_from_the_path._n
jmp 0x14000247f
movsxd rax, ebx
mov byte [rbp + rax + 0x330], 0
lea r8, str.GameAssembly.dll
mov edx, 0x104
lea rcx, [rbp + 0x330]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
xor r14d, r14d
mov dword [rbp - 0x78], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140002051
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002048
mov ecx, esi
call fcn.140002638
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x78]
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140002080
mov rcx, rbx
call fcn.140002604
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x330]
lea rcx, str.Failed_to_calculate_checksum_for__s_n
call fcn.140001190
xor r8d, r8d
call fcn.140001070
test eax, eax
jne 0x140002484
lea rcx, str.Failed_to_update_executable_path_in_settings._n
jmp 0x14000247f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x5a4d
mov rcx, rbx
cmp word [rbx], ax
je 0x14000209d
call fcn.140002604
jmp 0x140002051
movsxd rax, dword [rbx + 0x3c]
mov edi, dword [rax + rbx + 0x58]
call fcn.140002604
cmp edi, 0x19eaaaa0
je 0x1400020e4
mov r9d, edi
mov r8d, 0x19eaaaa0
lea rdx, [rbp + 0x330]
lea rcx, str.Invalid_checksum_for__s._Expected_0x_X__got_0x_X._n
call fcn.140001190
cmp edi, 0x19e48c05
jne 0x140002064
lea rcx, str.Checksum_matches_the_Global_version._Please_use_the_Global_version_of_the_tool._n
call fcn.140001190
jmp 0x140002064
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x110]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x110]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x14000246f
lea r9, [rbp + 0x110]
lea r8, str._sSettings.ini
mov edx, 0x104
lea rcx, [rbp]
call fcn.140001010
lea r9, [rbp]
mov r8d, 0x61a8
lea rdx, str.Delay
lea rcx, str.Settings
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
lea rdx, [rbp + 0x220]
lea rcx, str.Launching_executable__s.._n
call fcn.140001190
mov dword [rbp - 0x70], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x110]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x220]
lea rdx, [0x1400048dc]
lea rcx, [rbp + 0x110]
call fcn.140001130
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000221d
lea rcx, str.Failed_to_launch_the_executable_file._n
jmp 0x14000247f
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140002466
cmp qword [rsp + 0x58], r14
je 0x140002466
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], 0xa
mov qword [rbp - 0x80], 0xf
movsd xmm0, qword [str.Bypass.dll]
movsd qword [rsp + 0x68], xmm0
movzx eax, word [0x1400047f0]
mov word [rsp + 0x70], ax
mov byte [rsp + 0x72], r14b
lea rdx, [rsp + 0x68]
call fcn.140001c10
movzx ebx, al
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400022ba
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002604
test bl, bl
jne 0x140002302
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rcx, str.Failed_to_inject_the_DLL_into_the_process._n
call fcn.140001190
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002491
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14000244c
lea rcx, str.Waiting_for_the_game_window_to_initialize.._n
call fcn.140001190
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x70], r14
lea rdx, [rsp + 0x68]
lea rcx, [0x140002530]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x70], 0
jne 0x14000239a
nop dword [rax]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140002433
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x70], r14
lea rdx, [rsp + 0x68]
lea rcx, [0x140002530]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x70], 0
je 0x140002350
mov edx, edi
lea rcx, str.Waiting__i_ms_for_game_to_initialize.._n
call fcn.140001190
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], 9
mov qword [rbp - 0x80], 0xf
movsd xmm0, qword [str.Cheat.dll]
movsd qword [rsp + 0x68], xmm0
movzx eax, byte [0x1400048d8]
mov byte [rsp + 0x70], al
mov byte [rsp + 0x71], 0
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call fcn.140001c10
movzx ebx, al
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140002444
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000243f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000243f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, str.The_process_has_terminated_before_the_game_window_was_initialized._n
jmp 0x1400022d5
call fcn.140002604
test bl, bl
je 0x1400022be
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002496
lea rcx, str.Invalid_process_or_thread_handle._n
jmp 0x14000247f
lea rcx, str.Unable_to_retrieve_delay_setting_from_settings._n
jmp 0x14000247f
lea rcx, str.No_executable_file_selected._n
call fcn.140001190
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400025a0
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret