Function at 0x140004380
Capabilities:
Create thread
Execute command
Inject dll
Inject thread
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x288], rax
xor esi, esi
mov dword [rsp + 0x40], esi
lea rcx, str.LoginRose
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x48], rax
lea edx, [rsi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140007800]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
call sub.MSVCP140.dll__Xtime_get_ticks
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rcx, rdx, 0x2710
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
movups xmmword [rsp + 0x270], xmm0
mov r9d, dword [rax + 0x10]
inc r9d
mov r8d, dword [rax + 0x14]
add r8d, 0x76c
mov ecx, dword [rax + 8]
mov dword [rsp + 0x28], ecx
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
lea rdx, str._04d_02d_02d_02d
lea rcx, [rsp + 0x260]
call fcn.140004ca0
lea rcx, [rsp + 0x260]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
cmp eax, 0x78a57f91
jle 0x1400044ef
lea rdx, str._n_Execution_failed__an_error_occurred...._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
lea rdx, [0x1400079d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
mov rbx, rax
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
jmp 0x140004c2d
lea rax, [0x140007748]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0xe8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x40], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea r13, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x60], r13
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xd0], rsi
mov dword [rsp + 0xd8], 4
lea rcx, [rsp + 0x240]
call fcn.1400042b0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140004597
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140001580
mov rcx, rax
lea rdx, str.Rose_1_1_8
call fcn.140001120
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 0xf
jbe 0x1400045fa
inc rdx
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005378
lea rdx, str._n_File_extraction_directory_is:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
mov rbx, rax
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x60]
call fcn.1400040b0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140004631
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140001580
mov rcx, rax
lea rdx, [0x1400079ec]
call fcn.140001120
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 0xf
jbe 0x140004692
inc rdx
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000468d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000468d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005378
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x60]
call fcn.1400040b0
nop
lea rax, [rsp + 0x240]
mov qword [rsp + 0x50], rax
mov r14, qword [rsp + 0x270]
lea r15, [rsp + 0x260]
cmp qword [rsp + 0x278], 0xf
cmova r15, qword [rsp + 0x260]
call fcn.140004dd0
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
mov qword [rsp + 0x250], rsi
mov edi, 7
mov edx, edi
mov qword [rsp + 0x258], rdx
mov word [rsp + 0x240], si
mov dword [rsp + 0x40], 9
test r14, r14
je 0x14000479d
cmp r14, 0x7fffffff
ja 0x140004c61
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140004df8
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140004c69
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x240]
call fcn.140003d20
lea r9, [rsp + 0x240]
cmp qword [rsp + 0x258], rdi
cmova r9, qword [rsp + 0x240]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140004df8
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140004c74
mov rdx, qword [rsp + 0x258]
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x240]
cmp rdx, 7
cmova rcx, qword [rsp + 0x240]
call fcn.140004f0c
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140004c7e
mov rdx, qword [rsp + 0x258]
cmp rdx, 7
jbe 0x140004816
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004810
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004810
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005378
nop
jmp 0x140004825
lea r12, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
lea r14, [0x140007748]
call fcn.140002dc0
mov edx, 6
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rbx, str.RDR2.exe
mov rcx, rbx
call fcn.140002cf0
test eax, eax
jne 0x140004872
lea rbx, str.rdr2.exe
mov rcx, rbx
call fcn.140002cf0
test eax, eax
je 0x140004b45
mov rcx, rbx
call fcn.140002cf0
test eax, eax
je 0x140004b45
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov qword [rsp + 0x150], r14
lea rcx, [rsp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or edi, 0x10
mov dword [rsp + 0x40], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x150]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x150]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x150], r13
mov rax, qword [rsp + 0x150]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x14c], edx
lea rcx, [rsp + 0x158]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x1c0], rsi
mov dword [rsp + 0x1c8], 4
lea rcx, [rsp + 0x240]
call fcn.1400042b0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140004942
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.140001580
lea rdx, str.Rose_1_1_8_
mov rcx, rax
call fcn.140001120
mov rcx, rax
lea rdx, str.RoseMenu
call fcn.140001120
mov rcx, rax
lea rdx, str..dll
call fcn.140001120
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 0xf
jbe 0x1400049c6
inc rdx
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400049c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005378
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x150]
call fcn.1400040b0
mov rdi, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400049e8
mov rdi, qword [rax]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdi + r8], 0
jne 0x1400049f2
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
jne 0x140004a21
mov bl, 1
jmp 0x140004a99
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140004a21
mov r9, rbx
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140004a49
mov bl, 1
jmp 0x140004a99
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140004a8e
mov bl, 1
jmp 0x140004a99
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rsp + 0x258]
cmp rdx, 0xf
jbe 0x140004adf
inc rdx
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ada
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ada
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005378
test bl, bl
je 0x140004aed
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0x150]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x150], r13
mov rax, qword [rsp + 0x150]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x14c], edx
lea rcx, [rsp + 0x158]
call fcn.140002810
lea rcx, [rsp + 0x160]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140004b87
lea rdx, str._n_Failed__game_not_detected...._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
lea rdx, [0x1400079d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001120
mov rbx, rax
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
nop
mov rdx, qword [rsp + 0x278]
cmp rdx, 0xf
jbe 0x140004bcd
inc rdx
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005378
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], 0xf
mov byte [rsp + 0x260], 0
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x60], r13
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x68]
call fcn.140002810
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0xe8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140005490
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea ecx, [rdi + 0xf]
call fcn.1400034c0
shr rbx, 0x20
mov ecx, ebx
call fcn.140003500
shr rcx, 0x20
call fcn.140003500
nop
shr rdx, 0x20
lea r8, [rsp + 0x240]
lea rcx, str.create_directory
call fcn.140003450
int3