Function at 0x14001146f
Capabilities:
Enumerate process modules
Execute command
Read file via mapping
Terminate process

Disassembly:
jmp 0x1400265f0
push rbp
push rdi
mov eax, 0x1c48
call fcn.14001111d
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x586
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400360c0]
xor rax, rbp
mov qword [rbp + 0x1c08], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011668
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x203
mov r9d, 0x320
mov r8d, dword [rbp + 0x2c]
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_MoveWindow]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor ecx, ecx
call fcn.14001118b
lea rcx, str.Input:_Enter_Your_Online_Name:
call fcn.1400112bc
mov r8d, 0x64
lea rdx, [0x140036900]
lea rcx, [0x140032778]
call fcn.14001137f
mov eax, 1
imul rax, rax, 0xb
mov qword [rbp + 0x1bf8], rax
cmp qword [rbp + 0x1bf8], 0x64
jae 0x1400266c5
jmp 0x1400266ca
call fcn.1400114b5
lea rax, [0x140036900]
mov rcx, qword [rbp + 0x1bf8]
mov byte [rax + rcx], 0
lea rcx, [0x140032154]
call qword [sym.imp.ucrtbased.dll_system]
mov cl, 1
call fcn.14001118b
lea rcx, reloc.WS2_32.dll_ioctlsocket
call fcn.1400112bc
mov dword [rbp + 0x54], 0
lea rax, str.duckstation
mov qword [rbp + 0x78], rax
mov dword [rbp + 0x94], 0xffffffff
lea r8, [rbp + 0x10d4]
mov edx, 0x1000
lea rcx, [rbp + 0xc0]
call fcn.14001146a
mov eax, dword [rbp + 0x10d4]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x10f4], eax
mov dword [rbp + 0x1114], 0
jmp 0x140026760
mov eax, dword [rbp + 0x1114]
inc eax
mov dword [rbp + 0x1114], eax
mov eax, dword [rbp + 0x10f4]
cmp dword [rbp + 0x1114], eax
jae 0x140026881
movsxd rax, dword [rbp + 0x1114]
mov eax, dword [rbp + rax*4 + 0xc0]
mov dword [rbp + 0x1134], eax
cmp dword [rbp + 0x1134], 0
je 0x14002687c
mov r8d, dword [rbp + 0x1134]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x1158], rax
cmp qword [rbp + 0x1158], 0
je 0x14002687c
lea r9, [rbp + 0x1194]
mov r8d, 8
lea rdx, [rbp + 0x1178]
mov rcx, qword [rbp + 0x1158]
call fcn.140011028
test eax, eax
je 0x14002687c
mov r9d, 0x104
lea r8, [rbp + 0x11c0]
mov rdx, qword [rbp + 0x1178]
mov rcx, qword [rbp + 0x1158]
call fcn.1400110e6
mov eax, 2
imul rax, rax, 0
lea rax, [rbp + rax + 0x11c0]
mov qword [rbp + 0x13e8], rax
mov eax, 1
imul rax, rax, 0
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x13e8]
mov r8, qword [rbp + 0x78]
mov ecx, dword [r8 + rcx]
cmp dword [rdx + rax], ecx
jne 0x14002687c
mov eax, 1
imul rax, rax, 4
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rbp + 0x13e8]
mov r8, qword [rbp + 0x78]
mov ecx, dword [r8 + rcx]
cmp dword [rdx + rax], ecx
jne 0x14002687c
mov eax, dword [rbp + 0x54]
inc eax
mov dword [rbp + 0x54], eax
mov eax, dword [rbp + 0x1134]
mov dword [rbp + 0x94], eax
jmp 0x140026752
cmp dword [rbp + 0x54], 0
jne 0x1400268aa
lea rcx, str.Error:_DuckStation_is_not_running__n_n
call fcn.1400112bc
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
jmp 0x1400268b6
lea rcx, str.Client:_DuckStation_detected_n
call fcn.1400112bc
cmp dword [rbp + 0x54], 1
jle 0x1400268fb
lea rcx, str.Warning:_Multiple_DuckStations_detected_n
call fcn.1400112bc
lea rcx, str.Please_enter_the_PID_manually_n_n
call fcn.1400112bc
lea rcx, str.Input.:_DuckStation_PID:
call fcn.1400112bc
mov r8d, select
lea rdx, [rbp + 0x1408]
lea rcx, [0x140032778]
call fcn.14001137f
jmp 0x14002691a
mov r9d, dword [rbp + 0x94]
lea r8, [0x140032870]
mov edx, 0x64
lea rcx, [rbp + 0x1408]
call fcn.14001139d
lea r9, [rbp + 0x1408]
lea r8, str.duckstation__s
mov edx, 0x64
lea rcx, [rbp + 0x1440]
call fcn.14001139d
lea r9, [rbp + 0x1440]
lea r8, [0x1400328a0]
mov edx, 0x64
lea rcx, [rbp + 0x14d0]
call fcn.1400111d1
mov dword [rbp + 0x15b4], 0x800000
lea r8, [rbp + 0x14d0]
xor edx, edx
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rbp + 0x15d8], rax
mov eax, dword [rbp + 0x15b4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 6
mov rcx, qword [rbp + 0x15d8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x1400368f8], rax
cmp qword [0x1400368f8], 0
jne 0x1400269dc
lea rcx, str.Error:_Failed_to_open_DuckStation__n_n
call fcn.1400112bc
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [0x140032154]
call qword [sym.imp.ucrtbased.dll_system]
call fcn.14001146f
mov eax, 1
imul rax, rax, 0xc000
mov rcx, qword [0x1400368f8]
add rcx, rax
mov rax, rcx
mov qword [0x1400368f0], rax
call fcn.140011627
test eax, eax
je 0x140026a29
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.Error:_Failed_to_initialize_ENet__n
mov rcx, rax
call fcn.1400112bc
mov eax, 1
jmp 0x140026ac9
lea rcx, [0x140011244]
call fcn.140011253
lea rcx, str.Client:_Waiting_for_the_OnlineCTR_binary_to_load...
call fcn.1400112bc
xor eax, eax
cmp eax, 1
je 0x140026ab0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [0x1400368f0]
movzx eax, byte [rcx + rax + 0x28]
inc al
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [0x1400368f0]
mov byte [rdx + rcx + 0x28], al
mov rax, qword [0x1400368f0]
cmp dword [rax], 2
jl 0x140026a84
call fcn.14001144c
call fcn.1400115d2
mov rax, qword [0x1400368f0]
cmp dword [rax], 0
jl 0x140026aa9
mov rax, qword [0x1400368f0]
movsxd rax, dword [rax]
lea rcx, [0x140036030]
call qword [rcx + rax*8]
call fcn.1400115cd
jmp 0x140026a41
lea rcx, reloc.WS2_32.dll_ioctlsocket
call fcn.1400112bc
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_htons
call fcn.140011573
mov rax, rdi
mov rcx, qword [rbp + 0x1c08]
xor rcx, rbp
call fcn.1400112df
lea rsp, [rbp + 0x1c18]
pop rdi
pop rbp
ret