Function at 0x1400027b0
Capabilities:
Create process on windows
Create process suspended
Execute command
Resume thread
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x460], rax
xor ebx, ebx
mov dword [rsp + 0x50], ebx
lea rcx, str.WuWa_Loader
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, 0x100
lea rcx, [rbp + 0x250]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], rbx
mov r12d, 1
mov r8d, r12d
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0xb0]
call fcn.1400051b0
nop
movabs rax, 0x7fffffffffffffff
mov r14, rax
mov r13, qword [rbp + 0xc0]
sub r14, r13
cmp r14, 0x11
jb 0x1400036f6
lea r15, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova r15, qword [rbp + 0xb0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rsi, [r13 + 0x11]
mov ebx, 0xf
lea rdi, [rsp + 0x58]
movabs rcx, 0x8000000000000000
lea edx, [rbx + 7]
cmp rsi, rbx
jbe 0x140002916
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x1400028dd
mov rbx, rax
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140006430
test rax, rax
je 0x140002a1b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002911
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002900
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400036e4
jmp 0x1400028be
test rcx, rcx
je 0x14000290f
call fcn.140006430
mov rdi, rax
jmp 0x140002911
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rbx
mov r8, r13
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.:hellokittyfan48]
movups xmmword [rdi + r13], xmm0
movzx eax, byte [0x1400088f8]
mov byte [rdi + r13 + 0x10], al
mov byte [rdi + rsi], 0
mov rdi, qword [rsp + 0x68]
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rbx, qword [rsp + 0x58]
call fcn.140005e80
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rdi
lea r8, [rbp - 0x80]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.140001910
mov eax, 7
mov dword [rsp + 0x50], eax
lea rcx, [rbp - 0x70]
call fcn.140002450
movzx ebx, al
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x1400029d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006474
movdqa xmm0, xmmword [0x140008c00]
movdqu xmmword [rbp - 0x60], xmm0
xor eax, eax
mov word [rbp - 0x70], ax
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140002a29
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006474
xor eax, eax
test bl, bl
jne 0x140002c14
lea r15, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova r15, qword [rbp + 0xb0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov ebx, 0xf
lea rdi, [rsp + 0x58]
cmp rsi, rbx
jbe 0x140002aed
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x140002ab2
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006430
test rax, rax
je 0x140002c08
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002ae8
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002adb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400036ea
jmp 0x140002a93
test rcx, rcx
je 0x140002ae5
call fcn.140006430
mov rdi, rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rbx
mov r8, r13
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.:hellokittyfan48]
movups xmmword [rdi + r13], xmm0
movzx eax, byte [0x1400088f8]
mov byte [rdi + r13 + 0x10], al
mov byte [rdi + rsi], 0
mov rdi, qword [rsp + 0x68]
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rbx, qword [rsp + 0x58]
call fcn.140005e80
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rdi
lea r8, [rbp - 0x80]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.140001910
mov eax, 0x1c7
mov dword [rsp + 0x50], eax
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
call fcn.140005fbc
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x1400036fc
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140002bc1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bbc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006474
movdqa xmm0, xmmword [0x140008c00]
movdqu xmmword [rbp - 0x60], xmm0
xor eax, eax
mov word [rbp - 0x70], ax
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140002c16
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006474
xor eax, eax
cmp r14, 0x1e
jb 0x1400036de
lea r14, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
mov r15, qword [rbp + 0xb0]
cmova r14, r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
lea rsi, [r13 + 0x1e]
mov ebx, 0xf
lea rdi, [rbp + 0x90]
cmp rsi, rbx
jbe 0x140002cee
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x140002cb1
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006430
test rax, rax
je 0x140003645
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002ce7
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002cda
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400036f0
jmp 0x140002c92
test rcx, rcx
je 0x140002ce4
call fcn.140006430
mov rdi, rax
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rbx
mov r8, r13
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.:hellokittyfan48gamepath.txt]
movups xmmword [rdi + r13], xmm0
movsd xmm0, qword [0x140008910]
movsd qword [rdi + r13 + 0x10], xmm0
mov eax, dword [0x140008918]
mov dword [rdi + r13 + 0x18], eax
movzx eax, word [0x14000891c]
mov word [rdi + r13 + 0x1c], ax
mov byte [rdi + rsi], 0
mov esi, dword [rsp + 0x50]
or esi, 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xor r14d, r14d
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], r14b
mov rdi, qword [rbp + 0xa0]
lea rbx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rbx, qword [rbp + 0x90]
call fcn.140005e80
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rdi
lea r8, [rbp - 0x80]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.140001910
or esi, 0x30
lea rcx, [rbp - 0x70]
call fcn.140002450
movzx ebx, al
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140002df4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002def
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006474
xor edx, edx
test bl, bl
je 0x14000300b
mov r8d, 0x110
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rbx, qword [rbp + 0x90]
lea rax, [0x140000000]
lea rax, [rax + 0x8b98]
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0x180]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
bts esi, 9
mov dword [rsp + 0x50], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xd0], rdi
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xcc], edx
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0xe0], rax
mov byte [rbp + 0x15c], 0
mov byte [rbp + 0x151], 0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x160], r14
mov rax, qword [0x14000db20]
mov qword [rbp + 0x154], rax
mov qword [rbp + 0x148], r14
mov r8d, r12d
mov rdx, rbx
lea rcx, [rbp + 0xe0]
call fcn.140004a90
test rax, rax
jne 0x140002f2b
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xd0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0xd0], rdi
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xcc], edx
cmp qword [rbp + 0x160], 0
jne 0x140002f95
lea rdx, str.Error_opening_gamepath.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004d20
lea rdx, [0x140004ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xd0]
call fcn.140003710
jmp 0x1400035b6
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xd0]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xd0]
call fcn.140005a70
lea rcx, [rbp + 0xe0]
call fcn.140004950
test rax, rax
jne 0x140002ffa
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xd0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0xd0]
call fcn.140003710
jmp 0x1400032d8
mov r8d, 0x104
lea rcx, [rbp + 0x350]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
mov dword [rbp - 0x30], 0x98
mov qword [rbp - 0x28], r14
lea rax, [rbp + 0x350]
mov qword [rbp], rax
mov dword [rbp + 8], 0x104
lea rax, str.Executable_Files
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], r12d
mov dword [rbp + 0x30], 0x1800
lea rcx, [rbp - 0x30]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp eax, 1
jne 0x140003592
mov r9, qword [rbp]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [r9 + rdi], 0
jne 0x1400030a0
mov rax, qword [rbp + 0x88]
cmp rdi, rax
ja 0x1400030de
lea rbx, [rbp + 0x70]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x70]
mov qword [rbp + 0x80], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x1400030ea
mov rdx, rdi
lea rcx, [rbp + 0x70]
call fcn.140005910
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rbx, qword [rbp + 0x90]
lea rax, [0x140000000]
lea rax, [rax + 0x8b60]
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
bts esi, 0xa
mov dword [rsp + 0x50], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xd0], rdi
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xcc], edx
lea rcx, [rbp + 0xd8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0xd8], rax
mov byte [rbp + 0x154], 0
mov byte [rbp + 0x149], 0
lea rcx, [rbp + 0xd8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x158], r14
mov rax, qword [0x14000db20]
mov qword [rbp + 0x14c], rax
mov qword [rbp + 0x140], r14
mov r8d, 2
mov rdx, rbx
lea rcx, [rbp + 0xd8]
call fcn.140004a90
test rax, rax
jne 0x14000321c
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xd0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0xd0], rdi
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xcc], edx
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x80]
lea rcx, [rbp + 0xd0]
call fcn.140005c10
lea rcx, [rbp + 0xd8]
call fcn.140004950
test rax, rax
jne 0x14000329e
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xd0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, [0x14000894c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Restart_the_injector_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d20
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
lea rcx, [rbp + 0xd0]
call fcn.1400037d0
mov dword [rbp + 0x1e0], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e8], xmm0
movups xmmword [rbp + 0x1f8], xmm0
movups xmmword [rbp + 0x208], xmm0
movups xmmword [rbp + 0x218], xmm0
movups xmmword [rbp + 0x228], xmm0
movups xmmword [rbp + 0x238], xmm0
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000338a
lea rdx, str.CreateProcess_error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004d20
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x1400035a5
lea rdx, str.Created_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d20
lea rdx, [0x140004ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d20
mov edx, dword [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140004ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Main_thread_handle:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d20
mov rdx, qword [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140004ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, dword [rbp - 0x40]
call fcn.140002550
test al, al
jne 0x14000344d
lea rdx, str.Failed_to_inject_Bypass.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004d20
lea rdx, [0x140004ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, r12d
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400035b6
lea rdx, str.Bypass_injected
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d20
lea rdx, [0x140004ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1400034a8
lea rdx, str.ResumeThread_error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004d20
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x14000342b
lea rdx, str.Resuming_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d20
lea rdx, [0x140004ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea rcx, str.UnrealWindow
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400034ff
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.UnrealWindow
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400034e0
lea rdx, str.Game_initialized
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d20
lea rdx, [0x140004ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 5
nop dword [rax + rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140008a50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004d20
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, str.__Closing...
call fcn.140004d20
lea rdx, [0x140004f30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
sub ebx, 1
jns 0x140003540
mov r12d, r14d
jmp 0x1400035b6
lea rdx, str.Failed_to_get_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004d20
lea rdx, [0x140004ef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400035f7
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006474
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140003651
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000364c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000364c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006474
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], 0
mov rax, qword [rbp + 0xc8]
cmp rax, 0xf
jbe 0x1400036ab
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400036a3
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140006474
mov eax, r12d
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.140006410
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.1400011b0
nop
shr rdx, 0x20
lea r8, [rbp - 0x70]
call fcn.140002380
int3