Function at 0x1400153a0
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x670
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14004b300]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov qword [rsp + 0x70], r8
xor esi, esi
mov dword [rsp + 0x60], esi
call fcn.140007410
mov rdx, rax
lea rcx, [rsp + 0x2a0]
call fcn.1400029b0
nop
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x140015403
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
lea rbx, [rcx + rax*2]
mov rdi, rbx
mov rdx, rbx
call fcn.1400046b0
cmp rax, rbx
je 0x14001545b
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14001542f
cmp cx, 0x2f
jne 0x140015438
add rax, 2
cmp rax, rbx
jne 0x140015420
cmp rax, rbx
je 0x14001545b
nop dword [rax]
lea rcx, [rdi - 2]
movzx edx, word [rcx]
cmp dx, 0x5c
je 0x14001545b
cmp dx, 0x2f
je 0x14001545b
mov rdi, rcx
cmp rax, rcx
jne 0x140015440
mov r8d, 0x3a
mov rdx, rbx
mov rcx, rdi
call fcn.14001a6e0
mov r8, rax
cmp rdi, rax
je 0x140015499
add rax, 0xfffffffffffffffe
cmp rdi, rax
je 0x140015499
cmp word [rax], 0x2e
jne 0x140015534
lea rcx, [rax - 2]
cmp rdi, rcx
jne 0x140015496
cmp word [rcx], 0x2e
je 0x140015499
mov r8, rax
sub r8, rdi
sar r8, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rsi
mov rdx, rdi
lea rcx, [rsp + 0x240]
call fcn.140001550
nop
lea r15, [rsp + 0x240]
cmp qword [rsp + 0x258], 7
cmova r15, qword [rsp + 0x240]
mov r14, qword [rsp + 0x250]
xorps xmm0, xmm0
movups xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x238], 0xf
mov byte [rsp + 0x220], 0
mov dword [rsp + 0x60], 0x5c
test r14, r14
je 0x14001565e
cmp r14, 0x7fffffff
ja 0x140018b6c
jmp 0x140015559
sub rax, 2
cmp rdi, rax
je 0x140015499
cmp word [rax], 0x2e
je 0x140015496
sub rax, 2
cmp rdi, rax
jne 0x140015541
jmp 0x140015499
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, 0xfde9
call fcn.140019cb8
mov rsi, rax
shr rax, 0x20
test eax, eax
jne 0x140018b77
movsxd rcx, esi
mov rdx, qword [rsp + 0x230]
cmp rcx, rdx
ja 0x1400155b7
mov qword [rsp + 0x230], rcx
lea rax, [rsp + 0x220]
cmp qword [rsp + 0x238], 0xf
cmova rax, qword [rsp + 0x220]
mov byte [rax + rcx], 0
jmp 0x14001561f
mov rbx, rcx
sub rbx, rdx
mov rdi, qword [rsp + 0x238]
mov rax, rdi
sub rax, rdx
cmp rbx, rax
ja 0x140015604
mov qword [rsp + 0x230], rcx
lea rax, [rsp + 0x220]
cmp rdi, 0xf
cmova rax, qword [rsp + 0x220]
lea rdi, [rdx + rax]
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.140034620
mov byte [rbx + rdi], 0
jmp 0x14001561f
mov byte [rsp + 0x20], 0
mov r9, rbx
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x220]
call fcn.140001b50
lea r9, [rsp + 0x220]
cmp qword [rsp + 0x238], 0xf
cmova r9, qword [rsp + 0x220]
mov dword [rsp + 0x20], esi
mov r8d, r14d
mov rdx, r15
mov ecx, 0xfde9
call fcn.140019cb8
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140018b83
xor esi, esi
call fcn.140007430
mov r9, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140015671
mov rax, qword [rax]
mov r8, rax
xor edx, edx
lea rcx, [rsp + 0x220]
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x280], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x290], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x280], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x290], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x290]
mov rdx, qword [rsp + 0x298]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140015713
lea rax, [rcx + 4]
mov qword [rsp + 0x290], rax
lea rax, [rsp + 0x280]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x280]
mov dword [rax + rcx], 0x696e692e
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x280]
jmp 0x140015738
mov qword [rsp + 0x20], 4
lea r9, str..ini
xor r8d, r8d
mov edx, 4
lea rcx, [rsp + 0x280]
call fcn.1400019c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x14004b0d8]
cmp rdx, 0xf
jbe 0x14001578f
inc rdx
mov rcx, qword [0x14004b0c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001578a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018b8d
call fcn.14001af20
movups xmmword [0x14004b0c0], xmm6
movups xmmword [0x14004b0d0], xmm7
mov rdx, qword [rsp + 0x298]
cmp rdx, 0xf
jbe 0x1400157e0
inc rdx
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400157db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018b93
call fcn.14001af20
movdqa xmm6, xmmword [0x140037990]
movdqu xmmword [rsp + 0x290], xmm6
mov byte [rsp + 0x280], 0
mov rdx, qword [rsp + 0x238]
cmp rdx, 0xf
jbe 0x14001583c
inc rdx
mov rcx, qword [rsp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015837
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018b99
call fcn.14001af20
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x238], 0xf
mov byte [rsp + 0x220], 0
mov rdx, qword [rsp + 0x258]
cmp rdx, 7
jbe 0x1400158a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001589b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018b9f
call fcn.14001af20
movdqa xmm0, xmmword [0x140037980]
movdqu xmmword [rsp + 0x250], xmm0
mov word [rsp + 0x240], si
lea rcx, [rsp + 0x2a0]
call fcn.1400052a0
mov r13, qword [0x14004b0d0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x22
jb 0x140018ba5
lea r15, [0x14004b0c0]
mov r12, r15
cmp qword [0x14004b0d8], 0xf
cmova r12, qword [0x14004b0c0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
lea r14, [r13 + 0x22]
mov edi, 0xf
lea rbx, [rsp + 0x200]
cmp r14, rdi
jbe 0x1400159e0
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x140015951
mov rdi, rcx
movabs rsi, 0x8000000000000000
lea rax, [rsi + 0x27]
jmp 0x14001599d
mov ebx, 0x16
cmp rdi, rbx
cmovb rdi, rbx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x14001597d
mov rbx, rsi
movabs rsi, 0x8000000000000000
mov qword [rsp + 0x200], rbx
jmp 0x1400159ea
cmp rcx, 0x1000
jb 0x1400159c4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140018bab
movabs rsi, 0x8000000000000000
mov rcx, rax
call fcn.14001aee4
test rax, rax
je 0x140018bb1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov qword [rsp + 0x200], rbx
jmp 0x1400159ea
call fcn.14001aee4
mov rbx, rax
movabs rsi, 0x8000000000000000
mov qword [rsp + 0x200], rax
jmp 0x1400159ea
movabs rsi, 0x8000000000000000
mov qword [rsp + 0x210], r14
mov qword [rsp + 0x218], rdi
movups xmm0, xmmword [str.Searching_for_configuration_file:]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140038a90]
movups xmmword [rbx + 0x10], xmm1
movzx eax, word [0x140038aa0]
mov word [rbx + 0x20], ax
lea rcx, [rbx + 0x22]
mov r8, r13
mov rdx, r12
call fcn.140033f80
mov byte [rbx + r14], 0
mov r14d, 0x3bc
lea rdx, [rsp + 0x200]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x140015a8c
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015a87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018bb1
call fcn.14001af20
mov rcx, r15
call fcn.140005af0
test al, al
jne 0x140015cd3
call fcn.140007430
mov rdx, qword [rax + 0x10]
movabs rcx, 0x7fffffffffffffff
sub rcx, rdx
cmp rcx, 0x14
jb 0x140018bb7
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140015ac9
mov r9, qword [rax]
mov qword [rsp + 0x30], 0x14
lea rcx, str.ColdClientLoader.ini
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov r8, rax
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
mov rdx, qword [0x14004b0d8]
cmp rdx, 0xf
jbe 0x140015b39
inc rdx
mov rcx, qword [0x14004b0c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015b34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018bbd
call fcn.14001af20
movups xmm1, xmmword [rsp + 0x260]
movups xmmword [0x14004b0c0], xmm1
movups xmm0, xmmword [rsp + 0x270]
movups xmmword [0x14004b0d0], xmm0
movq r13, xmm0
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
sub rax, r13
cmp rax, 0x22
jb 0x140018bc3
mov r12, r15
movq rcx, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova r12, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
lea r14, [r13 + 0x22]
mov edi, 0xf
lea rbx, [rsp + 0x200]
cmp r14, rdi
jbe 0x140015c31
mov rdi, r14
or rdi, 0xf
cmp rdi, rdx
jbe 0x140015bef
mov rdi, rdx
add rsi, 0x27
mov rcx, rsi
call fcn.14001aee4
test rax, rax
je 0x140018bcf
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140015c29
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140015c09
xor eax, eax
jmp 0x140015c26
cmp rcx, 0x1000
jb 0x140015c21
lea rsi, [rcx + 0x27]
cmp rsi, rcx
jbe 0x140018bc9
jmp 0x140015bd0
call fcn.14001aee4
mov rbx, rax
mov qword [rsp + 0x200], rbx
mov qword [rsp + 0x210], r14
mov qword [rsp + 0x218], rdi
movups xmm0, xmmword [str.Searching_for_configuration_file:]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140038a90]
movups xmmword [rbx + 0x10], xmm1
movzx eax, word [0x140038aa0]
mov word [rbx + 0x20], ax
lea rcx, [rbx + 0x22]
mov r8, r13
mov rdx, r12
call fcn.140033f80
mov byte [rbx + r14], 0
mov r14d, 0xfbc
lea rdx, [rsp + 0x200]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x140015cd3
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015cce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018bcf
call fcn.14001af20
mov rcx, r15
call fcn.140005af0
test al, al
jne 0x140015d18
lea rdx, str.Couldnt_find_the_configuration_file
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.Couldnt_find_the_configuration_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
mov rdx, r15
lea rcx, [rsp + 0x2a0]
call fcn.1400029b0
nop
cmp qword [rax + 0x18], 7
jbe 0x140015d33
mov rax, qword [rax]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x21
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140009e50
mov rax, qword [rsp + 0xf0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0xf0], rax
mov rax, qword [rsp + 0xf0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0xec], edx
lea rcx, [rsp + 0x2a0]
call fcn.1400052a0
cmp qword [rsp + 0x180], 0
jne 0x140015dea
lea rdx, str.Failed_to_open_the_configuration_file
lea rcx, [0x14004ca60]
call fcn.1400071d0
lea rdx, str.Failed_to_open_the_configuration_file.
lea r8, str.ColdClientLoader
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rsp + 0xf0]
call fcn.14000b040
mov eax, 1
jmp 0x140018b35
xorps xmm0, xmm0
movups xmmword [rsp + 0x220], xmm0
xor r12d, r12d
mov qword [rsp + 0x230], r12
mov qword [rsp + 0x238], 0xf
mov byte [rsp + 0x220], r12b
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0xf0]
call fcn.140011a20
lea rax, [rsp + 0x440]
mov rbx, rsi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140015e50
mov rcx, qword [rsp + 0x230]
mov rdx, qword [rsp + 0x238]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x140015eb1
lea rax, [rcx + rbx]
mov qword [rsp + 0x230], rax
lea rdi, [rsp + 0x220]
cmp rdx, 0xf
cmova rdi, qword [rsp + 0x220]
add rdi, rcx
mov r8, rbx
lea rdx, [rsp + 0x440]
mov rcx, rdi
call fcn.140033f80
mov byte [rbx + rdi], 0
jmp 0x140015ed1
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x440]
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x220]
call fcn.1400019c0
mov rax, qword [rsp + 0xf0]
movsxd rcx, dword [rax + 4]
cmp dword [rsp + rcx + 0x100], 0
je 0x140015e20
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 0xf
cmova rdx, qword [rsp + 0x220]
mov r8, qword [rsp + 0x230]
lea rcx, [0x14004c9d0]
call fcn.14000c9a0
mov edi, eax
mov rdx, qword [rsp + 0x238]
cmp rdx, 0xf
jbe 0x140015f5e
inc rdx
mov rcx, qword [rsp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015f59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018bd5
call fcn.14001af20
lea rcx, [rsp + 0xf0]
call fcn.14000f7d0
cmp qword [0x14004b0d8], 0xf
cmova r15, qword [0x14004b0c0]
mov r9d, edi
mov r8, r15
lea rdx, str.result_of_parsing_ini__s__i__success__0_
lea rcx, [0x14004ca60]
call fcn.1400071d0
test edi, edi
je 0x140015fb7
lea rdx, str.Failed_to_load_the_configuration_file
lea rcx, [0x14004ca60]
call fcn.1400071d0
lea rdx, str.Failed_to_load_the_configuration_file.
jmp 0x140015dbd
lea rcx, [rsp + 0xf0]
call fcn.14000b040
call fcn.140007430
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140015fd6
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x20], r12
lea r9, [0x140037780]
lea r8, str.SteamClientDll
lea rdx, str.SteamClient
lea rcx, [0x14004c9d0]
call fcn.14000c6f0
mov qword [rsp + 0x60], rax
mov rcx, rsi
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140016020
mov qword [rsp + 0x68], rcx
movaps xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x3e0], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x3e0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2a0]
call fcn.140006620
mov rdx, rax
lea rcx, [0x14004b0e0]
call fcn.140007380
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
call fcn.140007430
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140016092
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x20], r12
lea r9, [0x140037780]
lea r8, str.SteamClient64Dll
lea rdx, str.SteamClient
lea rcx, [0x14004c9d0]
call fcn.14000c6f0
mov qword [rsp + 0x60], rax
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400160d4
mov qword [rsp + 0x68], rcx
movaps xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x3e0], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x3e0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2a0]
call fcn.140006620
mov rdx, rax
lea rcx, [0x14004b100]
call fcn.140007380
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
call fcn.140007430
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140016146
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x20], r12
lea r9, [0x140037780]
lea r8, [0x140038c2c]
lea rdx, str.SteamClient
lea rcx, [0x14004c9d0]
call fcn.14000c6f0
mov qword [rsp + 0x60], rax
mov rcx, rsi
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140016190
mov qword [rsp + 0x68], rcx
movaps xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x3e0], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x3e0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2a0]
call fcn.140006620
mov rdx, rax
lea rcx, [0x14004b120]
call fcn.140007380
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
call fcn.140007430
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140016202
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x20], r12
lea r9, [0x140037780]
lea r8, str.ExeRunDir
lea rdx, str.SteamClient
lea rcx, [0x14004c9d0]
call fcn.14000c6f0
mov qword [rsp + 0x60], rax
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140016244
mov qword [rsp + 0x68], rcx
movaps xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x3e0], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x3e0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2a0]
call fcn.140006620
mov rdx, rax
lea rdi, [0x14004b140]
mov rcx, rdi
call fcn.140007380
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
mov qword [rsp + 0x20], r12
lea r9, [0x140037780]
lea r8, str.ExeCommandLine
lea rdx, str.SteamClient
lea rcx, [0x14004c9d0]
call fcn.14000c6f0
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400162d0
mov rdx, rax
lea rcx, [0x14004b160]
call fcn.140006f50
mov qword [rsp + 0x20], r12
lea r9, [0x140037780]
lea r8, str.AppId
lea rdx, str.SteamClient
lea rcx, [0x14004c9d0]
call fcn.14000c6f0
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140016312
mov rdx, rax
lea rcx, [0x14004b180]
call fcn.140006f50
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.ForceInjectSteamClient
lea rdx, str.Injection
lea rcx, [0x14004c9d0]
call fcn.14000c610
mov byte [0x14004c9c5], al
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.ForceInjectGameOverlayRenderer
lea rdx, str.Injection
lea rcx, [0x14004c9d0]
call fcn.14000c610
mov byte [0x14004c9c6], al
call fcn.140007430
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14001638d
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x20], r12
lea r9, [0x140037780]
lea r8, str.DllsToInjectFolder
lea rdx, str.Injection
lea rcx, [0x14004c9d0]
call fcn.14000c6f0
mov qword [rsp + 0x60], rax
mov rcx, rsi
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400163d0
mov qword [rsp + 0x68], rcx
movaps xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x3e0], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x3e0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2a0]
call fcn.140006620
mov rdx, rax
lea rcx, [0x14004b1a0]
call fcn.140007380
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
mov qword [rsp + 0x20], r12
mov r9b, 1
lea r8, str.IgnoreInjectionError
lea rdx, str.Injection
lea rcx, [0x14004c9d0]
call fcn.14000c610
mov byte [0x14004c9c7], al
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.IgnoreLoaderArchDifference
lea rdx, str.Injection
lea rcx, [0x14004c9d0]
call fcn.14000c610
mov byte [0x14004c9c8], al
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.Mode
lea rdx, str.Persistence
lea rcx, [0x14004c9d0]
call fcn.14000c6f0
test rax, rax
je 0x140016568
cmp byte [rax], 0
je 0x140016568
xorps xmm0, xmm0
movups xmmword [rsp + 0x400], xmm0
movups xmmword [rsp + 0x410], xmm0
movups xmmword [rsp + 0x420], xmm0
movups xmmword [rsp + 0x430], xmm0
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400164e0
inc r8
cmp r8, 0x40
ja 0x140016568
mov rdx, rax
lea rcx, [rsp + 0x400]
call fcn.140033f80
lea rax, [rsp + 0x400]
mov qword [rsp + 0x60], rax
cmp byte [rsp + 0x400], 0x30
jne 0x140016542
movzx eax, byte [rsp + 0x401]
sub al, 0x58
test al, 0xdf
jne 0x140016542
cmp byte [rsp + 0x402], 0
je 0x140016568
lea rcx, [rsp + 0x402]
mov r8d, 0x10
jmp 0x140016550
lea rcx, [rsp + 0x400]
mov r8d, 0xa
lea rdx, [rsp + 0x60]
call fcn.140021d24
mov rcx, qword [rsp + 0x60]
cmp byte [rcx], 0
cmovne eax, r12d
jmp 0x14001656b
mov eax, r12d
mov dword [0x14004ca58], eax
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.ResumeByDebugger
lea rdx, str.Debug
lea rcx, [0x14004c9d0]
call fcn.14000c610
mov byte [0x14004c9c9], al
cmp dword [0x14004ca58], 2
jbe 0x1400165a9
mov dword [0x14004ca58], r12d
movabs r13, 0x7fffffffffffffff
mov rax, r13
mov rcx, qword [0x14004b130]
sub rax, rcx
cmp rax, 0x12
jb 0x140018bdb
lea rax, [0x14004b120]
cmp qword [0x14004b138], 0xf
cmova rax, qword [0x14004b120]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x12
lea r9, str.SteamClient::Exe:
lea r8, [0x14004b120]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
bts r14d, 0xc
lea rdx, [rsp + 0x260]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
mov rax, r13
mov rcx, qword [0x14004b150]
sub rax, rcx
cmp rax, 0x18
jb 0x140018be1
mov rax, rdi
cmp qword [0x14004b158], 0xf
cmova rax, qword [0x14004b140]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x18
lea r9, str.SteamClient::ExeRunDir:
mov r8, rdi
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
bts r14d, 0xd
lea rdx, [rsp + 0x260]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
mov rax, r13
mov rcx, qword [0x14004b170]
sub rax, rcx
cmp rax, 0x1d
jb 0x140018be7
lea rax, [0x14004b160]
cmp qword [0x14004b178], 0xf
cmova rax, qword [0x14004b160]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1d
lea r9, str.SteamClient::ExeCommandLine:
lea r8, [0x14004b160]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
bts r14d, 0xe
lea rdx, [rsp + 0x260]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
mov rax, r13
mov rcx, qword [0x14004b190]
sub rax, rcx
cmp rax, 0x14
jb 0x140018bed
lea rax, [0x14004b180]
cmp qword [0x14004b198], 0xf
cmova rax, qword [0x14004b180]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x14
lea r9, str.SteamClient::AppId:
lea r8, [0x14004b180]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
bts r14d, 0xf
lea rdx, [rsp + 0x260]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
mov rax, r13
mov rcx, qword [0x14004b0f0]
sub rax, rcx
cmp rax, 0x1a
jb 0x140018bf3
lea rax, [0x14004b0e0]
cmp qword [0x14004b0f8], 0xf
cmova rax, qword [0x14004b0e0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1a
lea r9, str.SteamClient::SteamClient:
lea r8, [0x14004b0e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
bts r14d, 0x10
lea rdx, [rsp + 0x260]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
mov rax, r13
mov rcx, qword [0x14004b110]
sub rax, rcx
cmp rax, 0x1f
jb 0x140018bf9
lea rax, [0x14004b100]
cmp qword [0x14004b118], 0xf
cmova rax, qword [0x14004b100]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1f
lea r9, str.SteamClient::SteamClient64Dll:
lea r8, [0x14004b100]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
bts r14d, 0x11
lea rdx, [rsp + 0x260]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
mov edx, dword [0x14004ca58]
lea rcx, [rsp + 0x3f5]
test edx, edx
jns 0x1400168fc
neg edx
call fcn.1400098b0
dec rax
mov byte [rax], 0x2d
jmp 0x140016901
call fcn.1400098b0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x3f5]
mov rdx, rax
lea rcx, [rsp + 0x340]
call fcn.140007e50
or r14d, 0xc0000
mov r9d, 0x1d
lea r8, str.SteamClient::PersistentMode:
xor edx, edx
lea rcx, [rsp + 0x340]
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x210], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts r14d, 0x14
lea rdx, [rsp + 0x200]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x1400169db
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400169d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018bff
call fcn.14001af20
movdqu xmmword [rsp + 0x210], xmm6
mov byte [rsp + 0x200], 0
mov r8, qword [rsp + 0x358]
cmp r8, 0xf
jbe 0x140016a0f
mov rdx, qword [rsp + 0x340]
lea rcx, [rsp + 0x340]
call fcn.14000d510
movzx edx, byte [0x14004c9c5]
lea rcx, [rsp + 0x2e0]
call fcn.1400146d0
nop
mov r9d, 0x25
lea r8, str.SteamClient::ForceInjectSteamClient:
xor edx, edx
mov rcx, rax
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x210], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts r14d, 0x15
lea rdx, [rsp + 0x200]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x140016ad5
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016ad0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018c05
call fcn.14001af20
movdqu xmmword [rsp + 0x210], xmm6
mov byte [rsp + 0x200], 0
mov r8, qword [rsp + 0x2f8]
cmp r8, 0xf
jbe 0x140016b09
mov rdx, qword [rsp + 0x2e0]
lea rcx, [rsp + 0x2e0]
call fcn.14000d510
movzx edx, byte [0x14004c9c6]
lea rcx, [rsp + 0x2e0]
call fcn.1400146d0
nop
mov r9d, 0x2d
lea r8, str.SteamClient::ForceInjectGameOverlayRenderer:
xor edx, edx
mov rcx, rax
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x210], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts r14d, 0x16
lea rdx, [rsp + 0x200]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x140016bcf
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016bca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018c0b
call fcn.14001af20
movdqu xmmword [rsp + 0x210], xmm6
mov byte [rsp + 0x200], 0
mov r8, qword [rsp + 0x2f8]
cmp r8, 0xf
jbe 0x140016c03
mov rdx, qword [rsp + 0x2e0]
lea rcx, [rsp + 0x2e0]
call fcn.14000d510
mov rax, r13
mov rcx, qword [0x14004b1b0]
sub rax, rcx
cmp rax, 0x1f
jb 0x140018c11
lea rax, [0x14004b1a0]
cmp qword [0x14004b1b8], 0xf
cmova rax, qword [0x14004b1a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1f
lea r9, str.Injection::DllsToInjectFolder:
lea r8, [0x14004b1a0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
bts r14d, 0x17
lea rdx, [rsp + 0x260]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
movzx edx, byte [0x14004c9c7]
lea rcx, [rsp + 0x2a0]
call fcn.1400146d0
nop
mov r9d, 0x21
lea r8, str.Injection::IgnoreInjectionError:
xor edx, edx
mov rcx, rax
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x210], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts r14d, 0x18
lea rdx, [rsp + 0x200]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x140016d51
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016d4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018c17
call fcn.14001af20
movdqu xmmword [rsp + 0x210], xmm6
mov byte [rsp + 0x200], 0
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
movzx edx, byte [0x14004c9c8]
lea rcx, [rsp + 0x2a0]
call fcn.1400146d0
nop
mov r9d, 0x27
lea r8, str.Injection::IgnoreLoaderArchDifference:
xor edx, edx
mov rcx, rax
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x210], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts r14d, 0x19
lea rdx, [rsp + 0x200]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x140016e35
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016e30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018c1d
call fcn.14001af20
movdqu xmmword [rsp + 0x210], xmm6
mov byte [rsp + 0x200], 0
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
movzx edx, byte [0x14004c9c9]
lea rcx, [rsp + 0x2a0]
call fcn.1400146d0
nop
mov r9d, 0x19
lea r8, str.Debug::ResumeByDebugger:
xor edx, edx
mov rcx, rax
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x210], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts r14d, 0x1a
lea rdx, [rsp + 0x200]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 0xf
jbe 0x140016f19
inc rdx
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016f14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018c23
call fcn.14001af20
movdqu xmmword [rsp + 0x210], xmm6
mov byte [rsp + 0x200], 0
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
lea rcx, [0x14004b100]
call fcn.140005af0
test al, al
jne 0x140016f80
lea rdx, str.Couldnt_find_the_requested_SteamClient64Dll
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.Couldnt_find_the_requested_SteamClient64Dll.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
lea rcx, [0x14004b0e0]
call fcn.140005af0
test al, al
jne 0x140016fc9
lea rdx, str.Couldnt_find_the_requested_SteamClientDll
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.Couldnt_find_the_requested_SteamClientDll.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
lea rcx, [0x14004b120]
call fcn.140005af0
test al, al
jne 0x140017012
lea rdx, str.Couldnt_find_the_requested_Exe_file
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.Couldnt_find_the_requested_Exe_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
cmp qword [0x14004b150], 0
jne 0x14001710a
lea rdx, [0x14004b120]
lea rcx, [rsp + 0x260]
call fcn.1400029b0
nop
lea rdx, [rsp + 0x300]
mov rcx, rax
call fcn.1400060c0
nop
lea rdx, [rsp + 0x2a0]
mov rcx, rax
call fcn.1400148c0
mov rdx, rax
mov rcx, rdi
call fcn.140007380
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
nop
lea rcx, [rsp + 0x300]
call fcn.1400052a0
nop
lea rcx, [rsp + 0x260]
call fcn.1400052a0
mov rax, r13
mov rcx, qword [0x14004b150]
sub rax, rcx
cmp rax, 0x16
jb 0x140018c29
mov rax, rdi
cmp qword [0x14004b158], 0xf
cmova rax, qword [0x14004b140]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x16
lea r9, str.Setting_ExeRunDir_to:
mov r8, rdi
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
bts r14d, 0x1b
lea rdx, [rsp + 0x260]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
mov rcx, rdi
call fcn.140005830
test al, al
jne 0x14001714f
lea rdx, str.Couldnt_find_the_requested_Exe_run_dir
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.Couldnt_find_the_requested_Exe_run_dir.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
xor bl, bl
cmp qword [0x14004b1b0], 0
je 0x14001719d
lea rcx, [0x14004b1a0]
call fcn.140005830
movzx ebx, al
test al, al
jne 0x14001719d
lea rdx, str.Couldnt_find_the_requested_folder_of_dlls_to_inject
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x30
lea r8, str.ColdClientLoader
lea rdx, str.Couldnt_find_the_requested_folder_of_dlls_to_inject.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [0x14004b120]
lea rcx, [rsp + 0x220]
call fcn.140011c00
mov rdi, rax
lea rcx, [0x14004ca40]
cmp rcx, rax
je 0x1400171f0
call fcn.14000ae50
mov rcx, qword [rdi]
mov qword [0x14004ca40], rcx
mov rcx, qword [rdi + 8]
mov qword [0x14004ca48], rcx
mov rcx, qword [rdi + 0x10]
mov qword [0x14004ca50], rcx
mov qword [rdi], r12
mov qword [rdi + 8], r12
mov qword [rdi + 0x10], r12
lea rcx, [rsp + 0x220]
call fcn.14000ae50
mov rcx, qword [0x14004ca40]
cmp rcx, qword [0x14004ca48]
jne 0x140017246
lea rdx, str.Couldnt_read_the_exe_header
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.Couldnt_read_the_exe_header.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
call fcn.140007b80
movzx r15d, al
mov rcx, qword [0x14004ca40]
call fcn.140007bc0
lea rcx, [0x14004ca60]
cmp r15b, al
jne 0x140017299
lea rdx, str.The_requested_exe_is_invalid__neither_32_nor_64_bit_
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.The_requested_exe_is_invalid__neither_32_nor_64_bit_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
lea rax, str.Detected_exe_arch:_x64
lea rdx, str.Detected_exe_arch:_x32
test r15b, r15b
cmove rdx, rax
call fcn.1400071d0
lea rdx, str.Detected_loader_arch:_x32
lea rax, str.Detected_loader_arch:_x64
cmp byte [0x14004c9c4], 0
cmove rdx, rax
lea rcx, [0x14004ca60]
call fcn.1400071d0
cmp byte [0x14004c9c4], r15b
je 0x140017316
lea rdx, str.Arch_of_loader_and_requested_exe_are_different__it_is_advised_to_use_the_appropriate_one
lea rcx, [0x14004ca60]
call fcn.1400071d0
cmp byte [0x14004c9c8], 0
jne 0x140017316
xor r9d, r9d
lea r8, str.ColdClientLoader
lea rdx, str.Arch_of_loader_and_requested_exe_are_different__nit_is_advised_to_use_the_appropriate_one.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
test bl, bl
je 0x140017534
xorps xmm0, xmm0
movups xmmword [rsp + 0x280], xmm0
mov qword [rsp + 0x290], r12
mov qword [rsp + 0x298], 0xf
mov byte [rsp + 0x280], 0
lea r8, [rsp + 0x280]
movzx edx, r15b
lea rcx, [rsp + 0x220]
call fcn.14000f870
mov rdi, rax
lea rbx, [0x14004cae0]
cmp rbx, rax
je 0x1400173a0
mov rcx, rbx
call fcn.14000ea30
mov rcx, qword [rdi]
mov qword [0x14004cae0], rcx
mov rcx, qword [rdi + 8]
mov qword [0x14004cae8], rcx
mov rcx, qword [rdi + 0x10]
mov qword [0x14004caf0], rcx
mov qword [rdi], r12
mov qword [rdi + 8], r12
mov qword [rdi + 0x10], r12
lea rcx, [rsp + 0x220]
call fcn.14000ea30
mov rcx, qword [rsp + 0x290]
test rcx, rcx
je 0x14001750f
cmp byte [0x14004c9c7], 0
jne 0x14001750f
mov rax, r13
sub rax, rcx
cmp rax, 0x27
jb 0x140018c2f
lea rax, [rsp + 0x280]
cmp qword [rsp + 0x298], 0xf
cmova rax, qword [rsp + 0x280]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x27
lea r9, str.The_following_dlls_cannot_be_injected:_n
lea r8, [rsp + 0x280]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
nop
mov r8d, 0xb
lea rdx, str._nContinue__
lea rcx, [rsp + 0x260]
call fcn.1400054c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x250], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x240], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x250], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x240]
cmp qword [rsp + 0x258], 0xf
cmova rdx, qword [rsp + 0x240]
mov r9d, 4
lea r8, str.ColdClientLoader
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edi, eax
mov r8, qword [rsp + 0x258]
cmp r8, 0xf
jbe 0x1400174d5
mov rdx, qword [rsp + 0x240]
lea rcx, [rsp + 0x240]
call fcn.14000d510
movdqu xmmword [rsp + 0x250], xmm6
mov byte [rsp + 0x240], 0
lea rcx, [rsp + 0x260]
call fcn.140003e90
cmp edi, 6
je 0x14001750f
lea rcx, [rsp + 0x280]
call fcn.140003e90
mov eax, 1
jmp 0x140018b35
mov r8, qword [rsp + 0x298]
cmp r8, 0xf
jbe 0x14001753b
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x280]
call fcn.14000d510
jmp 0x14001753b
lea rbx, [0x14004cae0]
cmp byte [0x14004c9c6], 0
je 0x1400177b9
lea rcx, [rsp + 0x260]
test r15b, r15b
je 0x140017685
lea rdx, [0x14004b0e0]
call fcn.1400029b0
nop
lea rdx, [rsp + 0x300]
mov rcx, rax
call fcn.1400060c0
nop
lea rdx, [rsp + 0x2a0]
mov rcx, rax
call fcn.1400148c0
nop
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140017595
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x3e8], rax
lea rax, str.GameOverlayRenderer.dll
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x17
movaps xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x3e0], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x3e0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2e0]
call fcn.140006620
nop
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
nop
lea rcx, [rsp + 0x300]
call fcn.1400052a0
nop
lea rcx, [rsp + 0x260]
call fcn.1400052a0
lea rcx, [rsp + 0x2e0]
call fcn.140005af0
test al, al
jne 0x140017660
lea rdx, str.Couldnt_find_GameOverlayRenderer.dll
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x30
lea r8, str.ColdClientLoader
lea rdx, str.Couldnt_find_GameOverlayRenderer.dll_to_inject.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140017680
lea r9, [rsp + 0x2e0]
mov r8, qword [0x14004cae0]
lea rdx, [rsp + 0x3e0]
mov rcx, rbx
call fcn.140011f30
nop
jmp 0x1400177ac
lea rdx, [0x14004b100]
call fcn.1400029b0
nop
lea rdx, [rsp + 0x300]
mov rcx, rax
call fcn.1400060c0
nop
lea rdx, [rsp + 0x2a0]
mov rcx, rax
call fcn.1400148c0
nop
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400176c1
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x3e8], rax
lea rax, str.GameOverlayRenderer64.dll
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x19
movaps xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x3e0], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x3e0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2e0]
call fcn.140006620
nop
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
nop
lea rcx, [rsp + 0x300]
call fcn.1400052a0
nop
lea rcx, [rsp + 0x260]
call fcn.1400052a0
lea rcx, [rsp + 0x2e0]
call fcn.140005af0
test al, al
jne 0x14001778c
lea rdx, str.Couldnt_find_GameOverlayRenderer64.dll
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x30
lea r8, str.ColdClientLoader
lea rdx, str.Couldnt_find_GameOverlayRenderer64.dll_to_inject.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400177ac
lea r9, [rsp + 0x2e0]
mov r8, qword [0x14004cae0]
lea rdx, [rsp + 0x3e0]
mov rcx, rbx
call fcn.140011f30
nop
lea rcx, [rsp + 0x2e0]
call fcn.140003e90
cmp byte [0x14004c9c5], 0
je 0x1400177ec
mov r8, qword [0x14004cae0]
lea rdx, [rsp + 0x3e0]
mov rcx, rbx
test r15b, r15b
lea r9, [0x14004b0e0]
jne 0x1400177e7
lea r9, [0x14004b100]
call fcn.140011f30
cmp dword [0x14004ca58], 2
je 0x14001788d
cmp qword [0x14004b190], 0
je 0x140017854
lea rax, [0x14004b180]
cmp qword [0x14004b198], 0xf
cmova rax, qword [0x14004b180]
cmp byte [rax], 0
je 0x140017854
xor edx, edx
mov r8d, 0xa
lea rcx, [0x14004b180]
call fcn.140014530
nop
lea rcx, [0x14004b180]
call fcn.1400142d0
mov r13, qword [rsp + 0x70]
jmp 0x140017eca
lea rdx, str.You_forgot_to_set_the_AppId
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.You_forgot_to_set_the_AppId.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
mov qword [0x14004b190], r12
lea rax, [0x14004b180]
cmp qword [0x14004b198], 0xf
cmova rax, qword [0x14004b180]
mov byte [rax], 0
mov r13, qword [rsp + 0x70]
test r13, r13
je 0x1400178d6
cmp word [r13], 0
je 0x1400178d6
mov rdx, r13
lea rcx, [rsp + 0x2a0]
call fcn.14000a790
or r14d, 1
jmp 0x140017907
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
movdqa xmm1, xmmword [0x140037980]
movdqu xmmword [rsp + 0x2d0], xmm1
mov word [rsp + 0x2c0], r12w
lea rax, [rsp + 0x2c0]
or r14d, 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x320], xmm0
mov qword [rsp + 0x330], r12
mov qword [rsp + 0x338], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x320], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x330], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
test r14b, 2
je 0x140017976
and r14d, 0xfffffffd
mov r8, qword [rsp + 0x2d8]
cmp r8, 7
jbe 0x140017976
mov rdx, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x2c0]
call fcn.14000d550
test r14b, 1
je 0x14001798d
and r14d, 0xfffffffe
lea rcx, [rsp + 0x2a0]
call fcn.1400052a0
lea r8, [rsp + 0x320]
lea rdx, str.persistent_mode_2_detecting_steam_launch_cmd_from:_
lea rcx, [rsp + 0x300]
call fcn.1400083c0
nop
mov r8d, 1
lea rdx, [0x140039430]
mov rcx, rax
call fcn.140005550
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x210], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
bts r14d, 0x1c
lea rdx, [rsp + 0x200]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov r8, qword [rsp + 0x218]
cmp r8, 7
jbe 0x140017a3a
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x200]
call fcn.14000d550
movdqa xmm0, xmmword [0x140037980]
movdqu xmmword [rsp + 0x210], xmm0
mov word [rsp + 0x200], r12w
lea rcx, [rsp + 0x300]
call fcn.1400052a0
lea rdx, str.____steam:__run_
mov r9, rsi
nop dword [rax + rax]
inc r9
cmp word [rdx + r9*2], 0
jne 0x140017a70
lea r10, [rsp + 0x320]
mov r15, qword [rsp + 0x320]
mov r12, qword [rsp + 0x338]
cmp r12, 7
cmova r10, r15
mov rbx, qword [rsp + 0x330]
cmp r9, rbx
ja 0x140017ae4
mov rax, rbx
sub rax, r9
test r9, r9
je 0x140017be2
lea r11, [r10 + 2]
lea r11, [r11 + rax*2]
mov rcx, r10
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x140017ae4
nop dword [rax]
cmp word [rcx], 0x2d
je 0x140017ba4
add rcx, 2
sub rax, 1
jne 0x140017ad0
lea r11, str.____steam:__rungameid_
nop dword [rax + rax]
inc rsi
cmp word [r11 + rsi*2], 0
jne 0x140017af0
lea r9, [rsp + 0x320]
cmp r12, 7
cmova r9, r15
cmp rsi, rbx
ja 0x140017b54
mov rax, rbx
sub rax, rsi
test rsi, rsi
je 0x140017d40
lea r10, [r9 + 2]
lea r10, [r10 + rax*2]
mov rcx, r9
nop word [rax + rax]
mov rax, r10
sub rax, rcx
sar rax, 1
je 0x140017b54
nop dword [rax + rax]
cmp word [rcx], 0x2d
je 0x140017d00
add rcx, 2
sub rax, 1
jne 0x140017b40
lea rdx, str.persistent_mode_2_didnt_detect_a_valid_steam_launch_cmd
lea rcx, [0x14004ca60]
call fcn.1400071d0
cmp qword [0x14004b190], 0
je 0x140017e90
lea rcx, [0x14004b180]
call fcn.1400142d0
movabs rax, 0x7fffffffffffffff
mov rcx, qword [0x14004b190]
sub rax, rcx
cmp rax, 0x24
jb 0x140018c35
jmp 0x140017e1b
test rcx, rcx
je 0x140017ae4
mov rdi, r9
test r9, r9
je 0x140017bd6
mov r8, rcx
lea rax, str.____steam:__run_
sub r8, rax
movzx eax, word [rdx]
cmp word [r8 + rdx], ax
jne 0x140017c1f
add rdx, 2
sub rdi, 1
jne 0x140017bc2
sub rcx, r10
sar rcx, 1
jne 0x140017ae4
xor r8d, r8d
lea rdx, [0x1400394ac]
lea rcx, [rsp + 0x320]
call fcn.140011770
mov r8, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x210], xmm1
cmp rbx, 0x11
jb 0x140018c3b
jmp 0x140017c2f
add rcx, 2
lea rdx, str.____steam:__run_
jmp 0x140017ac2
lea rax, [rbx - 0x11]
cmp rax, r8
cmovb r8, rax
lea rdx, [rsp + 0x320]
cmp r12, 7
cmova rdx, r15
add rdx, 0x22
lea rcx, [rsp + 0x200]
call fcn.140001550
nop
lea rax, [rsp + 0x200]
cmp qword [rsp + 0x218], 7
cmova rax, qword [rsp + 0x200]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x3e8], rax
movaps xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x3e0], xmm0
lea rdx, [rsp + 0x3e0]
lea rcx, [rsp + 0x300]
call fcn.140006850
mov rdx, rax
lea rcx, [0x14004b180]
call fcn.140007380
lea rcx, [rsp + 0x300]
call fcn.140003e90
nop
mov r8, qword [rsp + 0x218]
cmp r8, 7
jbe 0x140017cf4
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x200]
call fcn.14000d550
lea rdx, str.persistent_mode_2_got_steam_launch_cmd_1
jmp 0x140017b5b
test rcx, rcx
je 0x140017b54
mov rdi, rsi
mov rdx, r11
test rsi, rsi
je 0x140017d34
mov r8, rcx
sub r8, r11
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [rdx + r8], ax
jne 0x140017d7d
add rdx, 2
sub rdi, 1
jne 0x140017d20
sub rcx, r9
sar rcx, 1
jne 0x140017b54
xor r8d, r8d
lea rdx, [0x1400394ac]
lea rcx, [rsp + 0x320]
call fcn.140011770
mov r8, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x340], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x350], xmm1
cmp rbx, 0x17
jb 0x140018c41
jmp 0x140017d86
add rcx, 2
jmp 0x140017b30
lea rax, [rbx - 0x17]
cmp rax, r8
cmovb r8, rax
lea rdx, [rsp + 0x320]
cmp r12, 7
cmova rdx, r15
add rdx, 0x2e
lea rcx, [rsp + 0x340]
call fcn.140001550
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x340]
call fcn.14000afb0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x3e0], xmm0
lea rdx, [rsp + 0x3e0]
lea rcx, [rsp + 0x300]
call fcn.140006850
mov rdx, rax
lea rcx, [0x14004b180]
call fcn.140007380
lea rcx, [rsp + 0x300]
call fcn.140003e90
nop
lea rcx, [rsp + 0x340]
call fcn.1400052a0
lea rdx, str.persistent_mode_2_got_steam_launch_cmd_2
jmp 0x140017b5b
lea rax, [0x14004b180]
cmp qword [0x14004b198], 0xf
cmova rax, qword [0x14004b180]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x24
lea r9, str.persistent_mode_2_will_use_app_id_
lea r8, [0x14004b180]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.14000a660
or r14d, 0x80000000
lea rdx, [rsp + 0x260]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
jmp 0x140017ea4
lea rdx, str.persistent_mode_2_didnt_find_app_id
lea rcx, [0x14004ca60]
call fcn.1400071d0
nop
mov r8, qword [rsp + 0x338]
cmp r8, 7
jbe 0x140017ec7
mov rdx, qword [rsp + 0x320]
lea rcx, [rsp + 0x320]
call fcn.14000d550
xor r12d, r12d
call fcn.140012c80
test al, al
jne 0x140017f20
call fcn.14000ef00
call fcn.14000f1c0
call fcn.14000f450
call fcn.14000eb00
lea rdx, str.Unable_to_patch_Registry__HKCU_.
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.Unable_to_patch_Registry__HKCU_.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
call fcn.1400131a0
test al, al
jne 0x140017f76
call fcn.14000ef00
call fcn.14000f1c0
call fcn.14000f450
call fcn.14000eb00
lea rdx, str.Unable_to_patch_Registry__HKCU_2_.
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.Unable_to_patch_Registry__HKCU_2_.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x140018b35
call fcn.1400137c0
call fcn.1400124a0
cmp dword [0x14004ca58], 2
jne 0x140017f97
cmp qword [0x14004b190], 0
je 0x140018af3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
mov dword [rsp + 0xe4], eax
lea rdi, [rsp + 0x80]
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0x68
movups xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x230], rax
lea rdi, [rsp + 0x220]
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdx, str.spawning_the_requested_EXE_file
lea rcx, [0x14004ca60]
call fcn.1400071d0
lea rdx, [rsp + 0x70]
lea rcx, [0x14004b120]
call fcn.14000af90
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x3e0], xmm0
lea rdx, [rsp + 0x3e0]
lea rcx, [rsp + 0x340]
call fcn.140006a50
nop
mov edx, 1
lea rcx, [rsp + 0xf0]
call fcn.14000a7d0
nop
lea rdx, [0x140039624]
lea rcx, [rsp + 0x100]
call fcn.140007f90
mov rcx, rax
lea rdx, [rsp + 0x340]
call fcn.140008250
mov rcx, rax
lea rdx, [0x14003961c]
call fcn.140007f90
mov rdi, rax
lea rdx, [rsp + 0x70]
lea rcx, [0x14004b160]
call fcn.14000af90
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x3e0], xmm0
lea rdx, [rsp + 0x3e0]
lea rcx, [rsp + 0x2a0]
call fcn.140006a50
nop
mov rdx, rax
mov rcx, rdi
call fcn.140008250
mov rcx, rax
lea rdx, [0x140039618]
call fcn.140007f90
mov rcx, rax
mov rdx, r13
call fcn.140007f90
nop
lea rcx, [rsp + 0x2a0]
call fcn.1400052a0
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0xf0]
call fcn.1400145c0
nop
lea rdx, [rsp + 0x70]
lea rcx, [0x14004b140]
call fcn.14000af90
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x3e0], xmm0
lea rdx, [rsp + 0x3e0]
lea rcx, [rsp + 0x2a0]
call fcn.140006a50
mov rcx, rax
call fcn.14000eaf0
mov rdi, rax
lea rcx, [rsp + 0x2e0]
call fcn.14000eaf0
mov rbx, rax
lea rcx, [rsp + 0x340]
call fcn.14000eaf0
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
lea rcx, [rsp + 0x2a0]
call fcn.1400052a0
test edi, edi
jne 0x140018288
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x300]
call fcn.1400147a0
nop
mov r8, rax
lea rdx, str.Unable_to_load_the_requested_EXE_file__error_
lea rcx, [rsp + 0x2a0]
call fcn.140008350
nop
mov rdx, rax
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
nop
lea rcx, [rsp + 0x300]
call fcn.140003e90
call fcn.14000ef00
call fcn.14000f1c0
call fcn.14000f450
call fcn.14000eb00
mov r9d, 0x10
lea r8, str.ColdClientLoader
lea rdx, str.Unable_to_load_the_requested_EXE_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rsp + 0x2e0]
call fcn.1400052a0
nop
lea rcx, [rsp + 0xf0]
call fcn.14000b0e0
nop
lea rcx, [rsp + 0x340]
call fcn.1400052a0
mov eax, 1
jmp 0x140018b35
mov rdx, qword [0x14004cae8]
sub rdx, qword [0x14004cae0]
sar rdx, 5
lea rcx, [rsp + 0x260]
call fcn.140014830
nop
mov r8, rax
lea rdx, str.injecting
lea rcx, [rsp + 0x300]
call fcn.140008350
nop
lea r8, str._dlls
mov rdx, rax
lea rcx, [rsp + 0x2a0]
call fcn.1400082e0
nop
mov rdx, rax
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
nop
lea rcx, [rsp + 0x300]
call fcn.140003e90
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
mov r13, qword [0x14004cae0]
mov rax, qword [0x14004cae8]
mov qword [rsp + 0x3e0], rax
cmp r13, rax
je 0x14001887e
movzx edi, byte [rsp + 0x50]
movzx ebx, byte [rsp + 0x50]
movzx esi, byte [rsp + 0x50]
nop
mov rcx, qword [r13 + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x10
jb 0x140018c47
mov rax, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140018369
mov rax, qword [r13]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x10
lea r9, str.Injecting_dll:_
mov r8, r13
movzx edx, dil
lea rcx, [rsp + 0x260]
call fcn.14000a660
bts r14d, 0x1e
mov r8d, 5
lea rdx, str._...
lea rcx, [rsp + 0x260]
call fcn.1400054c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x240], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x250], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts r14d, 0x1d
mov dword [rsp + 0x60], r14d
lea rdx, [rsp + 0x240]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov r8, qword [rsp + 0x258]
cmp r8, 0xf
jbe 0x140018439
mov rdx, qword [rsp + 0x240]
lea rcx, [rsp + 0x240]
call fcn.14000d510
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], 0xf
mov byte [rsp + 0x240], 0
lea rcx, [rsp + 0x260]
call fcn.140003e90
mov qword [rsp + 0x70], r12
lea r8, [rsp + 0x70]
mov rdx, r13
mov rcx, qword [rsp + 0x220]
call fcn.140007c00
mov r15d, eax
test eax, eax
je 0x140018859
mov edx, eax
lea rcx, [rsp + 0x400]
call fcn.1400147a0
mov r12, rax
mov edx, r15d
lea rcx, [rsp + 0x3c0]
call fcn.1400079a0
mov r15, rax
mov r14, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
xor eax, eax
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], rax
mov r8d, 0x1a
lea rdx, str.Failed_to_inject_the_dll:
lea rcx, [rsp + 0x200]
call fcn.140001440
nop
mov r8, r13
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x3a0]
call fcn.140008270
nop
mov r8d, 1
lea rdx, [0x140037f74]
mov rcx, rax
call fcn.1400054c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x280], xmm0
xor ecx, ecx
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x298], rcx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x280], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x290], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0xf
mov byte [rax], cl
mov r8, r14
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x380]
call fcn.1400082e0
nop
mov r8d, 1
lea rdx, [0x140037f74]
mov rcx, rax
call fcn.1400054c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x360], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x370], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov r9, r15
lea r8, [rsp + 0x360]
movzx edx, sil
lea rcx, [rsp + 0x2a0]
call fcn.14000a460
nop
mov r8d, 1
lea rdx, [0x140037f74]
lea rcx, [rsp + 0x2a0]
call fcn.1400054c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
mov qword [rsp + 0x250], r14
mov qword [rsp + 0x258], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x240], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x250], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov r8d, 0xd
lea rdx, str.Error_code_
lea rcx, [rsp + 0x240]
call fcn.1400054c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x260], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x270], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov r9, r12
lea r8, [rsp + 0x260]
movzx edx, bl
lea rcx, [rsp + 0x300]
call fcn.14000a460
nop
mov r8d, 1
lea rdx, [0x140037f74]
lea rcx, [rsp + 0x300]
call fcn.1400054c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
xor r12d, r12d
mov qword [rsp + 0x2d0], r12
mov qword [rsp + 0x2d8], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x2c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x2d0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
lea rcx, [rsp + 0x300]
call fcn.140003e90
nop
lea rcx, [rsp + 0x260]
call fcn.140003e90
nop
mov r8, qword [rsp + 0x258]
cmp r8, 0xf
jbe 0x140018721
mov rdx, qword [rsp + 0x240]
lea rcx, [rsp + 0x240]
call fcn.14000d510
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], 0xf
mov byte [rsp + 0x240], 0
lea rcx, [rsp + 0x2a0]
call fcn.140003e90
nop
mov r8, qword [rsp + 0x378]
cmp r8, 0xf
jbe 0x14001876f
mov rdx, qword [rsp + 0x360]
lea rcx, [rsp + 0x360]
call fcn.14000d510
nop
lea rcx, [rsp + 0x380]
call fcn.140003e90
nop
mov r8, qword [rsp + 0x298]
cmp r8, 0xf
jbe 0x1400187a0
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x280]
call fcn.14000d510
mov qword [rsp + 0x290], r12
mov qword [rsp + 0x298], 0xf
mov byte [rsp + 0x280], 0
lea rcx, [rsp + 0x3a0]
call fcn.140003e90
nop
mov r8, qword [rsp + 0x218]
cmp r8, 0xf
jbe 0x1400187ed
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x200]
call fcn.14000d510
mov qword [rsp + 0x210], r12
mov qword [rsp + 0x218], 0xf
mov byte [rsp + 0x200], 0
lea rcx, [rsp + 0x3c0]
call fcn.140003e90
nop
lea rcx, [rsp + 0x400]
call fcn.140003e90
lea rdx, [rsp + 0x2c0]
lea rcx, [0x14004ca60]
call fcn.140006f40
cmp byte [0x14004c9c7], 0
je 0x1400188d3
lea rcx, [rsp + 0x2c0]
call fcn.140003e90
mov r14d, dword [rsp + 0x60]
jmp 0x14001886c
lea rdx, str.Injected_
lea rcx, [0x14004ca60]
call fcn.1400071d0
add r13, 0x20
cmp r13, qword [rsp + 0x3e0]
jne 0x140018340
cmp byte [0x14004c9c9], 0
jne 0x14001894e
lea rdx, str.resuming_the_main_thread_of_the_exe
lea rcx, [0x14004ca60]
call fcn.1400071d0
cmp dword [0x14004ca58], 2
jne 0x1400188c0
mov qword [rsp + 0x3e0], 5
lea rcx, [rsp + 0x3e0]
call fcn.140009bd0
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140018a77
mov edx, 1
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000ef00
call fcn.14000f1c0
call fcn.14000f450
call fcn.14000eb00
lea rcx, [rsp + 0x2c0]
call fcn.14000eae0
mov rdx, rax
mov r9d, 0x10
lea r8, str.ColdClientLoader
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rsp + 0x2c0]
call fcn.140003e90
jmp 0x140018255
mov edx, dword [rsp + 0x230]
lea rcx, [rsp + 0x400]
call fcn.1400147a0
nop
mov r9d, 0x1d
lea r8, str.Attach_a_debugger_now_to_PID
xor edx, edx
mov rcx, rax
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x360], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x370], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x360], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x370], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x1b
lea rdx, str._and_resume_its_main_thread
lea rcx, [rsp + 0x360]
call fcn.1400054c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2d0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x2c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x2d0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x360]
call fcn.140003e90
nop
lea rcx, [rsp + 0x400]
call fcn.140003e90
lea rdx, [rsp + 0x2c0]
lea rcx, [0x14004ca60]
call fcn.140006f40
lea rdx, [rsp + 0x2c0]
cmp qword [rsp + 0x2d8], 0xf
cmova rdx, qword [rsp + 0x2c0]
xor r9d, r9d
lea r8, str.ColdClientLoader
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rsp + 0x2c0]
call fcn.140003e90
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x2e0]
call fcn.1400052a0
nop
lea rcx, [rsp + 0xf0]
call fcn.14000b0e0
nop
lea rcx, [rsp + 0x340]
call fcn.1400052a0
mov eax, dword [0x14004ca58]
cmp eax, 1
jne 0x140018ae4
lea rdx, str.Press_OK_when_you_have_finished_playing_to_close_the_loader
jmp 0x140018afa
cmp eax, 2
jne 0x140018b1f
cmp qword [0x14004b190], 0
jne 0x140018b33
lea rdx, str.Start_the_game__then_press_OK_when_you_have_finished_playing_to_close_the_loader
xor r9d, r9d
lea r8, str.Cold_Client_Loader__waiting_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x14004ca58], 2
jne 0x140018b1f
cmp qword [0x14004b190], 0
jne 0x140018b33
call fcn.14000ef00
call fcn.14000f1c0
call fcn.14000f450
call fcn.14000eb00
xor eax, eax
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.14001b0a0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x16
call fcn.140005220
int3
shr rsi, 0x20
mov ecx, esi
call fcn.140005260
int3
shr rcx, 0x20
call fcn.140005260
nop
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140005310
int3
call fcn.1400050c0
int3
call fcn.140020d94
int3
call fcn.140005310
int3
call fcn.140020d94
int3
call fcn.140005310
int3
call fcn.1400050c0
int3
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140005310
int3
call fcn.140005310
int3
call fcn.140005310
int3
call fcn.140005310
int3
call fcn.140005310
int3
call fcn.140005310
nop
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140005310
nop
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140005310
nop
call fcn.140005310
nop
call fcn.140005310
int3
call fcn.140005330
int3
call fcn.140005330
nop
call fcn.140005310
int3