Function at 0x140001ec0
Capabilities:
Create process on windows
Create process suspended
Enumerate gui resources
Execute command
Get common file path
Get file size
Read .ini file
Read file on windows
Resume thread
Self delete
Set console window title
Set current directory
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x430], rax
lea rcx, str.Pipsi_ZZZ_:_Nov__6_2024
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
test eax, eax
je 0x14000206c
xor edx, edx
lea rcx, [rbp + 0x210]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x100]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140001f9d
lea r9, [rbp - 0x10]
mov edx, 0x104
lea r8, str._sSettings.ini
lea rcx, [rbp + 0x100]
call fcn.140001010
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x210]
lea r8, [0x140004780]
mov dword [rsp + 0x20], 0x104
lea rdx, str.Executable
lea rcx, str.Settings
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x140002076
lea rcx, str.Select_the_executable_game_file.._n
call fcn.140001190
lea rdx, [rbp + 0x100]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140002557
xorps xmm0, xmm0
mov dword [rbp - 0x10], 0x98
movups xmmword [rbp + 0x18], xmm0
lea rax, [rbp + 0x210]
mov dword [rbp + 0x1c], 1
mov qword [rbp + 0x20], rax
lea rcx, [rbp - 0x10]
lea rax, str.Executable_File__ZenlessZoneZero.exe_
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 8], rax
movups xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x28], 0x104
movups xmmword [rbp + 0x48], xmm0
mov dword [rbp + 0x50], 0x1800
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
test eax, eax
je 0x140002557
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x140002557
lea r8, [rbp + 0x210]
call fcn.140001070
test eax, eax
jne 0x140002076
lea rcx, str.Failed_to_update_executable_path_in_settings._n
call fcn.140001190
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0xffffffff
jmp 0x140002233
xor edx, edx
mov qword [rsp + 0x550], rbx
mov r8d, 0x104
lea rcx, [rbp + 0x320]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x210]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400020a0
cmp ebx, 0x104
jae 0x1400020e4
lea r8, [rbp + 0x210]
mov edx, 0x104
lea rcx, [rbp + 0x320]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
sub ebx, 1
movsxd rax, ebx
js 0x1400020e4
cmp byte [rbp + rax + 0x320], 0x5c
je 0x140002107
dec ebx
sub rax, 1
jns 0x1400020d2
lea rcx, str.Failed_to_remove_file_specification_from_the_path._n
call fcn.140001190
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0xffffffff
jmp 0x14000222b
movsxd rax, ebx
lea r8, str.GameAssembly.dll
mov qword [rsp + 0x558], rsi
lea rcx, [rbp + 0x320]
mov qword [rsp + 0x560], rdi
mov edx, 0x104
mov qword [rsp + 0x568], r14
mov byte [rbp + rax + 0x320], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
xor r14d, r14d
lea rcx, [rbp + 0x320]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x78], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400021d6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400021cd
mov ecx, esi
call fcn.1400026f8
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], r14
mov r8d, esi
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000224b
mov rcx, rbx
call fcn.1400026f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x320]
lea rcx, str.Failed_to_calculate_checksum_for__s_n
call fcn.140001190
xor r8d, r8d
call fcn.140001070
test eax, eax
jne 0x140002201
lea rcx, str.Failed_to_update_executable_path_in_settings._n
call fcn.140001190
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x560]
mov rsi, qword [rsp + 0x558]
mov r14, qword [rsp + 0x568]
mov rbx, qword [rsp + 0x550]
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.1400026d0
add rsp, 0x540
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x5a4d
mov rcx, rbx
cmp word [rbx], ax
je 0x14000226b
call fcn.1400026f0
jmp 0x1400021d6
movsxd rax, dword [rbx + 0x3c]
mov edi, dword [rax + rbx + 0x58]
call fcn.1400026f0
cmp edi, 0x19e48c05
je 0x1400022b5
mov r9d, edi
lea rdx, [rbp + 0x320]
mov r8d, 0x19e48c05
lea rcx, str.Invalid_checksum_for__s._Expected_0x_X__got_0x_X._n
call fcn.140001190
test edi, edi
jne 0x1400021e9
lea rcx, str.Checksum_matches_the_Chinese_version._Please_use_the_Chinese_version_of_the_tool._n
call fcn.140001190
jmp 0x1400021e9
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x100]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x100]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x14000254b
lea r9, [rbp + 0x100]
mov edx, 0x104
lea r8, str._sSettings.ini
lea rcx, [rbp - 0x10]
call fcn.140001010
lea r9, [rbp - 0x10]
mov r8d, 0x61a8
lea rdx, str.Delay
lea rcx, str.Settings
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea rdx, [rbp + 0x210]
mov ebx, eax
lea rcx, str.Launching_executable__s.._n
call fcn.140001190
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x68
xor eax, eax
lea rcx, [rbp + 0x100]
xor edx, edx
mov qword [rsp + 0x60], rax
mov r8d, 0x104
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rsp + 0x50], xmm0
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x210]
lea rdx, [0x140004b2c]
lea rcx, [rbp + 0x100]
call fcn.140001130
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x100]
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400023ee
lea rcx, str.Failed_to_launch_the_executable_file._n
jmp 0x1400021fc
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000253f
cmp qword [rsp + 0x58], r14
je 0x14000253f
lea rdx, str.Bypass.dll
call fcn.140001d10
test eax, eax
je 0x1400024d5
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140002522
lea rcx, str.Waiting_for_the_game_window_to_initialize.._n
call fcn.140001190
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x68]
lea rcx, [0x140002660]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x70], r14
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x70], r14
jne 0x1400024aa
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140002519
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x68]
lea rcx, [0x140002660]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x70], r14
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x70], r14
je 0x140002461
mov edx, ebx
lea rcx, str.Waiting__i_ms_for_game_to_initialize.._n
call fcn.140001190
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x50]
lea rdx, str.Cheat.dll
call fcn.140001d10
test eax, eax
jne 0x140002522
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rcx, str.Failed_to_inject_the_DLL_into_the_process._n
call fcn.140001190
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000220e
lea rcx, str.The_process_has_terminated_before_the_game_window_was_initialized._n
jmp 0x1400024ec
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002213
lea rcx, str.Invalid_process_or_thread_handle._n
jmp 0x1400021fc
lea rcx, str.Unable_to_retrieve_delay_setting_from_settings._n
jmp 0x1400021fc
lea rcx, str.No_executable_file_selected._n
jmp 0x14000205a