Function at 0x14004c010
Capabilities:
Create thread
Execute command

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x140100040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rcx, 0xfffffffffffffffe
call qword [sym.imp.USER32.dll_SetProcessDpiAwarenessContext]
lea rdx, str.Battlefield_4
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401002e0], rax
test rax, rax
jne 0x14004c1a0
mov r9d, 0x40000
lea r8, str.Info
lea rdx, str.Waiting_BF4...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [0x1401002e0]
test rax, rax
jne 0x14004c1a0
mov qword [rsp + 0x140], rsi
movabs rsi, 0x431bde82d7b634db
mov qword [rsp + 0x148], rdi
movabs rdi, 0x4e94914f0000
mov qword [rsp + 0x150], r14
movabs r14, 0x7fffffffffffffff
mov qword [rsp + 0x120], r15
movabs r15, 0x7ffffffff1194d7f
nop dword [rax]
lea rdx, str.Battlefield_4
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rcx, [rbp]
mov qword [0x1401002e0], rax
call fcn.14005ba30
mov rbx, qword [rbp]
cmp rbx, r15
jge 0x14004c101
add rbx, 0xee6b280
jmp 0x14004c104
mov rbx, r14
lea rcx, [rsp + 0x30]
call fcn.14005ba30
mov rax, qword [rsp + 0x30]
cmp rax, rbx
jge 0x14004c170
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jl 0x14004c132
mov ecx, 0x5265c00
jmp 0x14004c157
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14004c155
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x30]
call fcn.14005ba30
mov rax, qword [rsp + 0x30]
cmp rax, rbx
jl 0x14004c120
mov rax, qword [0x1401002e0]
test rax, rax
je 0x14004c0d0
mov r15, qword [rsp + 0x120]
mov r14, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x140]
lea rdx, [0x1401002e8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x1401002e8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401002f0], rax
test rax, rax
jne 0x14004c207
mov r9d, 0x40010
lea r8, str.ERROR
lea rdx, str.Failed_to_get_process_handle
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400c6220
add rsp, 0x128
pop rbx
pop rbp
ret
call fcn.14004c520
test al, al
jne 0x14004c217
mov eax, 2
jmp 0x14004c1f1
mov rbx, qword [0x140100fd0]
lea rdx, [rsp + 0x40]
xorps xmm0, xmm0
mov eax, 0xffff
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x58], 2
mov rcx, qword [rbx + 0x38]
movups xmmword [rbp - 0x70], xmm0
mov dword [rsp + 0x5c], 1
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x4c], 1
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x7c], 0x7f7fffff
movups xmmword [rsp + 0x60], xmm0
mov dword [rbp - 0x70], 0x3f800000
movups xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x6c], 0x3f800000
movups xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x68], ax
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x54], 0x41700000
movups xmmword [rbp - 0x40], xmm0
call fcn.140029f40
mov rbx, qword [rbx + 0x38]
cmp dword [rbx + 0x78], 0
jne 0x14004c2a6
xor edx, edx
mov rcx, rbx
call fcn.140029f40
mov rax, qword [rbx + 0x488]
test rax, rax
jne 0x14004c2c7
lea rax, [0x14002fd10]
mov qword [0x1401010a8], rax
lea rax, [0x1401010a8]
mov rax, qword [rax]
mov rcx, rbx
call rax
lea rdx, [0x1400e59c8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140100130], rax
call fcn.140052bc0
test al, al
jne 0x14004c2fb
lea rcx, str.mkdir_Config
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
mov byte [0x140100260], 1
call fcn.1400c6248
lea rcx, [rbp + 8]
xor ebx, ebx
mov qword [rsp + 0x28], rcx
lea r8, [0x14004c4f0]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
mov r9, rax
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp], rax
test rax, rax
je 0x14004c4d4
cmp dword [rbp + 8], ebx
je 0x14004c4c8
movaps xmm0, xmmword [rbp]
lea rcx, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004c4c8
cmp byte [0x140100260], bl
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
je 0x14004c4af
nop word [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14004c3d2
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x14004c3a0
mov rax, qword [0x140100fd0]
test rax, rax
je 0x14004c3e7
mov rcx, qword [rax + 0x98]
jmp 0x14004c3ea
mov rcx, rbx
cmp qword [rcx + 0x48], rbx
jne 0x14004c3f5
call fcn.140030e80
call fcn.140031f80
call fcn.14000ee90
call fcn.140001f30
cmp byte [0x140100261], bl
je 0x14004c411
call fcn.140002450
cmp byte [0x140100280], bl
je 0x14004c425
lea rcx, [0x140100130]
call fcn.140003560
call fcn.140010f90
mov rcx, qword [0x140100fe8]
lea r8, [0x140100ff8]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rbp], xmm0
mov edx, 1
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [0x140100fe8]
lea r8, [rbp]
mov rdx, qword [0x140100ff8]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov rax, qword [0x140100fd0]
mov rcx, qword [rax + 0x4b10]
mov rax, qword [rcx]
mov rcx, rbx
add rax, 0x48
cmp byte [rax], cl
cmovne rcx, rax
call fcn.140030220
mov rcx, qword [0x140100ff0]
xor r8d, r8d
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp byte [0x140100260], bl
jne 0x14004c380
call fcn.14004c8a0
mov rcx, qword [0x1401002f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14004c1f1
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 8], ebx
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3