Function at 0x140004b90
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Enumerate process modules
Inject thread
Query or enumerate registry value
Set console window title
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x678]
sub rsp, 0x750
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rbp + 0x620], rax
lea rcx, str.RawInput2BunnyhopAPE
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea r8, [rbp - 0x68]
lea rdx, str.SOFTWAREValveSteamActiveProcess
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [rbp + 0x440], 4
lea rax, [rbp + 0x440]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ActiveUser
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rbp - 0x70]
lea rcx, [rbp + 0x488]
call fcn.140006c80
nop
lea rdx, [rbp + 0x488]
cmp qword [rbp + 0x4a0], 0xf
cmova rdx, qword [rbp + 0x488]
lea rcx, str.steamid3____s_n
call fcn.140002cc0
lea r8, [rbp - 0x68]
lea rdx, str.SOFTWAREWOW6432NodeValveSteam
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [rbp - 0x70], 0x100
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x520]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InstallPath
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x468], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x478], xmm1
lea rax, [rbp + 0x520]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140004cd0
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x468]
call fcn.140007080
nop
lea rdx, [rbp + 0x468]
cmp qword [rbp + 0x480], 0xf
cmova rdx, qword [rbp + 0x468]
lea rcx, str.steampath___s_n
call fcn.140002cc0
lea r8, [rbp + 0x488]
lea rdx, [rbp + 0x468]
lea rcx, [rbp + 0x400]
call fcn.140004250
nop
mov r15, qword [rbp + 0x410]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, r15
cmp rax, 0x28
jb 0x1400057cd
lea r14, [rbp + 0x400]
cmp qword [rbp + 0x418], 0xf
cmova r14, qword [rbp + 0x400]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rsi, [r15 + 0x28]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
mov eax, 0x16
movabs r13, 0x8000000000000000
cmp rsi, rbx
jbe 0x140004df9
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x140004dc0
mov rbx, r12
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.1400078b0
test rax, rax
je 0x140005658
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004df4
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140004dd4
xor edi, edi
jmp 0x140004df4
cmp rcx, 0x1000
jb 0x140004dec
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400057bb
jmp 0x140004da1
call fcn.1400078b0
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [str._steam__game_garrysmod__insecure__novid]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x140009930]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [0x140009940]
movsd qword [rdi + 0x20], xmm0
lea rcx, [rdi + 0x28]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov rdx, qword [rbp + 0x418]
cmp rdx, 0xf
jbe 0x140004e79
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005658
call fcn.1400078ec
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp + 0x400], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x410], xmm1
lea rdx, [rbp + 0x400]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0xf
cmova rdx, rcx
lea rcx, str.launchopt___s_n
call fcn.140002cc0
lea rdx, [rbp + 0x468]
lea rcx, [rbp + 0x448]
call fcn.1400039e0
nop
lea rdx, [rbp + 0x448]
cmp qword [rbp + 0x460], 0xf
cmova rdx, qword [rbp + 0x448]
lea rcx, str.gmod_path___s_n_n
call fcn.140002cc0
mov r15, qword [rbp + 0x458]
mov rax, r12
sub rax, r15
cmp rax, 0x12
jb 0x1400057d3
lea r14, [rbp + 0x448]
cmp qword [rbp + 0x460], 0xf
cmova r14, qword [rbp + 0x448]
xorps xmm0, xmm0
movups xmmword [rbp + 0x420], xmm0
xor edx, edx
mov qword [rbp + 0x430], rdx
mov qword [rbp + 0x438], rdx
lea rsi, [r15 + 0x12]
mov ebx, 0xf
lea rdi, [rbp + 0x420]
cmp rsi, rbx
jbe 0x140004fc3
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x140004f81
mov rbx, r12
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.1400078b0
test rax, rax
je 0x1400055f4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004fbc
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140004f9c
mov rdi, rdx
jmp 0x140004fbc
cmp rcx, 0x1000
jb 0x140004fb4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400057c1
jmp 0x140004f62
call fcn.1400078b0
mov rdi, rax
mov qword [rbp + 0x420], rdi
mov qword [rbp + 0x430], rsi
mov qword [rbp + 0x438], rbx
mov r8, r15
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.binwin64gmod.exe]
movups xmmword [rdi + r15], xmm0
movzx eax, word [0x140009988]
mov word [rdi + r15 + 0x10], ax
mov byte [rdi + rsi], 0
mov r15, qword [rbp + 0x430]
mov rax, r12
sub rax, r15
cmp rax, 1
jb 0x1400057b5
lea r14, [rbp + 0x420]
cmp qword [rbp + 0x438], 0xf
cmova r14, qword [rbp + 0x420]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rsi, [r15 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp rsi, rbx
jbe 0x1400050bf
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x140005080
mov rbx, r12
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.1400078b0
test rax, rax
je 0x14000523d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400050ba
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14000509a
xor edi, edi
jmp 0x1400050ba
cmp rcx, 0x1000
jb 0x1400050b2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400057c7
jmp 0x140005061
call fcn.1400078b0
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov byte [rdi], 0x22
lea rcx, [rdi + 1]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 2
lea rdx, [0x14000998c]
lea rcx, [rsp + 0x50]
call fcn.140006be0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
lea rdx, [rbp + 0x400]
cmp qword [rbp + 0x418], 0xf
cmova rdx, qword [rbp + 0x400]
mov r8, qword [rbp + 0x410]
lea rcx, [rsp + 0x70]
call fcn.140006be0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp + 0x418]
cmp rdx, 0xf
jbe 0x1400051aa
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400051a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400051a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400078ec
movups xmmword [rbp + 0x400], xmm6
movups xmmword [rbp + 0x410], xmm7
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400051f7
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400051f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400051f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400078ec
movdqa xmm0, xmmword [0x140009a70]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140005249
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005244
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005244
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400078ec
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x4b4], xmm1
movups xmmword [rbp + 0x4c4], xmm1
movups xmmword [rbp + 0x4d4], xmm1
movups xmmword [rbp + 0x4e4], xmm1
movups xmmword [rbp + 0x4f4], xmm1
movups xmmword [rbp + 0x504], xmm1
mov dword [rbp + 0x514], eax
mov dword [rbp + 0x4b0], 0x68
lea rax, [rbp + 0x448]
cmp qword [rbp + 0x460], 0xf
cmova rax, qword [rbp + 0x448]
lea rdx, [rbp + 0x400]
cmp qword [rbp + 0x418], 0xf
cmova rdx, qword [rbp + 0x400]
lea rcx, [rbp + 0x420]
cmp qword [rbp + 0x438], 0xf
cmova rcx, qword [rbp + 0x420]
lea r8, [rbp - 0x60]
mov qword [rsp + 0x48], r8
lea r8, [rbp + 0x4b0]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140005370
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r9d, 0x10
lea r8, str.Error
mov rdx, qword [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 1
jmp 0x1400055bc
xor edx, edx
mov r8d, 0x438
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbp - 0x50]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
test rax, rax
je 0x14000545c
mov dword [rbp - 0x40], 0x438
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140005453
nop word [rax + rax]
lea r8, [0x14000970a]
lea rcx, [rsp + 0x50]
call fcn.140006e20
mov rdx, rax
cmp qword [rax + 0x18], 7
jbe 0x1400053de
mov rdx, qword [rax]
lea rcx, [rbp - 0x10]
sub rdx, rcx
movzx ebx, word [rcx]
movzx eax, word [rcx + rdx]
sub ebx, eax
jne 0x1400053f8
add rcx, 2
test eax, eax
jne 0x1400053e5
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14000543a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005435
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400055fb
call fcn.1400078ec
mov rcx, rdi
test ebx, ebx
je 0x14000548f
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400053c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140005370
cmp dword [rbp - 0x70], 0x103
je 0x140005370
jmp 0x1400055b9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp - 0x28], 0
je 0x14000545c
mov r15, qword [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
movsxd r14, dword [rax + 0x3c]
add r14, rax
mov edx, dword [r14 + 0x50]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov r8d, dword [r14 + 0x50]
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [r14 + 0x50]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r10, rax
mov rdi, rax
sub rdi, rbx
mov r9d, dword [r14 + 0xb0]
add r9, rsi
mov ecx, dword [r9 + 4]
test ecx, ecx
je 0x140005563
mov r11d, 0xfff
nop word [rax + rax]
mov eax, ecx
sub rax, 8
shr rax, 1
lea rdx, [r9 + 8]
test eax, eax
je 0x140005554
mov r8d, eax
movzx eax, word [rdx]
test r11w, ax
je 0x14000554a
and rax, r11
mov ecx, dword [r9]
add rax, rsi
add qword [rcx + rax], rdi
add rdx, 2
sub r8, 1
jne 0x140005534
mov eax, dword [r9 + 4]
add r9, rax
mov ecx, dword [r9 + 4]
test ecx, ecx
jne 0x140005520
mov r9d, dword [r14 + 0x50]
mov qword [rsp + 0x20], r12
mov r8, rsi
mov rdx, r10
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea r9, [0x140003610]
add r9, rdi
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, r12d
mov rdx, qword [rbp + 0x438]
cmp rdx, 0xf
jbe 0x140005607
inc rdx
mov rcx, qword [rbp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005602
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005602
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400078ec
mov qword [rbp + 0x430], r12
mov qword [rbp + 0x438], 0xf
mov byte [rbp + 0x420], 0
mov rdx, qword [rbp + 0x460]
cmp rdx, 0xf
jbe 0x140005664
inc rdx
mov rcx, qword [rbp + 0x448]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000565f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000565f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400078ec
mov qword [rbp + 0x458], r12
mov qword [rbp + 0x460], 0xf
mov byte [rbp + 0x448], 0
mov rdx, qword [rbp + 0x418]
cmp rdx, 0xf
jbe 0x1400056c1
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400056bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400078ec
mov qword [rbp + 0x410], r12
mov qword [rbp + 0x418], 0xf
mov byte [rbp + 0x400], 0
mov rdx, qword [rbp + 0x480]
cmp rdx, 0xf
jbe 0x14000571e
inc rdx
mov rcx, qword [rbp + 0x468]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005719
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005719
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400078ec
movdqa xmm0, xmmword [0x140009a70]
movdqu xmmword [rbp + 0x478], xmm0
mov byte [rbp + 0x468], 0
mov rdx, qword [rbp + 0x4a0]
cmp rdx, 0xf
jbe 0x140005779
inc rdx
mov rcx, qword [rbp + 0x488]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005774
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005774
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400078ec
mov eax, ebx
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.140007890
lea r11, [rsp + 0x750]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002ec0
nop
call fcn.140002e20
nop
call fcn.140002e20
nop
call fcn.140002e20
nop
call fcn.140002ec0
nop
call fcn.140002ec0
int3