Function at 0x140011744
Capabilities:
Create process on windows
Execute command

Disassembly:
jmp 0x14001ee30
push rbp
push rdi
sub rsp, 0x3f8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140031040]
xor rax, rbp
mov qword [rbp + 0x398], rax
lea rcx, [0x1400390f7]
call fcn.140011a46
lea rdx, str.EmuCPU.ini
lea rcx, [rbp + 8]
call fcn.14001137a
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.1400117d0
nop
lea rcx, [rbp + 0x48]
call fcn.140011735
movzx eax, al
test eax, eax
je 0x14001eef4
lea rdx, str.Error:_Unable_to_retrieve_the_executable_file_path_from_the_ini_file.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011127
lea rdx, [0x140011073]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x324], 1
lea rcx, [rbp + 0x48]
call fcn.14001191f
nop
lea rcx, [rbp + 8]
call fcn.14001191f
mov eax, dword [rbp + 0x324]
jmp 0x14001f142
lea rdx, str.Executable_file_path:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011587
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.140011631
lea rdx, [0x140011523]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x90], 0x68
lea rax, [rbp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rcx, [rbp + 0x48]
call fcn.14001138e
lea rcx, [rbp + 0x118]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14001f018
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x144], eax
lea rdx, str.Error:_Unable_to_start_the_game_process._Error_code:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011127
mov edx, dword [rbp + 0x144]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011073]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x344], 1
lea rcx, [rbp + 0x48]
call fcn.14001191f
nop
lea rcx, [rbp + 8]
call fcn.14001191f
mov eax, dword [rbp + 0x344]
jmp 0x14001f142
lea rdx, str.Game_process_started_successfully.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011587
lea rdx, [0x140011523]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.CEI.dll
lea rcx, [rbp + 0x168]
call fcn.14001137a
nop
mov edx, dword [rbp + 0x128]
lea rcx, [rbp + 0x168]
call fcn.140011465
movzx eax, al
test eax, eax
jne 0x14001f0e2
lea rdx, str.Error:_DLL_injection_failed.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011127
lea rdx, [0x140011073]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x364], 1
lea rcx, [rbp + 0x168]
call fcn.14001191f
nop
lea rcx, [rbp + 0x48]
call fcn.14001191f
nop
lea rcx, [rbp + 8]
call fcn.14001191f
mov eax, dword [rbp + 0x364]
jmp 0x14001f142
lea rdx, str.DLL_injection_successful._DLL_loaded_into_the_process.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011587
lea rdx, [0x140011523]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x384], 0
lea rcx, [rbp + 0x168]
call fcn.14001191f
nop
lea rcx, [rbp + 0x48]
call fcn.14001191f
nop
lea rcx, [rbp + 8]
call fcn.14001191f
mov eax, dword [rbp + 0x384]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14002a9f0]
call fcn.1400118c0
mov rax, rdi
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.140011519
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret