Function at 0x1400829d0
Capabilities:
Check os version
Create process on windows
Execute command
Get common file path
Query environment variable
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x5f0
mov rax, qword [0x140137040]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
xor esi, esi
call fcn.1400f2de0
mov ebx, eax
test eax, eax
jne 0x14008401c
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x270], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], sil
jne 0x140082a40
mov rdx, rax
lea rcx, [rsp + 0x260]
call fcn.140008640
nop
mov r8d, recv
lea rdx, [0x1401017f8]
lea rcx, [rsp + 0x260]
call fcn.140013b90
xorps xmm0, xmm0
movups xmmword [rsp + 0x2b0], xmm0
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x2c8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x2b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x2c0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov rdx, qword [rsp + 0x278]
cmp rdx, 0xf
jbe 0x140082afb
inc rdx
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082af6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140082af6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f4414
movdqa xmm0, xmmword [0x140112440]
movdqu xmmword [rsp + 0x270], xmm0
mov byte [rsp + 0x260], 0
lea rax, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x298], rax
call fcn.1400f308c
movaps xmm0, xmmword [rsp + 0x290]
movdqa xmmword [rsp + 0x290], xmm0
lea r8, [rsp + 0x290]
mov edx, eax
lea rcx, [rsp + 0x240]
call fcn.140007d50
nop
mov dword [rsp + 0x290], esi
lea r12, [0x1401370c8]
mov qword [rsp + 0x298], r12
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x240]
call fcn.14005e400
cmp dword [rsp + 0x290], 0
jne 0x140084086
lea rcx, [rsp + 0x240]
call fcn.1400138c0
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
sub rax, rcx
cmp rax, 0xc
jb 0x1400840a3
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x30], recv
lea rax, str._version.txt
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x350]
call fcn.140026c20
nop
lea rdx, [rsp + 0x350]
cmp qword [rsp + 0x368], 0xf
cmova rdx, qword [rsp + 0x350]
mov r8d, 2
lea rcx, [rsp + 0x130]
call fcn.140013140
mov rax, qword [rsp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x130], rax
mov rax, qword [rsp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x12c], edx
cmp qword [rsp + 0x1b8], 0
je 0x140082cd5
lea rdx, str.1.3.0
lea rcx, [rsp + 0x130]
call fcn.14001b810
lea rcx, [rsp + 0x138]
call fcn.140013080
test rax, rax
jne 0x140082cd5
mov rax, qword [rsp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x130]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor ecx, ecx
call fcn.14000cd80
test al, al
je 0x1400840a9
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rsi
mov ecx, 0x40
call fcn.1400f40c0
mov rcx, rax
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x270], 0x3b
mov qword [rsp + 0x278], 0x3f
movups xmm0, xmmword [str.Installing_maps_for_vis_check__it_might_take_a_few_minutes_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14010e5d0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14010e5e0]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x14010e5f0]
movsd qword [rax + 0x30], xmm0
movzx eax, word [0x14010e5f8]
mov word [rcx + 0x38], ax
movzx eax, byte [0x14010e5fa]
mov byte [rcx + 0x3a], al
mov byte [rcx + 0x3b], 0
lea rcx, [rsp + 0x260]
call fcn.140082340
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
sub rax, rcx
cmp rax, 0xd
jb 0x1400840c6
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x30], reloc.WS2_32.dll_listen
lea r15, str.mapstri1.zip
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x240]
call fcn.140026c20
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x270], xmm1
mov ecx, 0x30
call fcn.1400f40c0
mov rdx, rax
mov qword [rsp + 0x260], rax
movdqa xmm0, xmmword [0x140112550]
movdqu xmmword [rsp + 0x270], xmm0
movups xmm0, xmmword [str.https:__api.gpv3.ovh_api_files_maps]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14010e578]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x14010e588]
mov word [rax + 0x20], cx
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rdx + 0x22], al
mov byte [rdx + 0x23], 0
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x260]
call fcn.140008770
movzx edi, al
mov rdx, qword [rsp + 0x278]
cmp rdx, 0xf
jbe 0x140082ea2
inc rdx
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082e9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140082e9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f4414
movdqa xmm0, xmmword [0x140112440]
movdqu xmmword [rsp + 0x270], xmm0
mov byte [rsp + 0x260], 0
lea rcx, [rsp + 0x240]
call fcn.140013930
test dil, dil
je 0x1400840cc
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
sub rax, rcx
cmp rax, 0xd
jb 0x1400840e9
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x30], reloc.WS2_32.dll_listen
lea r14, str.mapstri2.zip
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x240]
call fcn.140026c20
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x270], xmm1
mov ecx, 0x30
call fcn.1400f40c0
mov qword [rsp + 0x260], rax
movdqa xmm0, xmmword [0x140112560]
movdqu xmmword [rsp + 0x270], xmm0
movups xmm0, xmmword [str.https:__api.gpv3.ovh_api_files_maps2]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14010e610]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x14010e620]
mov dword [rax + 0x20], ecx
mov byte [rax + 0x24], 0
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x260]
call fcn.140008770
movzx edi, al
mov rdx, qword [rsp + 0x278]
cmp rdx, 0xf
jbe 0x140082fe5
inc rdx
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082fe0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140082fe0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f4414
movdqa xmm0, xmmword [0x140112440]
movdqu xmmword [rsp + 0x270], xmm0
mov byte [rsp + 0x260], 0
lea rcx, [rsp + 0x240]
call fcn.140013930
test dil, dil
je 0x1400840ef
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
sub rax, rcx
cmp rax, 5
jb 0x140084016
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x30], 5
lea rdi, str.maps
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x260]
call fcn.140026c20
nop
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
sub rax, rcx
cmp rax, 0xd
jb 0x14008410c
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x30], reloc.WS2_32.dll_listen
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x240]
call fcn.140026c20
nop
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x240]
call fcn.140082510
nop
lea rcx, [rsp + 0x240]
call fcn.140013930
nop
lea rcx, [rsp + 0x260]
call fcn.140013930
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
sub rax, rcx
cmp rax, 5
jb 0x140084016
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x30], 5
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x260]
call fcn.140026c20
nop
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
sub rax, rcx
cmp rax, 0xd
jb 0x140084112
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x30], reloc.WS2_32.dll_listen
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x240]
call fcn.140026c20
nop
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x240]
call fcn.140082510
nop
lea rcx, [rsp + 0x240]
call fcn.140013930
nop
lea rcx, [rsp + 0x260]
call fcn.140013930
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
sub rax, rcx
cmp rax, 0x15
jb 0x140084118
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x30], socket
lea rax, str.driverkdmapper.exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x240]
call fcn.140026c20
nop
lea rdx, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova rdx, qword [rsp + 0x2b0]
mov r8, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x240]
call fcn.140013b90
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2a0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x290], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x2a0], xmm1
mov qword [rax + 0x18], recv
mov qword [rax + 0x10], rsi
mov byte [rax], 0
mov r8d, recv
lea rdx, str.driverkm.sys
lea rcx, [rsp + 0x290]
call fcn.140013b90
xorps xmm0, xmm0
movups xmmword [rsp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x300], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x2f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x300], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov rdx, qword [rsp + 0x2a8]
cmp rdx, 0xf
jbe 0x14008332c
inc rdx
mov rcx, qword [rsp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140083327
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140083327
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f4414
movdqa xmm0, xmmword [0x140112440]
movdqu xmmword [rsp + 0x2a0], xmm0
mov byte [rsp + 0x290], 0
lea rcx, [rsp + 0x240]
call fcn.140013930
xorps xmm0, xmm0
movups xmmword [rsp + 0x330], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x340], xmm1
mov ecx, 0x30
call fcn.1400f40c0
mov rdx, rax
mov qword [rsp + 0x330], rax
movdqa xmm0, xmmword [0x140112590]
movdqu xmmword [rsp + 0x340], xmm0
movups xmm0, xmmword [str.https:__api.gpv3.ovh_api_files_kdmapper]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14010e670]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x14010e680]
mov dword [rax + 0x20], ecx
movzx eax, word [0x14010e684]
mov word [rdx + 0x24], ax
movzx eax, byte [0x14010e686]
mov byte [rdx + 0x26], al
mov byte [rdx + 0x27], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x310], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x320], xmm1
mov ecx, 0x30
call fcn.1400f40c0
mov rdx, rax
mov qword [rsp + 0x310], rax
movdqa xmm0, xmmword [0x140112570]
movdqu xmmword [rsp + 0x320], xmm0
movups xmm0, xmmword [str.https:__api.gpv3.ovh_api_files_driver]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14010e698]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x14010e6a8]
mov dword [rax + 0x20], ecx
movzx eax, byte [0x14010e6ac]
mov byte [rdx + 0x24], al
mov byte [rdx + 0x25], 0
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
sub rax, rcx
cmp rax, 7
jb 0x14008411e
lea r9, [rsp + 0x2b0]
cmp qword [rsp + 0x2c8], 0xf
cmova r9, qword [rsp + 0x2b0]
mov qword [rsp + 0x30], 7
lea rax, str.driver
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x2d0]
call fcn.140026c20
nop
mov rax, rbx
mov rcx, qword [rsp + 0x2e0]
sub rax, rcx
cmp rax, 0xd
jb 0x140084124
lea r9, [rsp + 0x2d0]
cmp qword [rsp + 0x2e8], 0xf
cmova r9, qword [rsp + 0x2d0]
mov qword [rsp + 0x30], reloc.WS2_32.dll_listen
lea rax, str.kdmapper.exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x390]
call fcn.140026c20
nop
mov rax, qword [rsp + 0x2e0]
sub rbx, rax
cmp rbx, 7
jb 0x14008412a
lea r9, [rsp + 0x2d0]
cmp qword [rsp + 0x2e8], 0xf
cmova r9, qword [rsp + 0x2d0]
mov qword [rsp + 0x30], 7
lea rcx, str.km.sys
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x370]
call fcn.140026c20
nop
lea rax, [rsp + 0x2d0]
cmp qword [rsp + 0x2e8], 0xf
cmova rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x298], rax
call fcn.1400f308c
movaps xmm0, xmmword [rsp + 0x290]
movdqa xmmword [rsp + 0x290], xmm0
lea r8, [rsp + 0x290]
mov edx, eax
lea rcx, [rsp + 0x240]
call fcn.140007d50
nop
mov dword [rsp + 0x290], esi
mov qword [rsp + 0x298], r12
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x240]
call fcn.140008450
movzx ebx, al
cmp dword [rsp + 0x290], 0
jne 0x140084130
lea rcx, [rsp + 0x240]
call fcn.1400138c0
test bl, bl
jne 0x1400836a1
lea rax, [rsp + 0x2d0]
cmp qword [rsp + 0x2e8], 0xf
cmova rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x298], rax
call fcn.1400f308c
movaps xmm0, xmmword [rsp + 0x290]
movdqa xmmword [rsp + 0x290], xmm0
lea r8, [rsp + 0x290]
mov edx, eax
lea rcx, [rsp + 0x260]
call fcn.140007d50
nop
lea rcx, [rsp + 0x260]
cmp qword [rsp + 0x278], 7
cmova rcx, qword [rsp + 0x260]
call fcn.1400f32ec
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14008414d
lea rcx, [rsp + 0x260]
call fcn.1400138c0
test bl, bl
je 0x14008368c
lea rdx, str.Created_driver_directory:
jmp 0x1400836a8
lea rdx, str.Failed_to_create_driver_directory.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001b810
jmp 0x1400836de
lea rdx, str.Driver_directory_already_exists:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001b810
lea rdx, [rsp + 0x2d0]
cmp qword [rsp + 0x2e8], 0xf
mov r8, qword [rsp + 0x2e0]
cmova rdx, qword [rsp + 0x2d0]
mov rcx, rax
call fcn.140027e40
lea rdx, [0x14001b9f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rsi
mov ecx, 0x20
call fcn.1400f40c0
mov rdx, rax
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x270], 0x1b
mov qword [rsp + 0x278], 0x1f
movups xmm0, xmmword [str.Downloading_kdmapper.exe...]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14010e728]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x14010e730]
mov word [rax + 0x18], cx
movzx eax, byte [0x14010e732]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], 0
lea rcx, [rsp + 0x260]
call fcn.140082340
lea rdx, [rsp + 0x390]
lea rcx, [rsp + 0x330]
call fcn.140008770
test al, al
je 0x140084168
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rsi
mov ecx, 0x20
call fcn.1400f40c0
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x270], socket
mov qword [rsp + 0x278], 0x1f
movups xmm0, xmmword [str.Downloading_km.sys...]
movups xmmword [rax], xmm0
mov ecx, dword [0x14010e7e0]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14010e7e4]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea rcx, [rsp + 0x260]
call fcn.140082340
lea rdx, [rsp + 0x370]
lea rcx, [rsp + 0x310]
call fcn.140008770
test al, al
je 0x140084185
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rsp + 0x80], xmm1
movups xmmword [rsp + 0x90], xmm1
movups xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0xb0], xmm1
movups xmmword [rsp + 0xc0], xmm1
movups xmmword [rsp + 0xd0], xmm1
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x80], 0x68
psrldq xmm1, 0xc
movd eax, xmm1
or eax, 1
mov dword [rsp + 0xbc], eax
mov word [rsp + 0xc0], si
lea rdx, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 0xf
cmova rdx, qword [rsp + 0x2f0]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140084298
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x14010e7c0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x3bc]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x3b0], 0x11c
mov dword [rsp + 0x3b4], 6
mov dword [rsp + 0x3b8], 1
mov r8b, 3
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
mov edx, 3
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140083aa8
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rsi
mov ecx, 0x30
call fcn.1400f40c0
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x2a0], 0x26
mov qword [rsp + 0x2a8], 0x2f
movups xmm0, xmmword [str.Your_OS_is_unsupported__bugs_may_occur]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14010e858]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x14010e868]
mov dword [rax + 0x20], ecx
movzx ecx, word [0x14010e86c]
mov word [rax + 0x24], cx
mov byte [rax + 0x26], 0
lea rax, [rsp + 0x290]
mov qword [rsp + 0x50], rax
mov edx, recv
mov rcx, qword [0x1401a9d68]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14010e3d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001b810
lea rdx, [rsp + 0x290]
cmp qword [rsp + 0x2a8], 0xf
cmova rdx, qword [rsp + 0x290]
mov r8, qword [rsp + 0x2a0]
mov rcx, rax
call fcn.140027e40
mov rcx, rax
call fcn.1400842c0
mov edx, 8
mov rcx, qword [0x1401a9d68]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rsp + 0x290]
call fcn.140013930
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rsi
mov ecx, 0x20
call fcn.1400f40c0
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x270], reloc.WS2_32.dll_recv
mov qword [rsp + 0x278], 0x1f
movups xmm0, xmmword [str.Updating_offsets]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
lea rcx, [rsp + 0x260]
call fcn.140082340
call fcn.1400864f0
test eax, eax
je 0x140084276
sub eax, 1
je 0x140084254
cmp eax, 1
jne 0x1400841a2
lea rdx, str.e_1Ae_0G________________________________________________________________________________e_0G
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001b810
lea rdx, str.Offsets_updated
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.140082450
lea rdx, str.Opening_handle_to_driver.
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.140082340
call fcn.1400f25a0
test al, al
je 0x140084232
lea rdx, str.e_1Ae_0G________________________________________________________________________________e_0G
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001b810
lea rdx, str.Successfully_connected_to_kernel_mode_driver
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.140082450
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400842c0
call fcn.1400f2600
test eax, eax
jne 0x140083c92
nop word [rax + rax]
lea rdx, str.e_1Ae_0G________________________________________________________________________________e_0G
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001b810
mov qword [rsp + 0x2a0], recv
mov qword [rsp + 0x2a8], recv
movsd xmm0, qword [str.Waiting_for_CS2]
movsd qword [rsp + 0x290], xmm0
mov eax, dword [0x14010e910]
mov dword [rsp + 0x298], eax
movzx eax, word [0x14010e914]
mov word [rsp + 0x29c], ax
movzx eax, byte [0x14010e916]
mov byte [rsp + 0x29e], al
mov byte [rsp + 0x29f], 0
lea rcx, [rsp + 0x290]
call fcn.140082340
call fcn.1400f2600
test eax, eax
je 0x140083bd0
lea rdx, str.e_1Ae_0G________________________________________________________________________________e_0G
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001b810
lea rdx, str.Connecting_to_CS2__it_may_take_some_time_
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.140082340
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.e_1Ae_0G________________________________________________________________________________e_0G
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001b810
lea rdx, str.Connected_to_CS2
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.140082450
lea rdx, str.Linking_to_CS2
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.140082340
call fcn.1400f2600
mov edx, eax
call fcn.1400f25f0
test al, al
je 0x1400841c4
call fcn.140082200
test al, al
je 0x1400841e6
lea rdx, str.e_1Ae_0G________________________________________________________________________________e_0G
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001b810
lea rdx, str.Linked_to_CS2
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.140082450
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 5
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rcx, [rsp + 0x240]
test eax, eax
jne 0x140084208
lea r8, str.cfg
lea rdx, [rsp + 0x2b0]
call fcn.14001ad60
mov rdx, rax
lea rcx, [0x140197ab0]
call fcn.140012110
lea rcx, [rsp + 0x240]
call fcn.140013930
lea r8, str.cfg
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x240]
call fcn.14001ad60
mov rdx, rax
lea rcx, [0x140197a90]
call fcn.140012110
lea rcx, [rsp + 0x240]
call fcn.140013930
lea rdx, [0x140197ab0]
lea rcx, [rsp + 0x240]
call fcn.14001c950
nop
lea rcx, [rsp + 0x240]
call fcn.140008560
movzx ebx, al
lea rcx, [rsp + 0x240]
call fcn.1400138c0
lea rcx, [rsp + 0x240]
test bl, bl
jne 0x140083e3d
lea rdx, [0x140197ab0]
call fcn.14001c950
nop
lea rcx, [rsp + 0x240]
call fcn.1400085b0
movzx ebx, al
lea rcx, [rsp + 0x240]
call fcn.1400138c0
lea rcx, [rsp + 0x240]
test bl, bl
je 0x14008421d
lea r8, [0x140197ab0]
lea rdx, str.Config_folder_connected:
call fcn.14001c7b0
mov rcx, rax
call fcn.140082450
lea r8, str.default.cfg
lea rdx, [0x140197ab0]
lea rcx, [rsp + 0x260]
call fcn.14001ad60
nop
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.14001c950
nop
lea rcx, [rsp + 0x240]
call fcn.140008560
movzx ebx, al
lea rcx, [rsp + 0x240]
call fcn.1400138c0
nop
lea rcx, [rsp + 0x260]
call fcn.140013930
test bl, bl
je 0x140083ebb
mov byte [0x1401abfd2], 1
lea rdx, str.gpv3_loaded
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.140082450
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x50], rax
lea rax, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rsp + 0xf0], rax
lea rax, [0x1400705d0]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x70], rax
lea rdx, str.SDL_app
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rbx, rax
lea rdx, str.Counter_Strike_2
lea rcx, [rsp + 0x260]
call fcn.140008600
nop
lea r9, [rsp + 0xf0]
mov r8, rbx
mov rdx, rax
call fcn.1400f1580
nop
lea rcx, [rsp + 0x370]
call fcn.140013930
nop
lea rcx, [rsp + 0x390]
call fcn.140013930
nop
lea rcx, [rsp + 0x2d0]
call fcn.140013930
nop
lea rcx, [rsp + 0x310]
call fcn.140013930
nop
lea rcx, [rsp + 0x330]
call fcn.140013930
nop
lea rcx, [rsp + 0x2f0]
call fcn.140013930
nop
lea rcx, [rsp + 0x130]
call fcn.140009cb0
nop
lea rcx, [rsp + 0x350]
call fcn.140013930
nop
lea rcx, [rsp + 0x2b0]
call fcn.140013930
mov rcx, qword [rsp + 0x5e0]
xor rcx, rsp
call fcn.1400f3ce0
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.140004260
nop
lea rcx, [rsp + 0x3b0]
call fcn.1400769b0
nop
lea rdx, str.UIAccess_error:_0x
lea rcx, [rsp + 0x3b0]
call fcn.14001b810
lea rdx, [0x140082320]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14010e224]
call fcn.14001b810
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x3b0]
call fcn.140076900
mov rcx, rax
call fcn.1400823c0
nop
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x290]
lea rcx, str.create_directories
call fcn.1400083f0
nop
call fcn.140004260
nop
lea rdx, str.You_are_not_part_of_pastor_gang_discord_server
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
call fcn.140004260
int3
lea rdx, str.Couldnt_download_maps.zip
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
call fcn.140004260
int3
lea rdx, str.Couldnt_download_maps.zip
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
nop
call fcn.140004260
nop
call fcn.140004260
nop
call fcn.140004260
nop
call fcn.140004260
nop
call fcn.140004260
nop
call fcn.140004260
nop
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x290]
lea rcx, str.exists
call fcn.1400083f0
nop
shr rbx, 0x20
lea r8, [rsp + 0x260]
mov edx, ebx
lea rcx, str.create_directory
call fcn.140008380
nop
lea rdx, str.Failed_to_download_kdmapper.exe
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
lea rdx, str.Failed_to_download_driver__km.sys_
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
call fcn.1400824d0
lea rdx, str.Unknown_connection_error
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
call fcn.1400824d0
lea rdx, str.Failed_to_attach_to_the_process
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
call fcn.1400824d0
lea rdx, str.Failed_to_Init_Address
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
lea rdx, str.Failed_to_get_the_Documents_folder_path
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
lea rdx, str.Failed_to_create_the_config_directory
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
call fcn.1400824d0
lea rdx, str.Failed_to_connect_to_kernel_mode_driver__n_HOW_TO_FIX___:__n1._Restart_your_PC_n2._Run_this_command_in_CMD_as_ADMIN:__sc_stop_gpdriverv3_
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
call fcn.1400824d0
lea rdx, str.Failed_to_Update_Offsets
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
call fcn.1400824d0
lea rdx, str.Bad_internet_connection
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3
lea rdx, str.Failed_to_open_kdmapper
lea rcx, [rsp + 0x240]
call fcn.140008600
mov rcx, rax
call fcn.1400823c0
int3