Function at 0x1400be5d0
Capabilities:
Enumerate processes
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov rax, qword [0x1401dd140]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov r15, rdx
mov r12d, ecx
xor r13d, r13d
mov dword [rbp - 0x58], r13d
mov dword [rbp - 0x58], 0x400
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400be6c9
lea rdx, [0x140297498]
cmp qword [0x1402974b0], 0xf
cmova rdx, qword [0x140297498]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x60]
test eax, eax
jne 0x1400be6c3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov qword [rbp + 8], r13
lea rax, [rbp + 0x400]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x1400be6b1
lea rdx, [rbp + 0x400]
jmp 0x1400be6e2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov qword [rbp + 8], r13
xor r8d, r8d
lea rdx, [0x140199b7d]
lea rcx, [rbp - 0x10]
call fcn.14001a8d0
lea rdx, [rbp - 0x10]
lea rbx, [0x1402941e0]
mov rcx, rbx
call fcn.14000e460
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400be739
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400be734
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfead
call fcn.14008ad10
mov rdi, qword [reloc.WS2_32.dll_ntohs]
cmp rdi, 0xf
seta r14b
mov rcx, rbx
mov rsi, qword [0x1402941e0]
cmova rcx, rsi
mov r8, qword [0x1402941f0]
test r8, r8
jne 0x1400be7b7
lea rdx, [0x140199b7d]
call fcn.1401768c0
test eax, eax
jne 0x1400be7b7
cmp rdi, 3
jb 0x1400be7a3
test r14b, r14b
cmovne rbx, rsi
mov qword [0x1402941f0], 3
lea r8d, [rax + 3]
lea rdx, [0x14019c778]
mov rcx, rbx
call fcn.140175e80
mov byte [rbx + 3], r13b
jmp 0x1400be7b7
lea r9, [0x14019c778]
mov edx, 3
mov rcx, rbx
call fcn.14001dea0
mov byte [0x14029717c], 1
lea rcx, [rsp + 0x40]
call fcn.1400ea100
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 2
jb 0x1400be862
lea rax, [r8 + 2]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x1400be7f7
mov rdi, qword [rbx]
lea rax, [0x14019c77e]
lea r14, [0x14019c77c]
cmp rax, rdi
jbe 0x1400be825
lea rax, [rdi + r8]
cmp r14, rax
ja 0x1400be825
cmp rdi, r14
ja 0x1400be81d
mov rsi, r13
jmp 0x1400be82a
mov rsi, rdi
sub rsi, r14
jmp 0x1400be82a
mov esi, 2
lea rcx, [rdi + 2]
inc r8
mov rdx, rdi
call fcn.140175e80
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.140175e80
lea rcx, [rdi + rsi]
mov r8d, 2
sub r8, rsi
lea rdx, [r14 + 2]
add rdx, rsi
call fcn.140175e80
jmp 0x1400be887
mov qword [rsp + 0x28], 2
lea r14, [0x14019c77c]
mov qword [rsp + 0x20], r14
mov edx, 2
mov rcx, rbx
call fcn.140029d10
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400be8f1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400be8ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfeca
call fcn.14008ad10
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
cmp r12d, 0xa
je 0x1400be97a
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400be945
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400be940
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfead
call fcn.14008ad10
mov eax, 1
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.14008acf0
lea r11, [rsp + 0x910]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, qword [r15 + 8]
mov qword [0x140297278], rdx
mov rdi, qword [r15 + 0x20]
mov rbx, qword [r15 + 0x30]
mov rsi, qword [r15 + 0x38]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400be9b0
lea rcx, [rbp + 0x60]
call fcn.14001a8d0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x1400be9e0
mov rdx, rdi
lea rcx, [rbp + 0x40]
call fcn.14001a8d0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov qword [rbp + 8], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400bea10
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.14001a8d0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], 0
jne 0x1400bea46
mov rdx, rsi
lea rcx, [rbp + 0x80]
call fcn.14001a8d0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400bea80
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14001a8d0
nop
lea r8, [rbp + 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.1400c09d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400beaec
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400beae6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfed0
call fcn.14008ad10
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x1400beb2d
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400beb28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfee1
call fcn.14008ad10
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400bfed6
lea rax, [rsp + 0x40]
mov qword [rbp - 0x60], rax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000e640
mov rdi, rax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x58], rax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14000e640
mov rbx, rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.14000e640
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400bffc0
lea rcx, [0x140295470]
test al, al
je 0x1400bfeb3
lea rdx, str._n___ready_n
call fcn.140017af0
lea rcx, [rbp - 0x50]
mov r8, qword [rbp - 0x40]
cmp qword [rbp - 0x38], 0xf
jbe 0x1400bebbe
mov rdx, qword [rbp - 0x50]
add r8, rdx
jmp 0x1400bebc5
add r8, rcx
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140018fa0
nop
mov ebx, r13d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400bec6b
mov dword [rbp + 0x1f0], 0x130
lea rdx, [rbp + 0x1f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400bec6b
nop dword [rax + rax]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x21c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.RustClient.exe
lea rcx, [rbp + 0x400]
call fcn.140092cd0
test eax, eax
cmove ebx, dword [rbp + 0x1f8]
lea rdx, [rbp + 0x1f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400bec10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400bee3f
cmp byte [0x14029717c], 0
je 0x1400bee3f
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.close_game_before_launching
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x1400bece6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bece1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfee1
call fcn.14008ad10
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r13w
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x1400bed32
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bed2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfee7
call fcn.14008ad10
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400bed7e
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bed78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfeed
call fcn.14008ad10
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x1400bedba
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bedb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfef3
call fcn.14008ad10
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x1400bedf6
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bedf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfef9
call fcn.14008ad10
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400bf7b0
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bee30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfead
call fcn.14008ad10
mov eax, 0xffffffff
jmp 0x1400be94a
lea rdx, str.____preparing_driver_n
lea rcx, [0x140295470]
call fcn.140017af0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
call fcn.140150840
cmp eax, 0xffffffff
jne 0x1400bf01a
lea rdx, str.____drv_failed_nPress_enter_to_continue..._n
lea rcx, [0x140295470]
call fcn.140017af0
call fcn.14000d710
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x1400beec7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400beec2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfee1
call fcn.14008ad10
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r13w
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x1400bef13
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bef0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfee7
call fcn.14008ad10
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400bef5f
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bef59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfeed
call fcn.14008ad10
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x1400bef9b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bef95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfef3
call fcn.14008ad10
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x1400befd7
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400befd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfef9
call fcn.14008ad10
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400bf7b0
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bee30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bfead
jmp 0x1400bee30
lea rcx, [rbp - 0x60]
call fcn.140002ba0
movabs rcx, 0x7fffffffe2329aff
movabs r14, 0x7fffffffffffffff
mov rax, qword [rbp - 0x60]
cmp rax, rcx
jge 0x1400bf04c
add rax, 0x1dcd6500
mov qword [rbp - 0x60], rax
jmp 0x1400bf050
mov qword [rbp - 0x60], r14
lea rcx, [rbp - 0x60]
call fcn.1400225e0
mov ecx, Ordinal_26
call fcn.14008ae38
mov rdi, rax
mov qword [rbp + 0x80], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov rcx, r14
mov rdx, qword [rbp - 0x40]
sub rcx, rdx
cmp rcx, 4
jb 0x1400bfeff
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rax, qword [rbp - 0x50]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 4
lea r9, [0x14019c80c]
lea rcx, [rsp + 0x40]
call fcn.1400210b0
nop
mov dword [rbp - 0x58], reloc.WS2_32.dll_socket
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi], rax
mov rdx, rax
call fcn.14000d970
mov rcx, rax
lea rdx, str.______drive_n
call fcn.140017af0
nop
mov qword [0x140297378], rdi
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400bf16f
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bf163
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bff05
call fcn.14008ad10
mov rdi, qword [0x140297378]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
lea rcx, [0x140295470]
cmp qword [rdi], 0xffffffffffffffff
jne 0x1400bf1a5
lea rdx, str.____drv_failed2_nPress_enter_to_continue..._n
call fcn.140017af0
call fcn.14000d710
jmp 0x1400bf702
lea rdx, str.___drv_ready_nwaiting_for_MedalTv_n
call fcn.140017af0
lea rcx, str.Medal.exe
call fcn.1400eafb0
movabs r15, 0x7fffffffc46535ff
test eax, eax
jne 0x1400bf2a7
nop
mov edi, r13d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400bf26b
mov dword [rbp + 0x1f0], 0x130
lea rdx, [rbp + 0x1f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400bf26b
nop dword [rax]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x21c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.Medal.exe
lea rcx, [rbp + 0x400]
call fcn.140092cd0
test eax, eax
cmove edi, dword [rbp + 0x1f8]
lea rdx, [rbp + 0x1f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400bf210
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x58]
call fcn.140002ba0
mov rax, qword [rbp - 0x58]
cmp rax, r15
jge 0x1400bf292
add rax, 0x3b9aca00
mov qword [rbp - 0x60], rax
jmp 0x1400bf296
mov qword [rbp - 0x60], r14
lea rcx, [rbp - 0x60]
call fcn.1400225e0
test edi, edi
je 0x1400bf1d0
lea rdx, str.medal_ready_n
lea rcx, [0x140295470]
call fcn.140017af0
lea rcx, [rbp - 0x60]
call fcn.140002ba0
mov rax, qword [rbp - 0x60]
cmp rax, r15
jge 0x1400bf2d8
add rax, 0x3b9aca00
mov qword [rbp - 0x60], rax
jmp 0x1400bf2dc
mov qword [rbp - 0x60], r14
lea rcx, [rbp - 0x60]
call fcn.1400225e0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.caffeine
lea rdx, str.start_game_now
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
test ebx, ebx
jne 0x1400bf3f7
nop word [rax + rax]
mov ebx, r13d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400bf3bb
mov dword [rbp + 0x1f0], 0x130
lea rdx, [rbp + 0x1f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400bf3bb
nop dword [rax]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x21c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.RustClient.exe
lea rcx, [rbp + 0x400]
call fcn.140092cd0
test eax, eax
cmove ebx, dword [rbp + 0x1f8]
lea rdx, [rbp + 0x1f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400bf360
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x58]
call fcn.140002ba0
mov rax, qword [rbp - 0x58]
cmp rax, r15
jge 0x1400bf3e2
add rax, 0x3b9aca00
mov qword [rbp - 0x60], rax
jmp 0x1400bf3e6
mov qword [rbp - 0x60], r14
lea rcx, [rbp - 0x60]
call fcn.1400225e0
test ebx, ebx
je 0x1400bf320
mov edx, ebx
call fcn.14000dda0
mov rcx, rax
lea rdx, str._get_rust_n
call fcn.140017af0
mov ecx, ebx
mov rax, qword [0x140297378]
mov qword [rax + 8], rcx
cmp qword [0x1402972b0], 0
jne 0x1400bf480
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.MedalOverlay
lea rcx, str.MedalOverlayClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1402972b0], rax
lea rcx, [rbp - 0x58]
call fcn.140002ba0
mov rax, qword [rbp - 0x58]
cmp rax, r15
jge 0x1400bf469
add rax, 0x3b9aca00
mov qword [rbp - 0x60], rax
jmp 0x1400bf46d
mov qword [rbp - 0x60], r14
lea rcx, [rbp - 0x60]
call fcn.1400225e0
cmp qword [0x1402972b0], 0
je 0x1400bf430
cmp byte [0x14029717c], 0
je 0x1400bf4d3
nop dword [rax]
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400bf4bc
mov qword [rbp - 0x60], 0xa
lea rcx, [rbp - 0x60]
call fcn.140018da0
cmp byte [0x14029717c], 0
jne 0x1400bf490
jmp 0x1400bf4d3
cmp byte [0x14029717c], 0
je 0x1400bf4d3
mov edx, reloc.WLDAP32.dll_Ordinal_200
lea ecx, [rdx + 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rbp - 0x60], Ordinal_301
lea rcx, [rbp - 0x60]
call fcn.140018da0
mov ecx, 8
call fcn.14008ae38
lea rcx, [0x1400cc0f0]
mov qword [rax], rcx
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x14002a380]
xor edx, edx
xor ecx, ecx
call fcn.140096c88
mov qword [rbp + 0x30], rax
test rax, rax
je 0x1400bfe9e
cmp byte [0x140297265], 0
jne 0x1400bf574
movabs rbx, 0x7fffffffee1e5cff
lea rcx, [rbp - 0x58]
call fcn.140002ba0
mov rax, qword [rbp - 0x58]
cmp rax, rbx
jge 0x1400bf55e
add rax, 0x11e1a300
mov qword [rbp - 0x60], rax
jmp 0x1400bf562
mov qword [rbp - 0x60], r14
lea rcx, [rbp - 0x60]
call fcn.1400225e0
cmp byte [0x140297265], 0
je 0x1400bf540
mov qword [rbp - 0x60], Ordinal_301
lea rcx, [rbp - 0x60]
call fcn.140018da0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140297260], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140297288], eax
movups xmm0, xmmword [str.GameAssembly.dll]
movaps xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [0x14019c8d8]
movaps xmmword [rbp + 0x200], xmm1
movzx eax, word [0x14019c8e8]
mov word [rbp + 0x210], ax
xor edx, edx
mov r8d, 0x1e6
lea rcx, [rbp + 0x212]
call fcn.140176520
mov rcx, qword [0x140297378]
mov qword [rbp + 0x408], r13
mov qword [rbp + 0x410], r13
mov qword [rbp + 0x418], r13
mov qword [rbp + 0x420], r13
mov qword [rbp + 0x428], r13
mov rax, qword [rcx + 8]
mov qword [rbp + 0x400], rax
mov rdx, r13
nop word [rax + rax]
movzx eax, word [rbp + rdx + 0x1f0]
mov word [rbp + rdx + 0x430], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400bf620
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x238
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9d, 0x238
lea r8, [rbp + 0x400]
mov edx, 0x221de4
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400bf689
lea rdx, str.failed_get_module_base_n_n
lea rcx, [0x140295470]
call fcn.140017af0
mov rax, qword [rbp + 0x428]
mov qword [0x140297208], rax
mov rax, qword [0x140295470]
movsxd rcx, dword [rax + 4]
lea rax, [0x140295488]
add rcx, rax
mov eax, dword [rcx]
and eax, 0xfffff9ff
bts eax, 0xb
mov dword [rcx], eax
lea rdx, str.gBjasfje_addr:__0x
lea rcx, [0x140295470]
call fcn.140017af0
mov rdx, qword [0x140297208]
mov rcx, rax
call fcn.14000dba0
mov rcx, rax
lea rdx, [0x140199c14]
call fcn.140017af0
cmp qword [0x140297208], 0
jne 0x1400bf7ba
cmp dword [rbp + 0x38], 0
jne 0x1400bffaa
mov r8, qword [rbp - 0x18]
cmp r8, 7
jbe 0x1400bf719
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.1400148c0
mov word [rbp - 0x30], r13w
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r13
mov r8, qword [rbp + 0x28]
cmp r8, 0xf
jbe 0x1400bf741
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x10]
call fcn.140014a30
mov byte [rbp + 0x10], 0
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x20], r13
mov r8, qword [rbp + 8]
cmp r8, 0xf
jbe 0x1400bf769
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.140014a30
nop
mov r8, qword [rbp + 0x58]
cmp r8, 0xf
jbe 0x1400bf781
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.140014a30
nop
mov r8, qword [rbp + 0x78]
cmp r8, 0xf
jbe 0x1400bf799
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
call fcn.140014a30
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0xf
jbe 0x1400bf7b0
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140014a30
mov eax, 0xffffffff
jmp 0x1400be94a
cmp byte [0x14029717c], 0
je 0x1400bf7d1
mov edx, reloc.WLDAP32.dll_Ordinal_200
lea ecx, [rdx + 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rbp - 0x60], Ordinal_301
lea rcx, [rbp - 0x60]
call fcn.140018da0
mov ecx, Ordinal_26
call fcn.14008ae38
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov rbx, qword [0x140297548]
mov qword [0x140297548], rax
test rbx, rbx
je 0x1400bf840
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x1400bf818
call fcn.140011e80
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400bf826
call fcn.140011e80
mov rdx, qword [rbx]
test rdx, rdx
je 0x1400bf833
call fcn.140011e80
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14008ad10
lea rcx, [rbp - 0x60]
call fcn.140019100
mov rdx, rax
mov rcx, qword [0x140297548]
call fcn.140017ac0
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x1400bf866
call fcn.140011e80
lea rcx, [rbp - 0x60]
call fcn.140019100
mov rcx, qword [0x140297548]
add rcx, 8
mov rdx, rax
call fcn.140017ac0
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x1400bf890
call fcn.140011e80
lea rcx, [rbp - 0x60]
call fcn.140019100
mov rcx, qword [0x140297548]
add rcx, 0x10
mov rdx, rax
call fcn.140017ac0
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x1400bf8ba
call fcn.140011e80
mov ecx, Ordinal_26
call fcn.14008ae38
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [0x140297540]
call fcn.1400191e0
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x1400bf901
mov rcx, rbx
call fcn.140010c40
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14008ad10
mov ecx, Ordinal_26
call fcn.14008ae38
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [0x1402975c0]
call fcn.1400191e0
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x1400bf948
mov rcx, rbx
call fcn.140010c40
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14008ad10
mov ecx, Ordinal_26
call fcn.14008ae38
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [0x140297590]
call fcn.140019230
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x1400bf98f
mov rcx, rbx
call fcn.1400109b0
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14008ad10
mov ecx, Ordinal_26
call fcn.14008ae38
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [0x1402975a0]
call fcn.140019230
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x1400bf9d6
mov rcx, rbx
call fcn.1400109b0
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14008ad10
mov ecx, Ordinal_26
call fcn.14008ae38
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [0x140297538]
call fcn.140019230
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x1400bfa1d
mov rcx, rbx
call fcn.1400109b0
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14008ad10
mov ecx, Ordinal_26
call fcn.14008ae38
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [0x140297528]
call fcn.140019230
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x1400bfa64
mov rcx, rbx
call fcn.1400109b0
mov edx, Ordinal_26
mov rcx, rbx
call fcn.14008ad10
lea rcx, [rbp - 0x60]
call fcn.140018ec0
mov rdx, qword [rax]
mov qword [rax], r13
mov rcx, qword [0x140297530]
mov qword [0x140297530], rdx
test rcx, rcx
je 0x1400bfa90
mov edx, 1
call fcn.140012260
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400bfaa3
mov edx, 1
call fcn.140012260
lea rcx, [rbp - 0x60]
call fcn.140018ec0
mov rdx, qword [rax]
mov qword [rax], r13
mov rcx, qword [0x1402975d0]
mov qword [0x1402975d0], rdx
test rcx, rcx
je 0x1400bfacf
mov edx, 1
call fcn.140012260
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400bfae2
mov edx, 1
call fcn.140012260
lea rcx, [rbp - 0x60]
call fcn.140018ec0
mov rdx, qword [rax]
mov qword [rax], r13
mov rcx, qword [0x1402975b8]
mov qword [0x1402975b8], rdx
test rcx, rcx
je 0x1400bfb0e
mov edx, 1
call fcn.140012260
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400bfb21
mov edx, 1
call fcn.140012260
mov qword [rbp - 0x60], Ordinal_301
lea rcx, [rbp - 0x60]
call fcn.140018da0
lea rdx, [0x1400c5820]
lea rcx, [rbp + 0x150]
call fcn.140019280
nop
lea rdx, [0x1400c4580]
lea rcx, [rbp + 0x140]
call fcn.140019280
nop
lea rdx, [0x1400c1930]
lea rcx, [rbp + 0x130]
call fcn.140019280
nop
lea rdx, [0x1400c2dc0]
lea rcx, [rbp + 0x120]
call fcn.140019280
nop
lea rdx, [0x1400c31b0]
lea rcx, [rbp + 0x110]
call fcn.140019280
nop
lea rdx, [0x1400c33a0]
lea rcx, [rbp + 0x100]
call fcn.140019280
nop
lea rdx, [0x1400c0e90]
lea rcx, [rbp + 0xf0]
call fcn.140019280
nop
lea rdx, [0x1400c2c20]
lea rcx, [rbp + 0xe0]
call fcn.140019280
nop
lea rdx, [0x1400c22e0]
lea rcx, [rbp + 0xd0]
call fcn.140019280
nop
lea rdx, [0x1400c2800]
lea rcx, [rbp + 0xc0]
call fcn.140019280
nop
lea rdx, [0x1400c28b0]
lea rcx, [rbp + 0xb0]
call fcn.140019280
nop
lea rdx, [0x1400c2190]
lea rcx, [rbp + 0x1e0]
call fcn.140019280
nop
lea rdx, [0x1400c20b0]
lea rcx, [rbp + 0x1d0]
call fcn.140019280
nop
lea rdx, [0x1400e82e0]
lea rcx, [rbp + 0xa0]
call fcn.140019280
nop
mov edx, 2
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x1400bfc73
lea rdx, str.Failed_to_set_thread_priority_n
lea rcx, [0x140295720]
call fcn.140017af0
lea rdx, [0x1400e8470]
lea rcx, [rbp + 0x1c0]
call fcn.140019280
nop
lea rdx, [0x1400c2770]
lea rcx, [rbp + 0x1b0]
call fcn.140019280
nop
lea rdx, [0x1400c25a0]
lea rcx, [rbp + 0x1a0]
call fcn.140019280
nop
lea rdx, [0x1400c2440]
lea rcx, [rbp + 0x190]
call fcn.140019280
nop
lea rdx, [0x1400c3800]
lea rcx, [rbp + 0x180]
call fcn.140019280
nop
lea rdx, [0x1400c3980]
lea rcx, [rbp + 0x170]
call fcn.140019280
nop
lea rdx, [0x1400c4440]
lea rcx, [rbp + 0x160]
call fcn.140019280
nop
cmp dword [rbp + 0x38], 0
je 0x1400bff0b
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0x38], eax
je 0x1400bff16
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x80], xmm0
xor edx, edx
lea rcx, [rbp + 0x80]
call fcn.140087b70
test eax, eax
jne 0x1400bff21
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
cmp dword [rbp + 0x168], eax
jne 0x1400bff2c
cmp dword [rbp + 0x178], eax
jne 0x1400bff32
cmp dword [rbp + 0x188], eax
jne 0x1400bff38
cmp dword [rbp + 0x198], eax
jne 0x1400bff3e
cmp dword [rbp + 0x1a8], eax
jne 0x1400bff44
cmp dword [rbp + 0x1b8], eax
jne 0x1400bff4a
cmp dword [rbp + 0x1c8], eax
jne 0x1400bff50
cmp dword [rbp + 0xa8], eax
jne 0x1400bff56
cmp dword [rbp + 0x1d8], eax
jne 0x1400bff5c
cmp dword [rbp + 0x1e8], eax
jne 0x1400bff62
cmp dword [rbp + 0xb8], eax
jne 0x1400bff68
cmp dword [rbp + 0xc8], eax
jne 0x1400bff6e
cmp dword [rbp + 0xd8], eax
jne 0x1400bff74
cmp dword [rbp + 0xe8], eax
jne 0x1400bff7a
cmp dword [rbp + 0xf8], eax
jne 0x1400bff80
cmp dword [rbp + 0x108], eax
jne 0x1400bff86
cmp dword [rbp + 0x118], eax
jne 0x1400bff8c
cmp dword [rbp + 0x128], eax
jne 0x1400bff92
cmp dword [rbp + 0x138], eax
jne 0x1400bff98
cmp dword [rbp + 0x148], eax
jne 0x1400bff9e
cmp dword [rbp + 0x158], eax
jne 0x1400bffa4
psrldq xmm0, 8
movd eax, xmm0
test eax, eax
jne 0x1400bffaa
lea rcx, [rbp - 0x30]
call fcn.140011f10
nop
lea rcx, [rbp + 0x10]
call fcn.140011f80
nop
lea rcx, [rbp - 0x10]
call fcn.140011f80
nop
lea rcx, [rbp + 0x40]
call fcn.140011f80
nop
lea rcx, [rbp + 0x60]
call fcn.140011f80
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0xf
jbe 0x1400bfe97
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140014a30
xor eax, eax
jmp 0x1400be94a
mov dword [rbp + 0x38], r13d
mov ecx, 6
call fcn.140087f18
nop
call fcn.1400a0e94
nop
lea rdx, str._n____failed_n
call fcn.140017af0
mov ecx, 1
call fcn.1400921c8
nop
call fcn.1400a0e94
nop
call fcn.1400a0e94
nop
mov ecx, 1
call fcn.1400921c8
int3
call fcn.1400a0e94
nop
call fcn.1400a0e94
nop
call fcn.1400a0e94
nop
call fcn.1400a0e94
nop
call fcn.1400a0e94
nop
call fcn.140001a40
nop
call fcn.1400a0e94
nop
mov ecx, 1
call fcn.140087f18
int3
mov ecx, 5
call fcn.140087f18
int3
mov ecx, 2
call fcn.140087f18
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
nop
call fcn.14009efd4
int3