Function at 0x18006e680
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Enumerate threads
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
mov rax, qword [0x18011a070]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
cmp edx, 1
jne 0x180070865
lea rcx, [rbp + 0x570]
call fcn.180056040
lea rdi, [0x180124728]
cmp rdi, rax
je 0x18006e6e7
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.1800760f0
lea rcx, [rbp + 0x570]
call fcn.1800503e0
lea rcx, [rbp + 0x590]
call fcn.180056300
lea rsi, [0x1801247a8]
cmp rsi, rax
je 0x18006e719
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.1800760f0
lea rcx, [rbp + 0x590]
call fcn.1800503e0
lea rcx, [rbp + 0x5b0]
call fcn.180056e00
lea r15, [0x180124748]
cmp r15, rax
je 0x18006e74b
xor r8d, r8d
mov rdx, rax
mov rcx, r15
call fcn.1800760f0
lea rcx, [rbp + 0x5b0]
call fcn.1800503e0
mov dword [rbp - 0x38], 0xe7a6678
mov dword [rbp - 0x34], 0x641b030c
mov dword [rbp - 0x30], 0xd110f03
mov word [rbp - 0x2c], 4
mov byte [rbp - 0x2a], 1
lea rcx, [rbp - 0x38]
call fcn.180070c00
lea rax, [rbp - 0x38]
mov r14, 0xffffffffffffffff
mov qword [rbp + 0x4e0], r14
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x18006e794
lea rdx, [rbp - 0x38]
lea rcx, [0x1801247e8]
call fcn.180075f90
xor edx, edx
lea rcx, [rbp + 0x690]
call fcn.180073200
nop
lea rax, [rbp + 0x558]
mov qword [rbp + 0xd8], rax
mov dword [rbp - 0x58], 0x2751574e
mov dword [rbp - 0x54], 0x1002c28
lea rcx, [rbp - 0x58]
call fcn.180070ba0
lea rax, [rbp - 0x58]
mov qword [rbp + 0x4d8], rax
lea rdx, [rbp + 0x4d8]
lea rcx, [rbp + 0x558]
call fcn.180078f30
mov rbx, rax
mov dword [rbp - 0x50], 0x284b5b50
mov dword [rbp - 0x4c], 0x100262e
lea rcx, [rbp - 0x50]
call fcn.180070ba0
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x690]
call fcn.180078a40
mov rcx, rax
mov rdx, rbx
call fcn.180072eb0
lea rax, [rbp + 0x548]
mov qword [rbp + 0xd8], rax
lea rdx, [0x1801247e8]
lea rcx, [rbp + 0x548]
call fcn.180078890
mov rbx, rax
mov dword [rsp + 0x54], 0x25525f53
mov word [rsp + 0x58], 0x100
lea rcx, [rsp + 0x54]
call fcn.180071200
lea rdx, [rsp + 0x54]
lea rcx, [rbp + 0x690]
call fcn.180078a40
mov rcx, rax
mov rdx, rbx
call fcn.180072eb0
lea rax, [rbp + 0x538]
mov qword [rbp + 0xd8], rax
mov rdx, rdi
lea rcx, [rbp + 0x538]
call fcn.180078890
mov rdi, rax
mov dword [rsp + 0x5c], 0x2f595054
mov word [rsp + 0x60], 0x100
lea rcx, [rsp + 0x5c]
call fcn.180071200
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x690]
call fcn.180078a40
mov rbx, rax
mov dword [rsp + 0x64], 0x24564b48
mov word [rsp + 0x68], 0x100
lea rcx, [rsp + 0x64]
call fcn.180071200
lea rdx, [rsp + 0x64]
mov rcx, rbx
call fcn.180078a40
mov rcx, rax
mov rdx, rdi
call fcn.180072eb0
lea rax, [rbp + 0x528]
mov qword [rbp + 0xd8], rax
mov rdx, rsi
lea rcx, [rbp + 0x528]
call fcn.180078890
mov rdi, rax
mov dword [rsp + 0x4c], 0x2f595054
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x4c]
call fcn.180071200
lea rdx, [rsp + 0x4c]
lea rcx, [rbp + 0x690]
call fcn.180078a40
mov rbx, rax
mov dword [rsp + 0x44], 0xa5a50
mov byte [rsp + 0x48], 1
lea rcx, [rsp + 0x44]
call fcn.180070bd0
lea rdx, [rsp + 0x44]
mov rcx, rbx
call fcn.180078a40
mov rcx, rax
mov rdx, rdi
call fcn.180072eb0
lea rax, [rbp + 0x518]
mov qword [rbp + 0xd8], rax
mov rdx, r15
lea rcx, [rbp + 0x518]
call fcn.180078890
mov rdi, rax
mov dword [rsp + 0x6c], 0x2f595054
mov word [rsp + 0x70], 0x100
lea rcx, [rsp + 0x6c]
call fcn.180071200
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0x690]
call fcn.180078a40
mov rbx, rax
mov dword [rsp + 0x74], 0x255b5f4b
mov word [rsp + 0x78], 0x100
lea rcx, [rsp + 0x74]
call fcn.180071200
lea rdx, [rsp + 0x74]
mov rcx, rbx
call fcn.180078a40
mov rcx, rax
mov rdx, rdi
call fcn.180072eb0
lea rax, [rbp + 0x508]
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0x690]
lea rcx, [rbp + 0x508]
call fcn.180072f20
mov rbx, rax
movdqa xmm0, xmmword [0x180105460]
movdqu xmmword [rbp + 0x478], xmm0
mov dword [rbp + 0x488], 0x60212b
mov byte [rbp + 0x48c], 1
lea rcx, [rbp + 0x478]
call fcn.1800710e0
nop
mov r8, rbx
lea rdx, [rbp + 0x478]
lea rcx, [rbp + 0x6c8]
call fcn.180053f30
nop
lea rdx, [rbp + 0x6c8]
lea rcx, [rbp + 0x5d0]
call fcn.180073d80
mov rdx, rax
lea rcx, [rbp + 0x5f0]
call fcn.1800509b0
lea rcx, [rbp + 0x6c8]
cmp rcx, rax
je 0x18006eaaf
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x6c8]
call fcn.1800760f0
lea rcx, [rbp + 0x5f0]
call fcn.1800503e0
xor r15d, r15d
mov qword [rbp + 0x668], r15
lea rcx, [rbp + 0x6c8]
call fcn.180073bd0
mov qword [rbp + 0x4e8], rax
mov byte [rsp + 0x20], r15b
mov r9b, 1
lea r8, [rbp + 0x630]
lea rdx, [rbp + 0x4e8]
lea rcx, [rbp + 0x6a0]
call fcn.180078760
nop
mov dword [rbp + 0xb8], 0x147e6a6e
mov dword [rbp + 0xbc], 0x171c1114
mov dword [rbp + 0xc0], 0xd040510
mov dword [rbp + 0xc4], 0x100191a
lea rcx, [rbp + 0xb8]
call fcn.1800710b0
mov dword [rsp + 0x7c], 0x255b515e
mov word [rbp - 0x80], 0x100
lea rcx, [rsp + 0x7c]
call fcn.180071200
lea rdx, [rsp + 0x7c]
lea rcx, [rbp + 0x6a0]
call fcn.180078a40
lea rdx, [rbp + 0xb8]
mov rcx, rax
call fcn.180079000
test al, al
je 0x180070814
mov dword [rbp - 0x7c], 0x2f595054
mov word [rbp - 0x78], 0x100
lea rcx, [rbp - 0x7c]
call fcn.180071200
lea rdx, [rbp - 0x7c]
lea rcx, [rbp + 0x6a0]
call fcn.180078a40
mov rbx, rax
mov dword [rbp - 0x64], 0x2549575b
mov word [rbp - 0x60], Ordinal_46
mov byte [rbp - 0x5e], 1
lea rcx, [rbp - 0x64]
call fcn.180071140
lea rdx, [rbp - 0x64]
mov rcx, rbx
call fcn.180078a40
mov rdx, rax
lea rcx, [0x180124788]
call fcn.180080e60
mov dword [rbp - 0x74], 0x2f595054
mov word [rbp - 0x70], 0x100
lea rcx, [rbp - 0x74]
call fcn.180071200
lea rdx, [rbp - 0x74]
lea rcx, [rbp + 0x6a0]
call fcn.180078a40
mov rbx, rax
mov dword [rbp + 0x88], 0x2549575b
mov dword [rbp + 0x8c], 0x2d371d2c
mov dword [rbp + 0x90], 0x1002328
lea rcx, [rbp + 0x88]
call fcn.1800711a0
lea rdx, [rbp + 0x88]
mov rcx, rbx
call fcn.180078a40
mov rdx, rax
lea rcx, [0x1801246e8]
call fcn.180080e60
mov dword [rbp - 0x6c], 0x2f595054
mov word [rbp - 0x68], 0x100
lea rcx, [rbp - 0x6c]
call fcn.180071200
lea rdx, [rbp - 0x6c]
lea rcx, [rbp + 0x6a0]
call fcn.180078a40
mov rbx, rax
mov dword [rbp + 0xa8], 0x2549575b
mov dword [rbp + 0xac], 0x30301d2c
mov dword [rbp + 0xb0], 0x3b323224
mov word [rbp + 0xb4], 0x100
lea rcx, [rbp + 0xa8]
call fcn.180071240
lea rdx, [rbp + 0xa8]
mov rcx, rbx
call fcn.180078a40
mov rdx, rax
lea rcx, [0x1801246c8]
call fcn.180080e60
mov dword [rsp + 0x40], 0x1004346
lea rcx, [rsp + 0x40]
call fcn.180071110
lea rdx, [rsp + 0x40]
lea rcx, [0x180124788]
call fcn.18007d510
test al, al
jne 0x180070814
movzx eax, byte [0x1800f5880]
xor al, 0x3d
mov byte [rsp + 0x30], al
mov word [rsp + 0x31], 0x100
lea rcx, [rsp + 0x30]
call fcn.180071230
lea rdx, [rsp + 0x30]
lea rcx, [0x1801246c8]
call fcn.18007d510
test al, al
jne 0x18006ed4d
movzx eax, byte [0x1800f5888]
xor al, 0x3d
mov byte [rsp + 0x34], al
mov word [rsp + 0x35], 0x100
lea rcx, [rsp + 0x34]
call fcn.180071230
lea rdx, [rsp + 0x34]
lea rcx, [0x1801246c8]
call fcn.18007d510
test al, al
je 0x180070814
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18006edb9
xor edx, edx
lea rcx, [rbp + 0x6a0]
call fcn.180075d30
movzx edx, byte [rbp + 0x6a0]
lea rcx, [rbp + 0x6a8]
call fcn.180075360
nop
lea rcx, [rbp + 0x6c8]
call fcn.1800503e0
nop
xor edx, edx
lea rcx, [rbp + 0x690]
call fcn.180075d30
movzx edx, byte [rbp + 0x690]
lea rcx, [rbp + 0x698]
call fcn.180075360
nop
xor eax, eax
jmp 0x18007086a
mov dword [rbp + 0x670], Ordinal_30
lea rdx, [rbp + 0x670]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18006eecf
mov dword [rbp - 0x48], 0x6e544d52
mov dword [rbp - 0x44], 0x263a24
mov byte [rbp - 0x40], 1
lea rcx, [rbp - 0x48]
call fcn.1800711d0
lea rcx, [rbp - 0x48]
call fcn.180050c50
mov rdi, rax
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbp + 0x67c]
cmp rax, rdi
jne 0x18006eeb7
mov r8d, dword [rbp + 0x678]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov rcx, rax
call fcn.18006dbf0
mov r8d, eax
mov edx, edi
lea rcx, [rbp + 0x6e8]
call fcn.18006db00
nop
mov dword [rbp + 0x98], 0x335d5f49
mov dword [rbp + 0x9c], 0x206d202a
mov dword [rbp + 0xa0], 0x1002a29
lea rcx, [rbp + 0x98]
call fcn.1800711a0
xor r8d, r8d
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x6e8]
call fcn.180073a40
cmp rax, 0xffffffffffffffff
je 0x18006eea1
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x6e8]
call fcn.1800503e0
lea rdx, [rbp + 0x670]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18006ee10
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1800545b0
test eax, eax
jne 0x18006ef32
mov word [rsp + 0x38], 0x100
lea rcx, [rsp + 0x38]
call fcn.180070900
mov rbx, rax
movdqa xmm0, xmmword [str._V__c]
movdqu xmmword [rbp + 0x4f0], xmm0
mov byte [rbp + 0x500], 1
lea rcx, [rbp + 0x4f0]
call fcn.180053ed0
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0x780], 1
lea rcx, [rbp + 0x780]
call fcn.180054770
cmp dword [rbp + 0x780], 0x1337
jne 0x18007089a
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180125ab4], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180125ab0], eax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x18006da60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x180105620]
movdqu xmmword [rbp + 0x448], xmm0
mov dword [rbp + 0x458], 0x616063
mov byte [rbp + 0x45c], 1
lea rcx, [rbp + 0x448]
call fcn.1800710e0
lea rax, [rbp + 0x448]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18006efd0
lea rdx, [rbp + 0x448]
lea rcx, [0x180124708]
call fcn.180075f90
lea rbx, str.FiveM_b3095_GTAProcess.exe
lea rdi, str.FiveM_b2944_GTAProcess.exe
lea rsi, str.FiveM_b2802_GTAProcess.exe
lea r12, str.FiveM_b2699_GTAProcess.exe
lea r13, str.FiveM_b2612_GTAProcess.exe
lea r15, str.FiveM_b2545_GTAProcess.exe
lea r14, str.FiveM_b2372_GTAProcess.exe
nop
movdqa xmm0, xmmword [0x180105a60]
movdqu xmmword [rbp + 0x460], xmm0
mov dword [rbp + 0x470], 0x35372b63
mov word [rbp + 0x474], 0x100
lea rcx, [rbp + 0x460]
call fcn.180070b30
lea rcx, [rbp + 0x460]
call fcn.180050c50
test rax, rax
jne 0x180070337
movdqa xmm0, xmmword [0x180105d20]
movdqu xmmword [rbp + 0x490], xmm0
mov dword [rbp + 0x4a0], 0x2a3628
mov byte [rbp + 0x4a4], 1
lea rcx, [rbp + 0x490]
call fcn.1800710e0
lea rcx, [rbp + 0x490]
call fcn.180050c50
test rax, rax
jne 0x180070337
movdqa xmm0, xmmword [0x1801053f0]
movdqu xmmword [rbp + 0x100], xmm0
mov dword [rbp + 0x110], 0x352c213f
mov dword [rbp + 0x114], 0x317d2122
mov dword [rbp + 0x118], 0x100332d
lea rcx, [rbp + 0x100]
call fcn.180070ad0
lea rcx, [rbp + 0x100]
call fcn.180050c50
test rax, rax
jne 0x1800701c3
movdqa xmm0, xmmword [0x180105850]
movdqu xmmword [rbp + 0x260], xmm0
mov dword [rbp + 0x270], 0x232a2d22
mov dword [rbp + 0x274], 0x2c367c22
mov word [rbp + 0x278], Ordinal_50
mov byte [rbp + 0x27a], 1
lea rcx, [rbp + 0x260]
call fcn.180070b00
lea rcx, [rbp + 0x260]
call fcn.180050c50
test rax, rax
jne 0x1800701c3
movdqa xmm0, xmmword [0x180105400]
movdqu xmmword [rbp + 0xe0], xmm0
mov dword [rbp + 0xf0], 0x352c213f
mov dword [rbp + 0xf4], 0x317d2122
mov dword [rbp + 0xf8], 0x100332d
lea rcx, [rbp + 0xe0]
call fcn.180070ad0
lea rcx, [rbp + 0xe0]
call fcn.180050c50
test rax, rax
jne 0x180070055
movdqa xmm0, xmmword [0x180105890]
movdqu xmmword [rbp + 0x280], xmm0
mov dword [rbp + 0x290], 0x232a2d22
mov dword [rbp + 0x294], 0x2c367c22
mov word [rbp + 0x298], Ordinal_50
mov byte [rbp + 0x29a], 1
lea rcx, [rbp + 0x280]
call fcn.180070b00
lea rcx, [rbp + 0x280]
call fcn.180050c50
test rax, rax
jne 0x180070055
movdqa xmm0, xmmword [0x1801053c0]
movdqu xmmword [rbp + 0x1e0], xmm0
mov dword [rbp + 0x1f0], 0x352c213f
mov dword [rbp + 0x1f4], 0x317d2122
mov dword [rbp + 0x1f8], 0x100332d
lea rcx, [rbp + 0x1e0]
call fcn.180070ad0
lea rcx, [rbp + 0x1e0]
call fcn.180050c50
test rax, rax
jne 0x18006feee
movdqa xmm0, xmmword [0x180105860]
movdqu xmmword [rbp + 0x240], xmm0
mov dword [rbp + 0x250], 0x232a2d22
mov dword [rbp + 0x254], 0x2c367c22
mov word [rbp + 0x258], Ordinal_50
mov byte [rbp + 0x25a], 1
lea rcx, [rbp + 0x240]
call fcn.180070b00
lea rcx, [rbp + 0x240]
call fcn.180050c50
test rax, rax
jne 0x18006feee
movdqa xmm0, xmmword [0x180105390]
movdqu xmmword [rbp + 0x1c0], xmm0
mov dword [rbp + 0x1d0], 0x352c213f
mov dword [rbp + 0x1d4], 0x317d2122
mov dword [rbp + 0x1d8], 0x100332d
lea rcx, [rbp + 0x1c0]
call fcn.180070ad0
lea rcx, [rbp + 0x1c0]
call fcn.180050c50
test rax, rax
jne 0x18006fd87
movdqa xmm0, xmmword [0x180105820]
movdqu xmmword [rbp + 0x2a0], xmm0
mov dword [rbp + 0x2b0], 0x232a2d22
mov dword [rbp + 0x2b4], 0x2c367c22
mov word [rbp + 0x2b8], Ordinal_50
mov byte [rbp + 0x2ba], 1
lea rcx, [rbp + 0x2a0]
call fcn.180070b00
lea rcx, [rbp + 0x2a0]
call fcn.180050c50
test rax, rax
jne 0x18006fd87
movdqa xmm0, xmmword [0x1801053e0]
movdqu xmmword [rbp + 0x1a0], xmm0
mov dword [rbp + 0x1b0], 0x352c213f
mov dword [rbp + 0x1b4], 0x317d2122
mov dword [rbp + 0x1b8], 0x100332d
lea rcx, [rbp + 0x1a0]
call fcn.180070ad0
lea rcx, [rbp + 0x1a0]
call fcn.180050c50
test rax, rax
jne 0x18006fc20
movdqa xmm0, xmmword [0x180105880]
movdqu xmmword [rbp + 0x2c0], xmm0
mov dword [rbp + 0x2d0], 0x232a2d22
mov dword [rbp + 0x2d4], 0x2c367c22
mov word [rbp + 0x2d8], Ordinal_50
mov byte [rbp + 0x2da], 1
lea rcx, [rbp + 0x2c0]
call fcn.180070b00
lea rcx, [rbp + 0x2c0]
call fcn.180050c50
test rax, rax
jne 0x18006fc20
movdqa xmm0, xmmword [str.WI__f]
movdqu xmmword [rbp + 0x180], xmm0
mov dword [rbp + 0x190], 0x352c213f
mov dword [rbp + 0x194], 0x317d2122
mov dword [rbp + 0x198], 0x100332d
lea rcx, [rbp + 0x180]
call fcn.180070ad0
lea rcx, [rbp + 0x180]
call fcn.180050c50
test rax, rax
jne 0x18006fab9
movdqa xmm0, xmmword [0x1801058a0]
movdqu xmmword [rbp + 0x2e0], xmm0
mov dword [rbp + 0x2f0], 0x232a2d22
mov dword [rbp + 0x2f4], 0x2c367c22
mov word [rbp + 0x2f8], Ordinal_50
mov byte [rbp + 0x2fa], 1
lea rcx, [rbp + 0x2e0]
call fcn.180070b00
lea rcx, [rbp + 0x2e0]
call fcn.180050c50
test rax, rax
jne 0x18006fab9
movdqa xmm0, xmmword [0x1801053d0]
movdqu xmmword [rbp + 0x120], xmm0
mov dword [rbp + 0x130], 0x352c213f
mov dword [rbp + 0x134], 0x317d2122
mov dword [rbp + 0x138], 0x100332d
lea rcx, [rbp + 0x120]
call fcn.180070ad0
lea rcx, [rbp + 0x120]
call fcn.180050c50
test rax, rax
jne 0x18006f948
movdqa xmm0, xmmword [0x180105870]
movdqu xmmword [rbp + 0x300], xmm0
mov dword [rbp + 0x310], 0x232a2d22
mov dword [rbp + 0x314], 0x2c367c22
mov word [rbp + 0x318], Ordinal_50
mov byte [rbp + 0x31a], 1
lea rcx, [rbp + 0x300]
call fcn.180070b00
lea rcx, [rbp + 0x300]
call fcn.180050c50
test rax, rax
jne 0x18006f948
movdqa xmm0, xmmword [0x1801053b0]
movdqu xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], 0x352c213f
mov dword [rbp + 0x154], 0x317d2122
mov dword [rbp + 0x158], 0x100332d
lea rcx, [rbp + 0x140]
call fcn.180070ad0
lea rcx, [rbp + 0x140]
call fcn.180050c50
test rax, rax
jne 0x18006f7d7
movdqa xmm0, xmmword [0x180105840]
movdqu xmmword [rbp + 0x320], xmm0
mov dword [rbp + 0x330], 0x232a2d22
mov dword [rbp + 0x334], 0x2c367c22
mov word [rbp + 0x338], Ordinal_50
mov byte [rbp + 0x33a], 1
lea rcx, [rbp + 0x320]
call fcn.180070b00
lea rcx, [rbp + 0x320]
call fcn.180050c50
test rax, rax
jne 0x18006f7d7
movdqa xmm0, xmmword [0x1801053a0]
movdqu xmmword [rbp + 0x160], xmm0
mov dword [rbp + 0x170], 0x352c213f
mov dword [rbp + 0x174], 0x317d2122
mov dword [rbp + 0x178], 0x100332d
lea rcx, [rbp + 0x160]
call fcn.180070ad0
lea rcx, [rbp + 0x160]
call fcn.180050c50
test rax, rax
jne 0x18006f666
movdqa xmm0, xmmword [0x180105830]
movdqu xmmword [rbp + 0x340], xmm0
mov dword [rbp + 0x350], 0x232a2d22
mov dword [rbp + 0x354], 0x2c367c22
mov word [rbp + 0x358], Ordinal_50
mov byte [rbp + 0x35a], 1
lea rcx, [rbp + 0x340]
call fcn.180070b00
lea rcx, [rbp + 0x340]
call fcn.180050c50
test rax, rax
je 0x18007049a
movdqa xmm0, xmmword [0x180105830]
movdqu xmmword [rbp + 0x360], xmm0
mov dword [rbp + 0x370], 0x232a2d22
mov dword [rbp + 0x374], 0x2c367c22
mov word [rbp + 0x378], Ordinal_50
mov byte [rbp + 0x37a], 1
lea rcx, [rbp + 0x360]
call fcn.180070b00
lea rcx, [rbp + 0x360]
call fcn.180050c50
lea rcx, str.VMP_b3095_GameProcess.exe
test rax, rax
cmove rcx, rbx
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x2593320
mov dword [0x180125b18], 0x1f58b58
mov dword [0x180125b34], 0x20019e0
mov dword [0x180125b3c], 0x105dfa9
mov dword [0x180125b04], 0x105df64
mov dword [0x180125b00], 0x134
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2f4
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x11c
mov dword [0x180125b08], 0x110
mov dword [0x180125b38], 0xd10
mov dword [0x180125b48], 0x960
mov dword [0x180125b30], 0x10a8
mov dword [0x180125b44], 0xe8
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x150c
mov dword [0x180125b54], 0x1098
mov dword [0x180125b24], 0x10b8
mov dword [0x18011a0bc], 0x410
mov dword [rbp + 8], 0x175c4c5a
mov dword [rbp + 0xc], 0x2b272c28
mov word [rbp + 0x10], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x12], 1
lea rcx, [rbp + 8]
call fcn.180071170
lea rcx, [rbp + 8]
jmp 0x18007048d
movdqa xmm0, xmmword [0x180105840]
movdqu xmmword [rbp + 0x380], xmm0
mov dword [rbp + 0x390], 0x232a2d22
mov dword [rbp + 0x394], 0x2c367c22
mov word [rbp + 0x398], Ordinal_50
mov byte [rbp + 0x39a], 1
lea rcx, [rbp + 0x380]
call fcn.180070b00
lea rcx, [rbp + 0x380]
call fcn.180050c50
lea rcx, str.VMP_b2944_GameProcess.exe
test rax, rax
cmove rcx, rdi
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x257bea0
mov dword [0x180125b18], 0x1f42068
mov dword [0x180125b34], 0x1feaac0
mov dword [0x180125b3c], 0x1052879
mov dword [0x180125b04], 0x1052834
mov dword [0x180125b00], 0x134
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2f4
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x11c
mov dword [0x180125b08], 0x110
mov dword [0x180125b38], 0xd10
mov dword [0x180125b48], 0x918
mov dword [0x180125b30], 0x10a8
mov dword [0x180125b44], 0xe8
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x150c
mov dword [0x180125b54], 0x1098
mov dword [0x180125b24], 0x10b8
mov dword [0x18011a0bc], 0x410
mov dword [rbp + 0x18], 0x175c4c5a
mov dword [rbp + 0x1c], 0x2b272c28
mov word [rbp + 0x20], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x22], 1
lea rcx, [rbp + 0x18]
call fcn.180071170
lea rcx, [rbp + 0x18]
jmp 0x18007048d
movdqa xmm0, xmmword [0x180105870]
movdqu xmmword [rbp + 0x3a0], xmm0
mov dword [rbp + 0x3b0], 0x232a2d22
mov dword [rbp + 0x3b4], 0x2c367c22
mov word [rbp + 0x3b8], Ordinal_50
mov byte [rbp + 0x3ba], 1
lea rcx, [rbp + 0x3a0]
call fcn.180070b00
lea rcx, [rbp + 0x3a0]
call fcn.180050c50
lea rcx, str.VMP_b2802_GameProcess.exe
test rax, rax
cmove rcx, rsi
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x254d448
mov dword [0x180125b18], 0x1f5b820
mov dword [0x180125b34], 0x1fbc100
mov dword [0x180125b3c], 0x10455f5
mov dword [0x180125b04], 0x10455b0
mov dword [0x180125b00], 0x134
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2f4
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x11c
mov dword [0x180125b08], 0x110
mov dword [0x180125b38], 0xd10
mov dword [0x180125b48], 0x918
mov dword [0x180125b30], 0x10a8
mov dword [0x180125b44], 0x88
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x150c
mov dword [0x180125b54], 0x1098
mov dword [0x180125b24], 0x10b8
mov dword [0x18011a0bc], 0x410
mov dword [rbp - 8], 0x175c4c5a
mov dword [rbp - 4], 0x2b272c28
mov word [rbp], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 2], 1
lea rcx, [rbp - 8]
call fcn.180071170
lea rcx, [rbp - 8]
jmp 0x18007048d
movdqa xmm0, xmmword [0x1801058a0]
movdqu xmmword [rbp + 0x3c0], xmm0
mov dword [rbp + 0x3d0], 0x232a2d22
mov dword [rbp + 0x3d4], 0x2c367c22
mov word [rbp + 0x3d8], Ordinal_50
mov byte [rbp + 0x3da], 1
lea rcx, [rbp + 0x3c0]
call fcn.180070b00
lea rcx, [rbp + 0x3c0]
call fcn.180050c50
lea rcx, str.VMP_b2699_GameProcess.exe
test rax, rax
cmove rcx, r12
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x26684d8
mov dword [0x180125b18], 0x20304c8
mov dword [0x180125b34], 0x20d8c90
mov dword [0x180125b3c], 0x10479f9
mov dword [0x180125b04], 0x10479b4
mov dword [0x180125b00], 0x134
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2f4
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x11c
mov dword [0x180125b08], 0x110
mov dword [0x180125b38], 0xd10
mov dword [0x180125b48], 0x918
mov dword [0x180125b30], 0x10c8
mov dword [0x180125b44], 0x88
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x1530
mov dword [0x180125b54], 0x10b8
mov dword [0x180125b24], 0x10d8
mov dword [rbp + 0x28], 0x175c4c5a
mov dword [rbp + 0x2c], 0x2b272c28
mov word [rbp + 0x30], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x32], 1
lea rcx, [rbp + 0x28]
call fcn.180071170
lea rcx, [rbp + 0x28]
jmp 0x18007048d
movdqa xmm0, xmmword [0x180105880]
movdqu xmmword [rbp + 0x3e0], xmm0
mov dword [rbp + 0x3f0], 0x232a2d22
mov dword [rbp + 0x3f4], 0x2c367c22
mov word [rbp + 0x3f8], Ordinal_50
mov byte [rbp + 0x3fa], 1
lea rcx, [rbp + 0x3e0]
call fcn.180070b00
lea rcx, [rbp + 0x3e0]
call fcn.180050c50
lea rcx, str.VMP_b2612_GameProcess.exe
test rax, rax
cmove rcx, r13
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x2567db0
mov dword [0x180125b18], 0x1f77ef0
mov dword [0x180125b34], 0x1fd8570
mov dword [0x180125b3c], 0x1040dbd
mov dword [0x180125b04], 0x1040d78
mov dword [0x180125b00], 0x134
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2f4
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x11c
mov dword [0x180125b08], 0x110
mov dword [0x180125b38], 0xd30
mov dword [0x180125b48], 0x938
mov dword [0x180125b30], 0x10c8
mov dword [0x180125b44], 0x88
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x1530
mov dword [0x180125b54], 0x10b8
mov dword [0x180125b24], 0x10d8
mov dword [rbp + 0x38], 0x175c4c5a
mov dword [rbp + 0x3c], 0x2b272c28
mov word [rbp + 0x40], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x42], 1
lea rcx, [rbp + 0x38]
call fcn.180071170
lea rcx, [rbp + 0x38]
jmp 0x18007048d
movdqa xmm0, xmmword [0x180105820]
movdqu xmmword [rbp + 0x400], xmm0
mov dword [rbp + 0x410], 0x232a2d22
mov dword [rbp + 0x414], 0x2c367c22
mov word [rbp + 0x418], Ordinal_50
mov byte [rbp + 0x41a], 1
lea rcx, [rbp + 0x400]
call fcn.180070b00
lea rcx, [rbp + 0x400]
call fcn.180050c50
lea rcx, str.VMP_b2545_GameProcess.exe
test rax, rax
cmove rcx, r15
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x25667e8
mov dword [0x180125b18], 0x1f2e7a8
mov dword [0x180125b34], 0x1fd6f70
mov dword [0x180125b3c], 0x103f4ad
mov dword [0x180125b04], 0x103f468
mov dword [0x180125b00], 0x134
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2f4
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x11c
mov dword [0x180125b08], 0x110
mov dword [0x180125b38], 0xd30
mov dword [0x180125b48], 0x938
mov dword [0x180125b30], 0x10c8
mov dword [0x180125b44], 0x88
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x1530
mov dword [0x180125b54], 0x10b8
mov dword [0x180125b24], 0x10d8
mov dword [rbp + 0x48], 0x175c4c5a
mov dword [rbp + 0x4c], 0x2b272c28
mov word [rbp + 0x50], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x52], 1
lea rcx, [rbp + 0x48]
call fcn.180071170
lea rcx, [rbp + 0x48]
jmp 0x18007048d
movdqa xmm0, xmmword [0x180105860]
movdqu xmmword [rbp + 0x420], xmm0
mov dword [rbp + 0x430], 0x232a2d22
mov dword [rbp + 0x434], 0x2c367c22
mov word [rbp + 0x438], Ordinal_50
mov byte [rbp + 0x43a], 1
lea rcx, [rbp + 0x420]
call fcn.180070b00
lea rcx, [rbp + 0x420]
call fcn.180050c50
lea rcx, str.VMP_b2372_GameProcess.exe
test rax, rax
cmove rcx, r14
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x252dcd8
mov dword [0x180125b18], 0x1f05208
mov dword [0x180125b34], 0x1f9e9f0
mov dword [0x180125b3c], 0x1035665
mov dword [0x180125b04], 0x1035620
mov dword [0x180125b00], 0x134
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2f4
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x11c
mov dword [0x180125b08], 0x110
mov dword [0x180125b38], 0xd30
mov dword [0x180125b48], 0x938
mov dword [0x180125b30], 0x10c8
mov dword [0x180125b44], 0x88
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x14e0
mov dword [0x180125b54], 0x10b8
mov dword [0x180125b24], 0x10d8
mov dword [rbp + 0x58], 0x175c4c5a
mov dword [rbp + 0x5c], 0x2b272c28
mov word [rbp + 0x60], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x62], 1
lea rcx, [rbp + 0x58]
call fcn.180071170
lea rcx, [rbp + 0x58]
jmp 0x18007048d
movdqa xmm0, xmmword [0x180105890]
movdqu xmmword [rbp + 0x200], xmm0
mov dword [rbp + 0x210], 0x232a2d22
mov dword [rbp + 0x214], 0x2c367c22
mov word [rbp + 0x218], Ordinal_50
mov byte [rbp + 0x21a], 1
lea rcx, [rbp + 0x200]
call fcn.180070b00
lea rcx, [rbp + 0x200]
call fcn.180050c50
lea rcx, str.VMP_b2189_GameProcess.exe
test rax, rax
lea rax, str.FiveM_b2189_GTAProcess.exe
cmove rcx, rax
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x24e6d90
mov dword [0x180125b18], 0x1ee18a8
mov dword [0x180125b34], 0x1f888c0
mov dword [0x180125b3c], 0x102f8e9
mov dword [0x180125b04], 0x102f8a4
mov dword [0x180125b00], 0x134
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2f4
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x11c
mov dword [0x180125b08], 0x110
mov dword [0x180125b38], 0xd30
mov dword [0x180125b48], 0x938
mov dword [0x180125b30], 0x10c8
mov dword [0x180125b44], 0x78
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x14e0
mov dword [0x180125b54], 0x10b8
mov dword [0x180125b24], 0x10d8
mov dword [rbp + 0x68], 0x175c4c5a
mov dword [rbp + 0x6c], 0x2b272c28
mov word [rbp + 0x70], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x72], 1
lea rcx, [rbp + 0x68]
call fcn.180071170
lea rcx, [rbp + 0x68]
jmp 0x18007048d
movdqa xmm0, xmmword [0x180105850]
movdqu xmmword [rbp + 0x220], xmm0
mov dword [rbp + 0x230], 0x232a2d22
mov dword [rbp + 0x234], 0x2c367c22
mov word [rbp + 0x238], Ordinal_50
mov byte [rbp + 0x23a], 1
lea rcx, [rbp + 0x220]
call fcn.180070b00
lea rcx, [rbp + 0x220]
call fcn.180050c50
lea rcx, str.VMP_b2060_GameProcess.exe
test rax, rax
lea rax, str.FiveM_b2060_GTAProcess.exe
cmove rcx, rax
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x24c8858
mov dword [0x180125b18], 0x1ec3828
mov dword [0x180125b34], 0x1f6a7e0
mov dword [0x180125b3c], 0x101b6d9
mov dword [0x180125b04], 0x101b694
mov dword [0x180125b00], 0x134
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2f4
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x11c
mov dword [0x180125b08], 0x110
mov dword [0x180125b38], 0xd30
mov dword [0x180125b48], 0x938
mov dword [0x180125b30], 0x10c8
mov dword [0x180125b44], 0x78
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x14e0
mov dword [0x180125b54], 0x10b8
mov dword [0x180125b24], 0x10d8
mov dword [rbp + 0x78], 0x175c4c5a
mov dword [rbp + 0x7c], 0x2b272c28
mov word [rbp + 0x80], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x82], 1
lea rcx, [rbp + 0x78]
call fcn.180071170
lea rcx, [rbp + 0x78]
jmp 0x18007048d
movdqa xmm0, xmmword [0x180105d20]
movdqu xmmword [rbp + 0x4a8], xmm0
mov dword [rbp + 0x4b8], 0x2a3628
mov byte [rbp + 0x4bc], 1
lea rcx, [rbp + 0x4a8]
call fcn.1800710e0
lea rcx, [rbp + 0x4a8]
call fcn.180050c50
lea rcx, str.VMP_GameProcess.exe
test rax, rax
lea rax, str.FiveM_GTAProcess.exe
cmove rcx, rax
mov qword [0x180125ad0], rcx
mov dword [0x180125b28], 0x247f840
mov dword [0x180125b18], 0x1efd4c8
mov dword [0x180125b34], 0x2087780
mov dword [0x180125b3c], 0xec58f1
mov dword [0x180125b04], 0xec58ac
mov dword [0x180125b00], 0x12c
mov dword [0x180125b0c], 0x74
mov dword [0x180125b1c], 0x2e8
mov dword [0x180125b40], 0x28c
mov dword [0x180125b4c], 0xb0
mov dword [0x180125b10], 0x114
mov dword [0x180125b08], 0x108
mov dword [0x180125b38], 0xd28
mov dword [0x180125b48], 0x918
mov dword [0x180125b30], 0x10b8
mov dword [0x180125b44], 0x60
mov dword [0x180125b14], 0x60
mov dword [0x180125b2c], 0x90
mov dword [0x180125b20], 0x280
mov dword [0x180125b50], 0x14b8
mov dword [0x180125b54], 0x10a8
mov dword [0x180125b24], 0x10c8
mov dword [rbp - 0x28], 0x175c4c5a
mov dword [rbp - 0x24], 0x2b272c28
mov word [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x1e], 1
lea rcx, [rbp - 0x28]
call fcn.180071170
lea rcx, [rbp - 0x28]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1800704aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18006f020
mov dword [rbp - 0x18], 0x175c4c5a
mov dword [rbp - 0x14], 0x2b272c28
mov word [rbp - 0x10], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0xe], 1
lea rcx, [rbp - 0x18]
call fcn.180071170
xor edx, edx
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str._Founded
lea rcx, [rbp + 0x708]
call fcn.180073d40
nop
lea r8, [rbp + 0x708]
mov rdx, qword [0x180125ad0]
lea rcx, [rbp + 0x610]
call fcn.180077c20
mov rdx, rax
lea rcx, [0x180124708]
call fcn.180073cb0
lea rcx, [rbp + 0x610]
call fcn.1800503e0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x180105570]
movdqu xmmword [rbp + 0x4c0], xmm0
mov word [rbp + 0x4d0], 0x100
lea rcx, [rbp + 0x4c0]
call fcn.180070b70
lea rax, [rbp + 0x4c0]
mov r14, qword [rbp + 0x4e0]
xor r15d, r15d
inc r14
cmp byte [rax + r14], r15b
jne 0x180070561
mov r8, r14
lea rdx, [rbp + 0x4c0]
lea rcx, [0x180124708]
call fcn.180075f90
lea r14, [rbp + 0x808]
lea rsi, [0x180078d70]
lea rdi, [0x180000000]
mov rbx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [rbp + 0x440], 0x77
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x6b0], xmm0
mov qword [rbp + 0x6c0], rax
mov rdx, r14
lea rcx, [rbp + 0x6b0]
call fcn.18004d240
nop
mov ecx, r15d
mov rax, qword [0x180126690]
test rax, rax
je 0x180070609
mov rdx, r15
nop dword [rax + rax]
cmp rax, rsi
je 0x1800705f8
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x126690]
test rax, rax
jne 0x1800705e0
jmp 0x180070609
mov r8, qword [rdi + rdx*8 + 0x125d20]
test r8, r8
jne 0x1800706ef
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x180070630
mov r8, r15
jmp 0x1800706ce
mov rcx, rsi
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x180070640
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x1801269b0]
mov qword [rdi + rax*8 + 0x126690], rsi
mov qword [rdi + rax*8 + 0x125d20], r8
inc rax
mov qword [0x1801269b0], rax
lea rdx, [rbp + 0x440]
mov rcx, rbx
call r8
movzx edx, ax
mov rcx, qword [rbp + 0x6b0]
xor rcx, qword [rbp + 0x6b8]
mov qword [rbp + 0x6b0], rcx
mov rax, qword [rbp + 0x6c0]
mov qword [rax], rcx
test dx, dx
jne 0x180070733
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180070595
xor r8d, r8d
lea rdx, [0x1800f3e32]
lea rcx, [0x180124708]
call fcn.180075f90
mov rcx, qword [0x180125ad0]
call fcn.180050c50
mov dword [0x180125b58], eax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x180125b58]
test eax, eax
je 0x18007079b
mov qword [rbp + 0x730], 2
mov dword [rbp + 0x738], eax
lea rcx, [rbp + 0x730]
call fcn.180054770
mov rax, qword [rbp + 0x740]
mov qword [0x180125b60], rax
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180057d60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180059870]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x18006dce0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x1801258a9], 1
lea rcx, [rbp + 0x708]
call fcn.1800503e0
nop
xor edx, edx
lea rcx, [rbp + 0x6a0]
call fcn.180075d30
movzx edx, byte [rbp + 0x6a0]
lea rcx, [rbp + 0x6a8]
call fcn.180075360
nop
lea rcx, [rbp + 0x6c8]
call fcn.1800503e0
nop
xor edx, edx
lea rcx, [rbp + 0x690]
call fcn.180075d30
movzx edx, byte [rbp + 0x690]
lea rcx, [rbp + 0x698]
call fcn.180075360
nop
mov eax, 1
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.1800df390
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov word [rsp + 0x3c], 0x100
lea rcx, [rsp + 0x3c]
call fcn.180070900
mov rbx, rax
mov dword [rbp + 0xc8], 0x2c565f7b
mov dword [rbp + 0xcc], 0x10632624
mov dword [rbp + 0xd0], 0x2117662a
mov dword [rbp + 0xd4], 0x1002d27
lea rcx, [rbp + 0xc8]
call fcn.180057400
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3