Function at 0x140001fd0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14003f020]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r14, qword [0x14003fb50]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x14
jb 0x140002500
lea r12, [0x14003fb40]
cmp qword [0x14003fb58], 0x10
cmovae r12, qword [0x14003fb40]
xor r13d, r13d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r15, [r14 + 0x14]
mov edi, 0xf
lea rsi, [rsp + 0x40]
lea rbx, [rdi - 0x10]
cmp r15, rdi
jbe 0x1400020dd
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x14000207a
mov rdi, rcx
jmp 0x140002086
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
cmovb rcx, rbx
cmp rcx, 0x1000
jb 0x1400020c6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002506
mov rcx, rax
call fcn.1400084c8
test rax, rax
je 0x14000250c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400020d8
test rcx, rcx
je 0x1400020d5
call fcn.1400084c8
mov rsi, rax
jmp 0x1400020d8
mov rsi, r13
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [str.Loader___Built_at:]
movups xmmword [rsi], xmm0
mov eax, dword [0x14003a3c8]
mov dword [rsi + 0x10], eax
lea rcx, [rsi + 0x14]
mov r8, r14
mov rdx, r12
call fcn.14000a2f0
mov byte [rsi + r15], r13b
mov r8d, 1
lea rdx, [0x14003a3b0]
lea rcx, [rsp + 0x40]
call fcn.1400039b0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x14003fb60]
cmp qword [0x14003fb78], 0x10
cmovae rdx, qword [0x14003fb60]
mov r8, qword [0x14003fb70]
lea rcx, [rsp + 0x60]
call fcn.1400039b0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400021e2
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002512
call fcn.1400084c0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140002232
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000222d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002518
call fcn.1400084c0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
lea rdx, [0x14003a3d4]
lea rcx, [0x1400402c0]
call fcn.140004cb0
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x68]
mov rcx, rax
call fcn.140005980
mov rcx, rax
lea rdx, [0x14003a3d0]
call fcn.140004cb0
lea rdx, str._n_Injecting_FamilyRDR2.DLL_.....
lea rcx, [0x1400402c0]
call fcn.140004cb0
mov rcx, rax
lea rdx, [0x14003a3d0]
call fcn.140004cb0
mov dword [rbp - 0x58], 1
mov qword [rbp - 0x54], 0x14
mov dword [rbp - 0x4c], 2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x80]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp - 0x58]
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov r8d, 0x104
lea rdi, [0x140041910]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140002310
add rax, rdi
cmp rax, rdi
jb 0x14000232e
cmp byte [rax], 0x5c
je 0x14000232e
dec rax
cmp rax, rdi
jae 0x140002321
mov byte [rax + 1], 0
call fcn.140001f00
test eax, eax
jne 0x140002349
lea ecx, [rax + 0xa]
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001f00
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x40]
call fcn.14000a9a0
lea r9, str.FamilyGTA5.dll
mov r8, rdi
lea rdx, str._s_s
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdi, [rbp - 0x40]
lea rcx, [0x14003a2db]
test eax, eax
cmove rdi, rcx
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x1400023a0
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x140002439
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400023d0
mov r9, rbx
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002439
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
mov rcx, rax
jne 0x14000243c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str._n_Injection_completed
lea rcx, [0x1400402c0]
call fcn.140004cb0
mov rcx, rax
lea rdx, [0x14003a3d0]
call fcn.140004cb0
lea rdx, [0x14003a428]
lea rcx, [0x1400402c0]
call fcn.140004cb0
mov rbx, rax
lea rcx, str.pause
call fcn.14000ff9c
mov edx, eax
mov rcx, rbx
call fcn.140002520
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400024c8
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400024fa
call fcn.1400084c0
xor eax, eax
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1400084a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140010448
int3
call fcn.140001380
int3
call fcn.1400012e0
int3
call fcn.140010448
nop
call fcn.140010448
nop
call fcn.140010448
int3