Function at 0x140003630
Capabilities:
Create thread
Inject thread
Set console window title

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x300
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov edx, 0x14
lea rcx, [rsp + 0x118]
call fcn.140003520
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rax
lea r8, str..exe
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x180]
call fcn.14000dd30
nop
lea rcx, [rsp + 0x118]
call fcn.14000b530
lea rcx, [rsp + 0x138]
call fcn.1400034a0
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0x180]
call fcn.14000b280
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0xe0]
call fcn.14000b280
mov rcx, qword [rsp + 0xe8]
mov rdx, rcx
mov rcx, rax
call fcn.14001ae28
lea rcx, [rsp + 0x138]
call fcn.14000b530
call fcn.140002f10
mov byte [rsp + 0xa0], al
cmp byte [rsp + 0xa0], 1
je 0x140003716
jmp 0x140003736
xor r9d, r9d
lea r8, str.______
lea rdx, str._________vm___
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.1400186f0
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
call fcn.140004880
mov rcx, rax
call fcn.14000b020
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rax, [rsp + 0x41]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x41]
call fcn.140004970
mov rcx, rax
call fcn.14000af40
mov rcx, rax
call fcn.14001ab64
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x42]
call fcn.140004da0
mov rcx, rax
call fcn.14000ae70
mov rcx, rax
call fcn.14001ab64
lea rax, [rsp + 0x43]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x43]
call fcn.140004ec0
mov rcx, rax
call fcn.14000ad90
mov rcx, rax
call fcn.14001ab64
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x44]
call fcn.140005320
mov rcx, rax
call fcn.14000acc0
mov rcx, rax
call fcn.14001ab64
lea rax, [rsp + 0x45]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x45]
call fcn.140005460
mov rcx, rax
call fcn.14000abe0
mov rcx, rax
call fcn.14001ab64
lea rax, [rsp + 0x46]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x46]
call fcn.140005870
mov rcx, rax
call fcn.14000ab10
mov rcx, rax
call fcn.14001ab64
lea rax, [rsp + 0x47]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x47]
call fcn.1400059f0
mov rcx, rax
call fcn.14000aa40
mov rcx, rax
call fcn.14001ab64
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x48]
call fcn.140005b50
mov rcx, rax
call fcn.14000aa20
mov rcx, rax
call fcn.14001ab64
lea rcx, [rsp + 0x1a0]
call fcn.14000b720
nop
mov dword [rsp + 0x1c0], 0x130
lea rax, [rsp + 0x1c4]
mov rdi, rax
xor eax, eax
mov ecx, 0x12c
rep stosb byte [rdi], al
lea rax, [rsp + 0x49]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x49]
call fcn.140005c30
mov rcx, rax
call fcn.14000aa00
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x4a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x4a]
call fcn.140005d10
mov rcx, rax
call fcn.14000a9e0
mov edx, 4
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x4b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x4b]
call fcn.140005df0
mov rcx, rax
call fcn.14000a9c0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x4c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x4c]
call fcn.140005ed0
mov rcx, rax
call fcn.14000a9a0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x4d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x4d]
call fcn.140005fe0
mov rcx, rax
call fcn.14000a980
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x4e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x4e]
call fcn.140006120
mov rcx, rax
call fcn.14000a960
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x4f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x4f]
call fcn.140006200
mov rcx, rax
call fcn.14000a890
mov edx, 4
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.1400062e0
mov rcx, rax
call fcn.14000a870
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
jmp 0x140003a74
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x158]
mov qword [rsp + 0xf0], rax
lea rdx, str.FiveM_GTAProcess.exe
mov rcx, qword [rsp + 0xf0]
call fcn.14000b610
mov qword [rsp + 0xf8], rax
lea rdx, [rsp + 0x1c0]
mov rcx, qword [rsp + 0xf8]
call fcn.140003190
movzx eax, al
test eax, eax
jne 0x140003abe
jmp 0x140003a69
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x51]
call fcn.1400063d0
mov rcx, rax
call fcn.14000a850
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x52]
call fcn.1400064b0
mov rcx, rax
call fcn.14000a830
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x53]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x53]
call fcn.140006590
mov rcx, rax
call fcn.14000a810
mov edx, 4
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x54]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x54]
call fcn.140006670
mov rcx, rax
call fcn.14000a7f0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x55]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x55]
call fcn.140006750
mov rcx, rax
call fcn.14000a7d0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x56]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x56]
call fcn.140006850
mov rcx, rax
call fcn.14000a700
mov rcx, rax
call fcn.14001ab64
lea rax, [rsp + 0x57]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x57]
call fcn.140006930
mov rcx, rax
call fcn.14000a6e0
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x58]
call fcn.140006a10
mov rcx, rax
call fcn.14000a6c0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x59]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x59]
call fcn.140006af0
mov rcx, rax
call fcn.14000a6a0
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x5a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x5a]
call fcn.140006bd0
mov rcx, rax
call fcn.14000a680
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x5b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x5b]
call fcn.140006cb0
mov rcx, rax
call fcn.14000a5b0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x5c]
call fcn.140006e00
mov rcx, rax
call fcn.14000a590
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x5d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x5d]
call fcn.140006ee0
mov rcx, rax
call fcn.14000a570
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x5e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x5e]
call fcn.140006fc0
mov rcx, rax
call fcn.14000a550
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x5f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x5f]
call fcn.1400070a0
mov rcx, rax
call fcn.14000a530
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x60]
call fcn.140007180
mov rcx, rax
call fcn.14000a510
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x61]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x61]
call fcn.140007280
mov rcx, rax
call fcn.14000a440
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x62]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x62]
call fcn.140007380
mov rcx, rax
call fcn.14000a420
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x63]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x63]
call fcn.140007460
mov rcx, rax
call fcn.14000a400
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x64]
call fcn.140007540
mov rcx, rax
call fcn.14000a3e0
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x65]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x65]
call fcn.140007620
mov rcx, rax
call fcn.14000a3c0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x66]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x66]
call fcn.140007700
mov rcx, rax
call fcn.14000a2f0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x67]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x67]
call fcn.140007800
mov rcx, rax
call fcn.14000a2d0
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x68]
call fcn.140007920
mov rcx, rax
call fcn.14000a2b0
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x69]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x69]
call fcn.140007a00
mov rcx, rax
call fcn.14000a290
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x6a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x6a]
call fcn.140007ae0
mov rcx, rax
call fcn.14000a270
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x6b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x6b]
call fcn.140007bc0
mov rcx, rax
call fcn.14000a250
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x6c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x6c]
call fcn.140007ca0
mov rcx, rax
call fcn.14000a180
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x6d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x6d]
call fcn.140007db0
mov rcx, rax
call fcn.14000a0b0
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x6e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x6e]
call fcn.140007ed0
mov rcx, rax
call fcn.14000a090
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x6f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x6f]
call fcn.140007fb0
mov rcx, rax
call fcn.14000a070
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
call fcn.140008090
mov rcx, rax
call fcn.14000a050
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x71]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x71]
call fcn.140008170
mov rcx, rax
call fcn.14000a030
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x72]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x72]
call fcn.140008250
mov rcx, rax
call fcn.14000a010
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x73]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x73]
call fcn.140008360
mov rcx, rax
call fcn.140009ff0
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x74]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x74]
call fcn.140008440
mov rcx, rax
call fcn.140009fd0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x75]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x75]
call fcn.140008520
mov rcx, rax
call fcn.140009fb0
mov edx, 2
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x76]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x76]
call fcn.140008600
mov rcx, rax
call fcn.140009f90
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x77]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x77]
call fcn.1400086e0
mov rcx, rax
call fcn.140009ec0
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x78]
call fcn.1400087d0
mov rcx, rax
call fcn.140009ea0
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x79]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x79]
call fcn.1400088b0
mov rcx, rax
call fcn.140009e80
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x7a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x7a]
call fcn.140008990
mov rcx, rax
call fcn.140009e60
mov edx, 4
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x7b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x7b]
call fcn.140008a70
mov rcx, rax
call fcn.140009e40
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x7c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x7c]
call fcn.140008b50
mov rcx, rax
call fcn.140009e20
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x7d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x7d]
call fcn.140008c60
mov rcx, rax
call fcn.140009e00
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x7e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x7e]
call fcn.140008d40
mov rcx, rax
call fcn.140009de0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x7f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x7f]
call fcn.140008e20
mov rcx, rax
call fcn.140009dc0
mov edx, 4
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x80]
call fcn.140008f00
mov rcx, rax
call fcn.140009da0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x81]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x81]
call fcn.140008fe0
mov rcx, rax
call fcn.140009cd0
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x82]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x82]
call fcn.140009120
mov rcx, rax
call fcn.140009cb0
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x83]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x83]
call fcn.140009200
mov rcx, rax
call fcn.140009c90
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x84]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x84]
call fcn.1400092e0
mov rcx, rax
call fcn.140009c70
mov edx, 4
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x85]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x85]
call fcn.1400093c0
mov rcx, rax
call fcn.140009c50
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x86]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x86]
call fcn.1400094a0
mov rcx, rax
call fcn.140009b80
mov edx, 0xf
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x87]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x87]
call fcn.1400095b0
mov rcx, rax
call fcn.140009ab0
mov edx, 0xe
mov rcx, rax
call fcn.14000f210
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x88]
call fcn.140009690
mov rcx, rax
call fcn.1400099e0
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x89]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rsp + 0x89]
call fcn.1400097e0
mov rcx, rax
call fcn.140009910
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x8c], 0
cmp dword [rsp + 0x8c], 0
jne 0x1400045e7
mov rcx, qword [rsp + 0x100]
call fcn.1400033e0
mov dword [rsp + 0x8c], eax
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400045bc
mov r8d, dword [rsp + 0x8c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x140004716
cmp qword [rsp + 0x90], 0xffffffffffffffff
je 0x140004716
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x104
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x98], 0xffffffffffffffff
inc qword [rsp + 0x98]
mov rax, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x98]
cmp byte [rax + rcx], 0
jne 0x14000466a
mov rax, qword [rsp + 0x98]
inc rax
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x140004716
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x90], 0
je 0x14000472f
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xa4], 0
lea rcx, [rsp + 0x1a0]
call fcn.14000b530
nop
lea rcx, [rsp + 0x180]
call fcn.14000b530
mov eax, dword [rsp + 0xa4]
jmp 0x14000485c
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.140011c90
add rsp, 0x300
pop rdi
ret