Function at 0x1400064e0
Capabilities:
Contain obfuscated stackstrings
Hide graphical window
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x14002d140]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
movdqa xmm0, xmmword [0x1400260a0]
mov dword [rbp + 0x198], 0x62bb2ee3
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x22c
mov eax, dword [rcx + rdi]
mov ebx, 0x298
add rbx, rdi
test al, 1
jne 0x14000659f
or eax, 1
mov dword [rcx + rdi], eax
mov byte [rbx + 0x15], 1
lea rax, [rbx + 0x14]
lea rcx, [rbp + 0x19c]
cmp rbx, rcx
ja 0x140006582
lea rcx, [rbp + 0x188]
cmp rax, rcx
jb 0x140006582
movups xmmword [rbx], xmm0
mov eax, dword [rbp + 0x198]
mov dword [rbx + 0x10], eax
mov byte [rbx + 0x14], 0xb9
jmp 0x140006592
movups xmmword [rbx], xmm0
mov eax, dword [rbp + 0x198]
mov dword [rbx + 0x10], eax
mov byte [rbx + 0x14], 0xb9
lea rcx, [0x1400215a0]
call fcn.14001fa68
nop
cmp byte [rbx + 0x15], 0
je 0x1400065fc
xor byte [rbx], 0xcd
xor byte [rbx + 1], 0x4b
xor byte [rbx + 2], 0xc3
xor byte [rbx + 3], 7
xor byte [rbx + 4], 0xb9
xor byte [rbx + 5], 0x71
xor byte [rbx + 6], 0xb3
xor byte [rbx + 7], 0x1b
xor byte [rbx + 8], 0xcd
xor byte [rbx + 9], 0x4b
xor byte [rbx + 0xa], 0xc3
xor byte [rbx + 0xb], 7
xor byte [rbx + 0xc], 0xb9
xor byte [rbx + 0xd], 0x71
xor byte [rbx + 0xe], 0xb3
xor byte [rbx + 0xf], 0x1b
xor byte [rbx + 0x10], 0xcd
xor byte [rbx + 0x11], 0x4b
xor byte [rbx + 0x12], 0xc3
xor byte [rbx + 0x13], 7
xor byte [rbx + 0x14], 0xb9
mov byte [rbx + 0x15], 0
mov rcx, rbx
call fcn.140010910
mov r14d, eax
mov ecx, eax
call fcn.1400109d0
mov r13, rax
add rax, 0x6e5c8
mov qword [rbp + 0x160], rax
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x158], rax
movdqa xmm0, xmmword [0x1400261b0]
mov dword [rbp + 0x100], 0x7c0298f1
mov dword [rbp + 0x104], 0x84db62a6
mov word [rbp + 0x108], 0x92fb
mov ecx, 0x1f8
mov eax, dword [rcx + rdi]
mov ebx, 0x130
test al, 1
jne 0x1400066e2
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x1b], 1
lea rax, [rcx + 0x1a]
lea rdx, [rbp + 0x10a]
cmp rcx, rdx
ja 0x1400066b6
lea rdx, [rbp + 0xf0]
cmp rax, rdx
jb 0x1400066b6
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp + 0x100]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp + 0x108]
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], 0x61
jmp 0x1400066d5
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp + 0x100]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp + 0x108]
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], 0x61
lea rcx, [0x140021570]
call fcn.14001fa68
nop
lea rcx, [rdi + rbx]
cmp byte [rcx + 0x1b], 0
je 0x14000675b
xor byte [rcx], 0x83
xor byte [rcx + 1], 0xf7
xor byte [rcx + 2], 0x61
xor byte [rcx + 3], 0x19
xor byte [rcx + 4], 0xd5
xor byte [rcx + 5], 0x11
xor byte [rcx + 6], 0xf5
xor byte [rcx + 7], 0xe1
xor byte [rcx + 8], 0x83
xor byte [rcx + 9], 0xf7
xor byte [rcx + 0xa], 0x61
xor byte [rcx + 0xb], 0x19
xor byte [rcx + 0xc], 0xd5
xor byte [rcx + 0xd], 0x11
xor byte [rcx + 0xe], 0xf5
xor byte [rcx + 0xf], 0xe1
xor byte [rcx + 0x10], 0x83
xor byte [rcx + 0x11], 0xf7
xor byte [rcx + 0x12], 0x61
xor byte [rcx + 0x13], 0x19
xor byte [rcx + 0x14], 0xd5
xor byte [rcx + 0x15], 0x11
xor byte [rcx + 0x16], 0xf5
xor byte [rcx + 0x17], 0xe1
xor byte [rcx + 0x18], 0x83
xor byte [rcx + 0x19], 0xf7
xor byte [rcx + 0x1a], 0x61
mov byte [rcx + 0x1b], 0
call fcn.140010910
mov esi, eax
mov ecx, eax
call fcn.1400109d0
mov r15, rax
add rax, 0x6e5c8
mov qword [rbp + 0x180], rax
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x130], rax
movdqa xmm0, xmmword [0x140026060]
mov dword [rbp + 0xe0], 0xe2422269
mov dword [rbp + 0xe4], 0x489ae86
mov word [rbp + 0xe8], 0x2863
mov ecx, 0x18c
mov eax, dword [rcx + rdi]
mov ebx, 0x270
test al, 1
jne 0x14000683d
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x1b], 1
lea rax, [rcx + 0x1a]
lea rdx, [rbp + 0xea]
cmp rcx, rdx
ja 0x140006811
lea rdx, [rbp + 0xd0]
cmp rax, rdx
jb 0x140006811
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp + 0xe0]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp + 0xe8]
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], 0x21
jmp 0x140006830
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp + 0xe0]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp + 0xe8]
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], 0x21
lea rcx, [0x140021540]
call fcn.14001fa68
nop
lea rcx, [rdi + rbx]
cmp byte [rcx + 0x1b], 0
je 0x1400068b6
xor byte [rcx], 0x1b
xor byte [rcx + 1], 0x4d
xor byte [rcx + 2], 0x21
xor byte [rcx + 3], 0x87
xor byte [rcx + 4], 0xf5
xor byte [rcx + 5], 0xdd
xor byte [rcx + 6], 0xa7
xor byte [rcx + 7], 0x61
xor byte [rcx + 8], 0x1b
xor byte [rcx + 9], 0x4d
xor byte [rcx + 0xa], 0x21
xor byte [rcx + 0xb], 0x87
xor byte [rcx + 0xc], 0xf5
xor byte [rcx + 0xd], 0xdd
xor byte [rcx + 0xe], 0xa7
xor byte [rcx + 0xf], 0x61
xor byte [rcx + 0x10], 0x1b
xor byte [rcx + 0x11], 0x4d
xor byte [rcx + 0x12], 0x21
xor byte [rcx + 0x13], 0x87
xor byte [rcx + 0x14], 0xf5
xor byte [rcx + 0x15], 0xdd
xor byte [rcx + 0x16], 0xa7
xor byte [rcx + 0x17], 0x61
xor byte [rcx + 0x18], 0x1b
xor byte [rcx + 0x19], 0x4d
xor byte [rcx + 0x1a], 0x21
mov byte [rcx + 0x1b], 0
call fcn.140010910
mov ebx, eax
call fcn.1400056c0
mov ecx, ebx
call fcn.1400109d0
mov rdi, rax
add rax, 0x6e5c8
mov qword [rbp + 0x138], rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x270], 0x130
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x274]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0xc3], 0x3d003d37
mov cl, 0x3d
mov dword [rbp + 0xbf], 0x1d500d66
mov dword [rbp + 0xbb], 0x260e457c
mov dword [rbp + 0xb7], 0x6f454770
mov dword [rbp + 0xb3], 0x44785f12
mov dword [rbp + 0xaf], 0x5a5a1359
mov dword [rbp + 0xab], 0x4f525e4e
mov dword [rbp + 0xa7], 0x54591d41
mov dword [rbp + 0xa3], 0x1d647972
mov dword [rbp + 0x9f], 0x7f6f786b
mov dword [rbp + 0x9b], 0x781d786f
mov dword [rbp + 0x97], 0x727b1d78
mov dword [rbp + 0x93], 0x786f7b50
mov dword [rbp + 0x8f], 0xb046626
mov dword [rbp + 0x8b], 0x1d1d1d1d
mov word [rbp + 0x89], 0x3437
mov byte [rbp + 0x88], 0x37
lea rax, [rbp + 0x88]
nop dword [rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp + 0xc5]
cmp rax, rcx
je 0x1400069da
movzx ecx, byte [rbp + 0xc6]
jmp 0x1400069c0
mov byte [rbp + 0xc5], 1
lea rdx, [rbp + 0x88]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000dc20
mov rcx, rax
lea rdx, [0x14000ddf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea r8d, [r12 + 0x1a]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x30]
call fcn.14000e410
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.140006330
test al, al
je 0x140006ae5
mov dword [rbp - 0x73], 0x2700274a
mov cl, 0x27
mov dword [rbp - 0x77], 0x177c3c07
mov dword [rbp - 0x7b], 0x636e0754
mov dword [rbp - 0x7f], 0x54424448
mov dword [rsp + 0x7d], 0x55774a17
mov dword [rsp + 0x79], 0x1e7c3c07
mov dword [rsp + 0x75], 0x4a177c3c
mov dword [rsp + 0x71], 0x7a0c7c4a
mov dword [rsp + 0x6d], 0x111e7c3c
mov dword [rsp + 0x69], 0x7070707
mov byte [rsp + 0x68], 0x2e
lea rax, [rsp + 0x68]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x71]
cmp rax, rcx
je 0x140006ab4
movzx ecx, byte [rbp - 0x70]
jmp 0x140006aa0
mov byte [rbp - 0x71], 1
lea rdx, [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000dc20
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000ddf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov r8d, 0x1a
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rsp + 0x30]
call fcn.14000e410
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.140006330
test al, al
je 0x140006bc4
mov dword [rbp - 0x13], 0x2700274a
mov cl, 0x27
mov dword [rbp - 0x17], 0x177c3c07
mov dword [rbp - 0x1b], 0x636e0754
mov dword [rbp - 0x1f], 0x54424448
mov dword [rbp - 0x23], 0x55774a17
mov dword [rbp - 0x27], 0x1e7c3c07
mov dword [rbp - 0x2b], 0x4a177c3c
mov dword [rbp - 0x2f], 0x7a0c7c4a
mov dword [rbp - 0x33], 0x111e7c3c
mov dword [rbp - 0x37], 0x7070707
mov byte [rbp - 0x38], 0x2e
lea rax, [rbp - 0x38]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x11]
cmp rax, rcx
je 0x140006b94
movzx ecx, byte [rbp - 0x10]
jmp 0x140006b80
mov byte [rbp - 0x11], 1
lea rdx, [rbp - 0x38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000dc20
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000ddf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov r8d, 0x14
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x30]
call fcn.14000e410
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.140006330
test al, al
je 0x140006ca4
mov dword [rbp - 0x43], 0x2700274a
mov cl, 0x27
mov dword [rbp - 0x47], 0x177c3c07
mov dword [rbp - 0x4b], 0x636e0754
mov dword [rbp - 0x4f], 0x54424448
mov dword [rbp - 0x53], 0x55774a17
mov dword [rbp - 0x57], 0x1e7c3c07
mov dword [rbp - 0x5b], 0x4a177c3c
mov dword [rbp - 0x5f], 0x7a0c7c4a
mov dword [rbp - 0x63], 0x111e7c3c
mov dword [rbp - 0x67], 0x7070707
mov byte [rbp - 0x68], 0x2e
lea rax, [rbp - 0x68]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x41]
cmp rax, rcx
je 0x140006c74
movzx ecx, byte [rbp - 0x40]
jmp 0x140006c60
mov byte [rbp - 0x41], 1
lea rdx, [rbp - 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000dc20
mov rcx, rax
mov rdx, r14
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14000ddf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x50], 0x2a002a47
mov cl, 0x2a
mov dword [rbp + 0x4c], 0x1b197131
mov dword [rbp + 0x48], 0xa471a71
mov dword [rbp + 0x44], 0x316f616b
mov dword [rbp + 0x40], 0x6c0a797a
mov dword [rbp + 0x3c], 0x6c471a13
mov dword [rbp + 0x38], 0x71310a47
mov dword [rbp + 0x34], 0x1a713177
mov dword [rbp + 0x30], 0x171471c
mov dword [rbp + 0x2c], 0x1371310a
mov dword [rbp + 0x28], 0xa0a0a23
lea rax, [rbp + 0x28]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp + 0x52]
cmp rax, rcx
je 0x140006d14
movzx ecx, byte [rbp + 0x53]
jmp 0x140006d00
mov byte [rbp + 0x52], 1
lea rdx, [rbp + 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000dc20
lea rdx, [0x14002f840]
cmp qword [0x14002f858], 0xf
cmova rdx, qword [0x14002f840]
mov r8, qword [0x14002f850]
mov rcx, rax
call fcn.14000f980
mov rcx, rax
lea rdx, [0x14000ddf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x81], 0x2b002b46
mov cl, 0x2b
mov dword [rbp + 0x7d], 0x1a187030
mov dword [rbp + 0x79], 0xb461b70
mov dword [rbp + 0x75], 0x306e606a
mov dword [rbp + 0x71], 0x6d0b6c65
mov dword [rbp + 0x6d], 0x627b461b
mov dword [rbp + 0x69], 0x1270300b
mov dword [rbp + 0x65], 0x461b7030
mov dword [rbp + 0x61], 0x76007046
mov dword [rbp + 0x5d], 0x1d127030
mov dword [rbp + 0x59], 0xb0b0b0b
mov byte [rbp + 0x58], 0x22
lea rax, [rbp + 0x58]
nop dword [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp + 0x83]
cmp rax, rcx
je 0x140006dda
movzx ecx, byte [rbp + 0x84]
jmp 0x140006dc0
mov byte [rbp + 0x83], 1
lea rdx, [rbp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000dc20
lea rdx, [0x14002f7f8]
cmp qword [0x14002f810], 0xf
cmova rdx, qword [0x14002f7f8]
mov r8, qword [0x14002f808]
mov rcx, rax
call fcn.14000f980
mov rcx, rax
lea rdx, [0x14000ddf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x1f], 0x29002944
mov cl, 0x29
mov dword [rbp + 0x1b], 0x181a7232
mov dword [rbp + 0x17], 0x9441972
mov dword [rbp + 0x13], 0x326c6268
mov dword [rbp + 0xf], 0x6f096579
mov dword [rbp + 0xb], 0x44191072
mov dword [rbp + 7], 0x32094419
mov dword [rbp + 3], 0x72327402
mov dword [rbp - 1], 0x72441f10
mov dword [rbp - 5], 0x72320909
mov word [rbp - 7], 0x909
mov byte [rbp - 8], 0x20
lea rax, [rbp - 8]
nop dword [rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp + 0x21]
cmp rax, rcx
je 0x140006e94
movzx ecx, byte [rbp + 0x22]
jmp 0x140006e80
mov byte [rbp + 0x21], 1
lea rdx, [rbp - 8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000dc20
lea rdx, [0x14002f7d8]
cmp qword [0x14002f7f0], 0xf
cmova rdx, qword [0x14002f7d8]
mov r8, qword [0x14002f7e8]
mov rcx, rax
call fcn.14000f980
mov rcx, rax
lea rdx, [0x14000ddf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r12, [r15 + 0x36922]
lea rax, [r15 + 0x35e85]
mov qword [rsp + 0x58], rax
lea rax, [r15 + 0x35e8d]
mov qword [rsp + 0x60], rax
lea rax, [r13 + 0x36922]
mov qword [rbp + 0x230], rax
lea rax, [r13 + 0x35e85]
mov qword [rbp + 0x1e8], rax
lea rax, [r13 + 0x35e8d]
mov qword [rbp + 0x1f8], rax
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea r8d, [rax + 0x1a]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x30]
call fcn.14000e410
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.140006330
test al, al
je 0x14000747e
lea rcx, [0x14002f840]
cmp qword [0x14002f858], 0xf
cmova rcx, qword [0x14002f840]
mov r8, qword [0x14002f850]
cmp r8, 6
jne 0x14000711e
lea rdx, str.enable
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000711e
mov rbx, qword [rbp + 0x110]
mov r8, rbx
lea edx, [rax + 7]
lea rcx, [rdi + 0x36922]
call fcn.140010850
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [0x14002f790]
sub ecx, dword [0x14002f774]
inc ecx
cdq
idiv ecx
add edx, dword [0x14002f774]
mov dword [rbp + 0x248], edx
mov dword [rbp + 0x1d0], 0x30
mov dword [rbp + 0x1d4], 0x5c
mov ecx, 8
call fcn.14001f710
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rbp + 0x1d0]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x138]
mov rcx, rbx
call fcn.140010a80
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x248]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x200]
call fcn.140001700
mov rbx, qword [rbp + 0x200]
movabs rax, 0x7fffffffc46535ff
cmp rbx, rax
jge 0x140007087
add rbx, 0x3b9aca00
jmp 0x140007091
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x170]
call fcn.140001700
mov rax, qword [rbp + 0x170]
cmp rax, rbx
jge 0x14000711e
movabs r15, 0x4e94914f0000
movabs r13, 0x431bde82d7b634db
nop dword [rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r15
jl 0x1400070d2
mov ecx, 0x5265c00
jmp 0x1400070f7
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400070f5
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x170]
call fcn.140001700
mov rax, qword [rbp + 0x170]
cmp rax, rbx
jl 0x1400070c0
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
lea rcx, [0x14002f7f8]
cmp qword [0x14002f810], 0xf
cmova rcx, qword [0x14002f7f8]
mov r8, qword [0x14002f808]
cmp r8, 6
jne 0x1400072ce
lea rdx, str.enable
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400072ce
mov rbx, qword [rbp + 0x110]
mov r8, rbx
lea edx, [rax + 6]
lea rcx, [rdi + 0x35e85]
call fcn.140010850
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [0x14002f780]
sub ecx, dword [0x14002f778]
inc ecx
cdq
idiv ecx
add edx, dword [0x14002f778]
mov dword [rbp + 0x25c], edx
mov dword [rbp + 0x1d8], 0x30
mov dword [rbp + 0x1dc], 0x48
mov ecx, 8
call fcn.14001f710
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rbp + 0x1d8]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x138]
mov rcx, rbx
call fcn.140010a80
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x25c]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x208]
call fcn.140001700
mov rax, qword [rbp + 0x208]
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
lea rbx, [rax + 0x3b9aca00]
jl 0x14000723a
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x178]
call fcn.140001700
mov rax, qword [rbp + 0x178]
cmp rax, rbx
jge 0x1400072ce
movabs r13, 0x4e94914f0000
movabs r15, 0x431bde82d7b634db
nop word [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r13
jl 0x140007282
mov ecx, 0x5265c00
jmp 0x1400072a7
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400072a5
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x178]
call fcn.140001700
mov rax, qword [rbp + 0x178]
cmp rax, rbx
jl 0x140007270
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
lea rcx, [0x14002f7d8]
cmp qword [0x14002f7f0], 0xf
cmova rcx, qword [0x14002f7d8]
mov r8, qword [0x14002f7e8]
cmp r8, 6
jne 0x14000747e
lea rdx, str.enable
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000747e
mov rbx, qword [rbp + 0x110]
mov r8, rbx
lea edx, [rax + 6]
lea rcx, [rdi + 0x35e8d]
call fcn.140010850
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [0x14002f77c]
sub ecx, dword [0x14002f770]
inc ecx
cdq
idiv ecx
add edx, dword [0x14002f770]
mov dword [rbp + 0x258], edx
mov dword [rbp + 0x1e0], 0x30
mov dword [rbp + 0x1e4], 0x4c
mov ecx, 8
call fcn.14001f710
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rbp + 0x1e0]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x138]
mov rcx, rbx
call fcn.140010a80
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x258]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x210]
call fcn.140001700
mov rax, qword [rbp + 0x210]
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
lea rbx, [rax + 0x3b9aca00]
jl 0x1400073ea
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x118]
call fcn.140001700
mov rax, qword [rbp + 0x118]
cmp rax, rbx
jge 0x14000747e
movabs r15, 0x4e94914f0000
movabs r13, 0x431bde82d7b634db
nop word [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r15
jl 0x140007432
mov ecx, 0x5265c00
jmp 0x140007457
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140007455
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x118]
call fcn.140001700
mov rax, qword [rbp + 0x118]
cmp rax, rbx
jl 0x140007420
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea r8d, [rax + 0x1a]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rsp + 0x30]
call fcn.14000e410
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.140006330
test al, al
je 0x1400079b0
lea rcx, [0x14002f840]
cmp qword [0x14002f858], 0xf
cmova rcx, qword [0x14002f840]
mov r8, qword [0x14002f850]
cmp r8, 6
jne 0x140007662
lea rdx, str.enable
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007662
mov rbx, qword [rbp + 0x130]
mov r8, rbx
lea edx, [rax + 7]
mov rcx, r12
call fcn.140010850
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [0x14002f790]
sub ecx, dword [0x14002f774]
inc ecx
cdq
idiv ecx
add edx, dword [0x14002f774]
mov dword [rbp + 0x254], edx
mov dword [rbp + 0x1a0], 0x30
mov dword [rbp + 0x1a4], 0x5c
mov ecx, 8
call fcn.14001f710
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rbp + 0x1a0]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x180]
mov rcx, rbx
call fcn.140010a80
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x254]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x218]
call fcn.140001700
mov rax, qword [rbp + 0x218]
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
lea rbx, [rax + 0x3b9aca00]
jl 0x1400075d8
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x120]
call fcn.140001700
mov rax, qword [rbp + 0x120]
cmp rax, rbx
jge 0x140007662
movabs r13, 0x4e94914f0000
movabs r15, 0x431bde82d7b634db
mov rcx, rbx
sub rcx, rax
cmp rcx, r13
jl 0x140007616
mov ecx, 0x5265c00
jmp 0x14000763b
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140007639
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x120]
call fcn.140001700
mov rax, qword [rbp + 0x120]
cmp rax, rbx
jl 0x140007604
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
lea rcx, [0x14002f7f8]
cmp qword [0x14002f810], 0xf
cmova rcx, qword [0x14002f7f8]
mov r8, qword [0x14002f808]
cmp r8, 6
jne 0x14000780e
lea rdx, str.enable
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000780e
mov rbx, qword [rbp + 0x130]
mov r8, rbx
lea edx, [rax + 6]
mov rcx, r15
call fcn.140010850
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [0x14002f780]
sub ecx, dword [0x14002f778]
inc ecx
cdq
idiv ecx
add edx, dword [0x14002f778]
mov dword [rbp + 0x250], edx
mov dword [rbp + 0x1b8], 0x30
mov dword [rbp + 0x1bc], 0x48
mov ecx, 8
call fcn.14001f710
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rbp + 0x1b8]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x180]
mov rcx, rbx
call fcn.140010a80
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x250]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x220]
call fcn.140001700
mov rax, qword [rbp + 0x220]
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
lea rbx, [rax + 0x3b9aca00]
jl 0x14000777a
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x128]
call fcn.140001700
mov rax, qword [rbp + 0x128]
cmp rax, rbx
jge 0x14000780e
movabs r13, 0x4e94914f0000
movabs r15, 0x431bde82d7b634db
nop word [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r13
jl 0x1400077c2
mov ecx, 0x5265c00
jmp 0x1400077e7
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400077e5
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x128]
call fcn.140001700
mov rax, qword [rbp + 0x128]
cmp rax, rbx
jl 0x1400077b0
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
lea rcx, [0x14002f7d8]
cmp qword [0x14002f7f0], 0xf
cmova rcx, qword [0x14002f7d8]
mov r8, qword [0x14002f7e8]
cmp r8, 6
jne 0x1400079b0
lea rdx, str.enable
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400079b0
mov rbx, qword [rbp + 0x130]
mov r8, rbx
lea edx, [rax + 6]
mov rcx, r13
call fcn.140010850
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [0x14002f77c]
sub ecx, dword [0x14002f770]
inc ecx
cdq
idiv ecx
add edx, dword [0x14002f770]
mov dword [rbp + 0x240], edx
mov dword [rbp + 0x1a8], 0x30
mov dword [rbp + 0x1ac], 0x4c
mov ecx, 8
call fcn.14001f710
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rbp + 0x1a8]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x180]
mov rcx, rbx
call fcn.140010a80
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x240]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x228]
call fcn.140001700
mov rax, qword [rbp + 0x228]
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
lea rbx, [rax + 0x3b9aca00]
jl 0x140007926
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x140]
call fcn.140001700
mov rax, qword [rbp + 0x140]
cmp rax, rbx
jge 0x1400079b0
movabs r15, 0x4e94914f0000
movabs r13, 0x431bde82d7b634db
mov rcx, rbx
sub rcx, rax
cmp rcx, r15
jl 0x140007964
mov ecx, 0x5265c00
jmp 0x140007989
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140007987
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x140]
call fcn.140001700
mov rax, qword [rbp + 0x140]
cmp rax, rbx
jl 0x140007952
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea r8d, [rax + 0x14]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x30]
call fcn.14000e410
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x30]
call fcn.140006330
test al, al
je 0x140007efe
lea rcx, [0x14002f840]
cmp qword [0x14002f858], 0xf
cmova rcx, qword [0x14002f840]
mov r8, qword [0x14002f850]
cmp r8, 6
jne 0x140007b9e
lea rdx, str.enable
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007b9e
mov rbx, qword [rbp + 0x158]
mov r8, rbx
lea edx, [rax + 7]
mov rcx, qword [rbp + 0x230]
call fcn.140010850
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [0x14002f790]
sub ecx, dword [0x14002f774]
inc ecx
cdq
idiv ecx
add edx, dword [0x14002f774]
mov dword [rbp + 0x260], edx
mov dword [rbp + 0x1b0], 0x30
mov dword [rbp + 0x1b4], 0x5c
mov ecx, 8
call fcn.14001f710
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rbp + 0x1b0]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x160]
mov rcx, rbx
call fcn.140010a80
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x260]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x238]
call fcn.140001700
mov rbx, qword [rbp + 0x238]
movabs rax, 0x7fffffffc46535ff
cmp rbx, rax
jge 0x140007b06
add rbx, 0x3b9aca00
jmp 0x140007b10
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x148]
call fcn.140001700
mov rax, qword [rbp + 0x148]
cmp rax, rbx
jge 0x140007b9e
movabs r13, 0x4e94914f0000
movabs r15, 0x431bde82d7b634db
nop dword [rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r13
jl 0x140007b52
mov ecx, 0x5265c00
jmp 0x140007b77
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140007b75
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x148]
call fcn.140001700
mov rax, qword [rbp + 0x148]
cmp rax, rbx
jl 0x140007b40
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
lea rcx, [0x14002f7f8]
cmp qword [0x14002f810], 0xf
cmova rcx, qword [0x14002f7f8]
mov r8, qword [0x14002f808]
cmp r8, 6
jne 0x140007d4e
lea rdx, str.enable
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007d4e
mov rbx, qword [rbp + 0x158]
mov r8, rbx
lea edx, [rax + 6]
mov rcx, qword [rbp + 0x1e8]
call fcn.140010850
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [0x14002f780]
sub ecx, dword [0x14002f778]
inc ecx
cdq
idiv ecx
add edx, dword [0x14002f778]
mov dword [rbp + 0x244], edx
mov dword [rbp + 0x1c0], 0x30
mov dword [rbp + 0x1c4], 0x48
mov ecx, 8
call fcn.14001f710
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rbp + 0x1c0]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x160]
mov rcx, rbx
call fcn.140010a80
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x244]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x1f0]
call fcn.140001700
mov rbx, qword [rbp + 0x1f0]
movabs rax, 0x7fffffffc46535ff
cmp rbx, rax
jge 0x140007cb2
add rbx, 0x3b9aca00
jmp 0x140007cbc
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x150]
call fcn.140001700
mov rax, qword [rbp + 0x150]
cmp rax, rbx
jge 0x140007d4e
movabs r15, 0x4e94914f0000
movabs r13, 0x431bde82d7b634db
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r15
jl 0x140007d02
mov ecx, 0x5265c00
jmp 0x140007d27
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140007d25
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x150]
call fcn.140001700
mov rax, qword [rbp + 0x150]
cmp rax, rbx
jl 0x140007cf0
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
lea rcx, [0x14002f7d8]
cmp qword [0x14002f7f0], 0xf
cmova rcx, qword [0x14002f7d8]
mov r8, qword [0x14002f7e8]
cmp r8, 6
jne 0x140007efe
lea rdx, str.enable
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007efe
mov rbx, qword [rbp + 0x158]
mov r8, rbx
lea edx, [rax + 6]
mov rcx, qword [rbp + 0x1f8]
call fcn.140010850
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, dword [0x14002f77c]
sub ecx, dword [0x14002f770]
inc ecx
cdq
idiv ecx
add edx, dword [0x14002f770]
mov dword [rbp + 0x24c], edx
mov dword [rbp + 0x1c8], 0x30
mov dword [rbp + 0x1cc], 0x4c
mov ecx, 8
call fcn.14001f710
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rbp + 0x1c8]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x160]
mov rcx, rbx
call fcn.140010a80
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x24c]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0xc8]
call fcn.140001700
mov rax, qword [rbp + 0xc8]
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
lea rbx, [rax + 0x3b9aca00]
jl 0x140007e6a
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x168]
call fcn.140001700
mov rax, qword [rbp + 0x168]
cmp rax, rbx
jge 0x140007efe
movabs r15, 0x4e94914f0000
movabs r13, 0x431bde82d7b634db
nop word [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r15
jl 0x140007eb2
mov ecx, 0x5265c00
jmp 0x140007ed7
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140007ed5
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x168]
call fcn.140001700
mov rax, qword [rbp + 0x168]
cmp rax, rbx
jl 0x140007ea0
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140006f31
cmp byte [0x14002d1b4], 0
sete byte [0x14002d1b4]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
movzx ecx, byte [0x14002d1b4]
neg cl
sbb edx, edx
and edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140006f31