Function at 0x140004ee0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x268]
sub rsp, 0x340
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1402f5028]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor r12d, r12d
mov dword [rsp + 0x44], r12d
lea rdx, str.Thank_you_for_using_DougTool_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001010
lea rdx, [0x140001fa0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Ready_to_load...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001010
lea rdx, [0x140001fa0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400050b9
movabs rsi, 0x311cdad160000
movabs r15, 0x7fffffff1194d7ff
mov r12d, 0xee6b2800
movabs r13, 0x7fffffffffffffff
movabs r14, 0x112e0be826d694b3
movsd xmm6, qword [0x1402f08b8]
call sub.MSVCP140.dll__Query_perf_frequency
mov rdi, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rdi, 0x989680
jne 0x140004fd3
imul rax, rax, 0x64
jmp 0x140004fee
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, r15
lea rbx, [rax + r12]
jl 0x140005000
mov rbx, r13
nop word [rax + rax]
call sub.MSVCP140.dll__Query_perf_frequency
mov rdi, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rdi, 0x989680
jne 0x14000501c
imul rdi, rax, 0x64
jmp 0x140005038
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
lea rdi, [rax + rcx]
cmp rbx, rdi
je 0x14000509e
jl 0x14000509e
call sub.MSVCP140.dll__Xtime_get_ticks
imul rcx, rax, 0x64
mov rax, rbx
sub rax, rdi
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x140005061
add rcx, rsi
jmp 0x140005064
add rcx, rax
mov rax, r14
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp + 0x190], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rbp + 0x198], ecx
lea rcx, [rbp + 0x190]
call sub.MSVCP140.dll__Thrd_sleep
jmp 0x140005000
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140004fb7
xor r12d, r12d
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x190], rax
call fcn.140005988
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], r12
mov qword [rbp + 0x1d8], 7
mov word [rbp + 0x1c0], r12w
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8d, [r9 + 0xc]
lea rdx, str.DougTool.dll
mov ecx, eax
call fcn.1400059b0
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x1400057f2
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rbp + 0x1c0]
call fcn.140004610
lea r9, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae r9, qword [rbp + 0x1c0]
mov dword [rsp + 0x20], edi
mov r8d, 0xc
lea rdx, str.DougTool.dll
mov ecx, ebx
call fcn.1400059b0
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400057fe
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], r12w
mov dword [rsp + 0x44], 0x13
mov word [rsp + 0x20], r12w
mov r9d, 0x105
movzx r8d, byte [rsp + 0x40]
mov edx, r9d
lea rcx, [rbp + 0x1a0]
call fcn.140001b90
lea rcx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rcx, qword [rbp + 0x1a0]
call fcn.140005be8
mov qword [rbp + 0x190], rax
mov ecx, eax
mov r8, qword [rbp + 0x1b0]
cmp rcx, r8
ja 0x140005216
lea rax, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x1b0], rcx
mov word [rax + rcx*2], r12w
jmp 0x140005281
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp + 0x1b8]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140005266
mov qword [rbp + 0x1b0], rcx
lea r9, [rbp + 0x1a0]
cmp rdi, 8
cmovae r9, qword [rbp + 0x1a0]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14000525b
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [rdx + r8]
mov word [r9 + rax*2], r12w
jmp 0x140005281
mov word [rsp + 0x20], r12w
mov r9, rdx
movzx r8d, byte [rsp + 0x40]
lea rcx, [rbp + 0x1a0]
call fcn.140001b90
mov eax, dword [rbp + 0x194]
cmp eax, 0xffffffff
jne 0x14000529a
mov eax, 0x14
lea rcx, section..data
jmp 0x1400052a1
lea rcx, [0x1402f5010]
mov dword [rbp + 0x190], eax
mov qword [rbp + 0x198], rcx
movaps xmm0, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x190], xmm0
mov dword [rsp + 0x44], 0xb
test eax, eax
jne 0x1400057d7
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x200]
call fcn.140002d10
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 8
jb 0x140005331
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000532c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000532c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d28
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], r12w
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 8
jb 0x140005394
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000538f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000538f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d28
movdqa xmm0, xmmword [0x1402f08c0]
movdqu xmmword [rbp + 0x1d0], xmm0
mov word [rbp + 0x1c0], r12w
lea rdx, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae rdx, qword [rbp + 0x200]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400020c0
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea r13, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], r13
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x4c], edx
mov r8d, 0x2e9000
lea rdx, [0x1400075d0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x58]
call fcn.140003d90
test rax, rax
jne 0x14000544c
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rax, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae rax, qword [rbp + 0x200]
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x198], rax
movaps xmm0, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x190], xmm0
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x190]
mov edx, 0xfde9
lea rcx, [rbp + 0x1e0]
call fcn.140001330
lea rdx, [rbp + 0x1e0]
mov r8, qword [rbp + 0x1e0]
mov r9, qword [rbp + 0x1f8]
cmp r9, 0x10
cmovae rdx, r8
add rdx, qword [rbp + 0x1f0]
lea rax, [rbp + 0x1e0]
cmp r9, 0x10
cmovae rax, r8
cmp rax, rdx
je 0x1400054fe
nop dword [rax]
cmp byte [rax], 0x5c
jne 0x1400054e8
mov byte [rax], 0x2f
inc rax
cmp rax, rdx
jne 0x1400054e0
mov r9, qword [rbp + 0x1f8]
mov r8, qword [rbp + 0x1e0]
lea rdi, [rbp + 0x1e0]
cmp r9, 0x10
cmovae rdi, r8
mov dword [rbp + 0x60], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
lea rdx, [rbp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x1400055a3
lea rdx, [rbp + 0x60]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x1400055a3
lea rcx, [rbp + 0x8c]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140005551
cmp rax, 8
jne 0x140005532
mov r8, rax
lea rdx, [rbp + 0x8c]
lea rcx, str.GTA5.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140005532
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x68]
jmp 0x1400055af
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000570e
mov edx, r12d
mov r8d, r12d
lea r15, [0x140003160]
mov ecx, edx
cmp byte [rcx + r15], 0xc3
jne 0x1400055e6
test r8d, r8d
je 0x1400055f3
inc r8d
inc edx
cmp edx, 0x1869f
jb 0x1400055d5
mov edx, r12d
lea r14d, [rdx + 1]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x60], rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x70]
sub rcx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdi]
mov byte [rdi + rcx], al
lea rdi, [rdi + 1]
test al, al
jne 0x140005620
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x118
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
mov edi, r14d
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, r14d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov qword [rsp + 0x20], r12
mov r9d, edi
mov r8, r15
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 0x118
lea r8, [rbp + 0x60]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
mov r9, r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
je 0x14000570e
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x140005753
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000574d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000574d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d28
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x50], r13
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x4c], edx
lea rcx, [rsp + 0x58]
call fcn.140002aa0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x200]
call fcn.1400039a0
xor eax, eax
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140005e40
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x190]
lea rcx, str.temp_directory_path
call fcn.1400038c0
nop
shr rdi, 0x20
mov ecx, edi
call fcn.140003960
int3
shr rcx, 0x20
call fcn.140003960
int3