Function at 0x14000d650
Capabilities:
Contain obfuscated stackstrings
Create thread
Inject dll
Inject thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14018d0c0]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor esi, esi
mov dword [rsp + 0x40], esi
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x140177da0]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], si
mov dword [rsp + 0x4e], 0x8000869
mov cl, 8
mov dword [rsp + 0x4a], 0x7c696c78
mov word [rsp + 0x48], 0x7869
lea rax, [rsp + 0x48]
nop
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x14000d6d6
movzx ecx, byte [rsp + 0x51]
jmp 0x14000d6c0
mov byte [rsp + 0x50], 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r14, rax
mov rbx, 0xffffffffffffffff
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000d6f3
call fcn.1400e0384
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], rdi
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rbp - 0x68]
call fcn.1400093b0
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp]
call fcn.140009600
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14000d76a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d765
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d765
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
mov dword [rsp + 0x61], 0xb000b53
mov cl, 0xb
mov dword [rsp + 0x5d], 0x26796e63
mov dword [rsp + 0x59], 0x68657e6a
mov byte [rsp + 0x58], 0x47
lea rax, [rsp + 0x58]
nop
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x63]
cmp rax, rcx
je 0x14000d7a6
movzx ecx, byte [rsp + 0x64]
jmp 0x14000d790
mov byte [rsp + 0x63], 1
lea rax, [rsp + 0x58]
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000d7b3
call fcn.1400e0384
lea rcx, [rsp + 0x58]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rdi
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rbp - 0x68]
call fcn.1400093b0
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp]
call fcn.140009600
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14000d82f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d82a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d82a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
mov dword [rsp + 0x73], 0xd000d61
mov cl, reloc.WS2_32.dll_listen
mov dword [rsp + 0x6f], 0x61692368
mov dword [rsp + 0x6b], 0x69626e69
mov word [rsp + 0x69], 0x6c6f
mov byte [rsp + 0x68], 0x75
lea rax, [rsp + 0x68]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x75]
cmp rax, rcx
je 0x14000d876
movzx ecx, byte [rsp + 0x76]
jmp 0x14000d860
mov byte [rsp + 0x75], 1
lea rax, [rsp + 0x68]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000d880
call fcn.1400e0384
lea rcx, [rsp + 0x68]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rbx
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rbp - 0x68]
call fcn.1400093b0
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp]
call fcn.140009600
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x14000d8fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d8f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d8f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
lea rax, [rsp + 0x78]
mov qword [rbp - 0x40], rax
lea r14, [rbp]
cmp qword [rbp + 0x18], 7
cmova r14, qword [rbp]
mov rdi, qword [rbp + 0x10]
call fcn.1400e0384
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], 0
mov dword [rsp + 0x40], 0x23f
test rdi, rdi
je 0x14000d9b6
cmp rdi, 0x7fffffff
ja 0x14000df4a
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.1400e03f4
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000df50
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.14000fa30
lea r9, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova r9, qword [rsp + 0x78]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r15d
call fcn.1400e03f4
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14000df5c
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov r8d, Ordinal_60
lea rdx, str.https:__github.com_RozeCheats_Engine_X_raw_main_Engine.dll
lea rcx, [rbp - 0x68]
call fcn.140006fc0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.14000b360
mov dword [rbp - 8], esi
lea rdx, str.Grand_Theft_Auto_V
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rbp - 8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp - 8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x14000ded0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140110fc0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x40], rax
lea r14, [rbp]
cmp qword [rbp + 0x18], 7
cmova r14, qword [rbp]
mov rdi, qword [rbp + 0x10]
call fcn.1400e0384
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov r8, rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x28], r8b
mov dword [rsp + 0x40], 0x20001ff
test rdi, rdi
je 0x14000dafa
cmp rdi, 0x7fffffff
ja 0x14000df66
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.1400e03f4
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000df6c
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x28]
call fcn.14000fa30
lea r9, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova r9, qword [rbp - 0x28]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r12d
call fcn.1400e03f4
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14000df78
mov r8, qword [rbp - 0x18]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14000db55
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000db50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000db50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x28], 0
lea r14, [rbp]
cmp qword [rbp + 0x18], 7
cmova r14, qword [rbp]
mov rdi, qword [rbp + 0x10]
call fcn.1400e0384
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140177db0]
movdqu xmmword [rbp - 0x58], xmm1
mov byte [rbp - 0x68], 0
mov dword [rsp + 0x40], 0x1c021ff
test rdi, rdi
je 0x14000dc12
cmp rdi, 0x7fffffff
ja 0x14000df82
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.1400e03f4
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000df88
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x68]
call fcn.14000fa30
lea r9, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova r9, qword [rbp - 0x68]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r12d
call fcn.1400e03f4
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14000df94
mov r13, qword [rbp - 0x58]
lea r14, [rbp]
cmp qword [rbp + 0x18], 7
cmova r14, qword [rbp]
mov rdi, qword [rbp + 0x10]
call fcn.1400e0384
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x140177db0]
movdqu xmmword [rbp - 0x78], xmm1
mov byte [rsp + 0x78], 0
mov dword [rsp + 0x40], 0x1c21dff
test rdi, rdi
je 0x14000dcc8
cmp rdi, 0x7fffffff
ja 0x14000df9e
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.1400e03f4
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000dfa4
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.14000fa30
lea r9, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova r9, qword [rsp + 0x78]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r12d
call fcn.1400e03f4
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14000dfb0
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova r8, qword [rsp + 0x78]
mov qword [rsp + 0x20], rsi
mov r9, r13
mov rbx, qword [rbp - 0x30]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14000dd2f
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dd2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dd2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
movdqa xmm0, xmmword [0x140177db0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14000dd7f
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dd7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dd7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp - 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r13, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r14, [rbp]
cmp qword [rbp + 0x18], 7
cmova r14, qword [rbp]
mov rdi, qword [rbp + 0x10]
call fcn.1400e0384
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], 0
mov dword [rsp + 0x40], 0x1e1ddff
test rdi, rdi
je 0x14000de69
cmp rdi, 0x7fffffff
ja 0x14000dfba
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.1400e03f4
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000dfc0
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.14000fa30
lea r9, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova r9, qword [rsp + 0x78]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r12d
call fcn.1400e03f4
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14000df40
mov rsi, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x30]
mov r9d, 0x8000
mov r8, rsi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14000debd
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000deb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000deb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x14000df13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000df0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400e0ae0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rcx, 0x20
call fcn.140007930
nop
call fcn.140007660
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140007930
int3
shr rcx, 0x20
call fcn.140007930
nop
call fcn.140007660
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140007930
int3
shr rcx, 0x20
call fcn.140007930
nop
call fcn.140007660
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140007930
int3
shr rcx, 0x20
call fcn.140007930
nop
call fcn.140007660
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140007930
int3
shr rcx, 0x20
call fcn.140007930
nop
call fcn.140007660
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140007930
int3