Function at 0x14007fa90
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Execute command
Execute shellcode via indirect call
Inject thread
Resume thread
Spawn thread to rwx shellcode
Suspend thread
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
mov eax, 0x2868
call fcn.140157d40
sub rsp, rax
mov rax, qword [0x1401e7890]
xor rax, rsp
mov qword [rsp + 0x2850], rax
mov dword [rsp + 0xb0], 0
cmp dword [rsp + 0x2870], 0
jbe 0x14007fd5f
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x14007faea
jmp 0x14007fb83
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0x63
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0xbc0]
call fcn.1400a2490
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0xc8]
call fcn.14000d2c0
mov qword [rsp + 0xd0], rax
lea rdx, str.Steam_found
mov rcx, qword [rsp + 0xd0]
call fcn.140016580
nop
lea rcx, [rsp + 0xbc0]
call fcn.1400a2660
mov r8d, dword [rsp + 0x2870]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x14007fc6d
lea rcx, [0x1401ed158]
call fcn.1400a3220
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x41]
test eax, eax
jne 0x14007fbcd
jmp 0x14007fc66
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed158]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0x68
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0xd00]
call fcn.1400a2490
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xe0]
call fcn.14000d2c0
mov qword [rsp + 0xe8], rax
lea rdx, str.Error_while_opening_steam_process
mov rcx, qword [rsp + 0xe8]
call fcn.140016580
nop
lea rcx, [rsp + 0xd00]
call fcn.1400a2660
xor al, al
jmp 0x14008114e
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14007fd51
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1401ed158]
call fcn.1400a3220
mov byte [rsp + 0x42], al
movzx eax, byte [rsp + 0x42]
test eax, eax
jne 0x14007fcb1
jmp 0x14007fd4a
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed158]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, reloc.WS2_32.dll_WSASetLastError
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x440]
call fcn.1400a2490
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
call fcn.14000d2c0
mov qword [rsp + 0x100], rax
lea rdx, str.Error_while_closing_steam_process
mov rcx, qword [rsp + 0x100]
call fcn.140016580
nop
lea rcx, [rsp + 0x440]
call fcn.1400a2660
xor al, al
jmp 0x14008114e
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x388], 0
mov qword [rsp + 0x390], 0
lea rdx, str.https:__newway.b_cdn.net_dll_csgo_vac_bypass.dll
lea rcx, [rsp + 0x1ee0]
call fcn.14000d2d0
mov qword [rsp + 0x398], rax
lea rcx, [rsp + 0x3d8]
call fcn.14007f6c0
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x118], rax
lea rdx, [rsp + 0x1f00]
mov rcx, qword [rsp + 0x118]
call fcn.14000c5b0
mov qword [rsp + 0x3a0], rax
lea rcx, [rsp + 0x3d8]
call fcn.14000c750
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [rsp + 0x418]
call fcn.14007f950
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x128], rax
mov r8, qword [rsp + 0x128]
lea rdx, [rsp + 0x1f00]
lea rcx, [rsp + 0x3f8]
call fcn.140085d30
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x138], rax
lea r8, str..dll
mov rdx, qword [rsp + 0x138]
lea rcx, [rsp + 0x1eb8]
call fcn.140014920
mov qword [rsp + 0x3a8], rax
lea rcx, [rsp + 0x3f8]
call fcn.140011e70
nop
lea rcx, [rsp + 0x418]
call fcn.140011e70
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x43], al
movzx eax, byte [rsp + 0x43]
test eax, eax
jne 0x14007feae
jmp 0x14007ff89
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, Ordinal_127
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0xa80]
call fcn.1400a2490
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x148], rax
mov rcx, qword [rsp + 0x148]
call fcn.14000d2c0
mov qword [rsp + 0x150], rax
lea rdx, str.path:
mov rcx, qword [rsp + 0x150]
call fcn.140016580
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x168], rax
lea rcx, [rsp + 0x1eb8]
call fcn.14000deb0
mov qword [rsp + 0x160], rax
mov rdx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x168]
call fcn.140016580
nop
lea rcx, [rsp + 0xa80]
call fcn.1400a2660
lea rcx, [rsp + 0x1eb8]
call fcn.14000deb0
mov rdx, rax
lea rcx, [rsp + 0x3b8]
call fcn.14000d2d0
mov qword [rsp + 0x3b0], rax
lea rdx, [rsp + 0x3b8]
lea rcx, [rsp + 0x1ee0]
call fcn.14000e220
nop
lea rcx, [rsp + 0x3b8]
call fcn.140011e70
mov qword [rsp + 0x60], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x98], rax
lea rcx, str.start_steam:__open_main
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401ed248]
call fcn.1400a3220
mov byte [rsp + 0x44], al
movzx eax, byte [rsp + 0x44]
test eax, eax
jne 0x14008001a
jmp 0x1400800b3
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed248]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0x87
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x940]
call fcn.1400a2490
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x178], rax
mov rcx, qword [rsp + 0x178]
call fcn.14000d2c0
mov qword [rsp + 0x180], rax
lea rdx, str.Waiting_on_steam.exe
mov rcx, qword [rsp + 0x180]
call fcn.140016580
nop
lea rcx, [rsp + 0x940]
call fcn.1400a2660
cmp qword [rsp + 0x60], 0
jne 0x1400800de
lea rcx, str.steam.exe
call fcn.14007f7e0
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x60], rax
jmp 0x1400800b3
lea rcx, [0x1401ed248]
call fcn.1400a3220
mov byte [rsp + 0x45], al
movzx eax, byte [rsp + 0x45]
test eax, eax
jne 0x1400800fc
jmp 0x140080195
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed248]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, Ordinal_142
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x800]
call fcn.1400a2490
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x198], rax
mov rcx, qword [rsp + 0x198]
call fcn.14000d2c0
mov qword [rsp + 0x1a0], rax
lea rdx, str.Found_process
mov rcx, qword [rsp + 0x1a0]
call fcn.140016580
nop
lea rcx, [rsp + 0x800]
call fcn.1400a2660
lea r9, [rsp + 0x1eb0]
mov r8d, 0x820
lea rdx, [rsp + 0x1f20]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
mov dword [rsp + 0xb4], eax
lea rcx, [0x1401ed248]
call fcn.1400a3220
mov byte [rsp + 0x46], al
movzx eax, byte [rsp + 0x46]
test eax, eax
jne 0x1400801db
jmp 0x140080274
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed248]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, reloc.WLDAP32.dll_Ordinal_147
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x6c0]
call fcn.1400a2490
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x1b0], rax
mov rcx, qword [rsp + 0x1b0]
call fcn.14000d2c0
mov qword [rsp + 0x1b8], rax
lea rdx, str.Waiting_on_steamservice.dll
mov rcx, qword [rsp + 0x1b8]
call fcn.140016580
nop
lea rcx, [rsp + 0x6c0]
call fcn.1400a2660
mov dword [rsp + 0x6c], 0
mov eax, dword [rsp + 0x1eb0]
xor edx, edx
mov ecx, 8
div rcx
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x68], 0
jmp 0x1400802a8
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x68], eax
jge 0x140080307
movsxd rax, dword [rsp + 0x68]
mov r8d, 0x104
lea rdx, [rsp + 0x2740]
mov rcx, qword [rsp + rax*8 + 0x1f20]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str.steamservice
lea rcx, [rsp + 0x2740]
call sub.VCRUNTIME140.dll_strstr
mov qword [rsp + 0x1c0], rax
cmp qword [rsp + 0x1c0], 0
jne 0x140080305
mov dword [rsp + 0x6c], 1
jmp 0x14008029e
cmp dword [rsp + 0x6c], 0
je 0x14008027c
cmp dword [rsp + 0x6c], 0
je 0x140080324
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x47], al
movzx eax, byte [rsp + 0x47]
test eax, eax
jne 0x14008034d
jmp 0x1400803e6
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, reloc.WLDAP32.dll_Ordinal_167
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x580]
call fcn.1400a2490
mov qword [rsp + 0x1c8], rax
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x1d0], rax
mov rcx, qword [rsp + 0x1d0]
call fcn.14000d2c0
mov qword [rsp + 0x1d8], rax
lea rdx, str.___found_steamservice.dll
mov rcx, qword [rsp + 0x1d8]
call fcn.140016580
nop
lea rcx, [rsp + 0x580]
call fcn.1400a2660
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x48], al
movzx eax, byte [rsp + 0x48]
test eax, eax
jne 0x140080404
jmp 0x1400804c8
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0xa9
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0xe40]
call fcn.1400a2490
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rax
mov rcx, qword [rsp + 0x1e8]
call fcn.14000d2c0
mov qword [rsp + 0x1f0], rax
lea rdx, str.___injecting_shellcode_into
mov rcx, qword [rsp + 0x1f0]
call fcn.140016580
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x200], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0xe40]
call fcn.1400a2660
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x30
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1400805e9
lea rcx, [0x1401ed158]
call fcn.1400a3220
mov byte [rsp + 0x49], al
movzx eax, byte [rsp + 0x49]
test eax, eax
jne 0x140080518
jmp 0x1400805b1
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed158]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0xaf
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0xf80]
call fcn.1400a2490
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x210], rax
mov rcx, qword [rsp + 0x210]
call fcn.14000d2c0
mov qword [rsp + 0x218], rax
lea rdx, str.___couldnt_alloc_struct
mov rcx, qword [rsp + 0x218]
call fcn.140016580
nop
lea rcx, [rsp + 0xf80]
call fcn.1400a2660
mov byte [rsp + 0x4a], 0
lea rcx, [rsp + 0x1eb8]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1f00]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1ee0]
call fcn.140011e70
movzx eax, byte [rsp + 0x4a]
jmp 0x14008114e
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x4b], al
movzx eax, byte [rsp + 0x4b]
test eax, eax
jne 0x140080607
jmp 0x1400806cb
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0xb3
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x10c0]
call fcn.1400a2490
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x228], rax
mov rcx, qword [rsp + 0x228]
call fcn.14000d2c0
mov qword [rsp + 0x230], rax
lea rdx, str.___allocated_ldr_struct_at
mov rcx, qword [rsp + 0x230]
call fcn.140016580
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x240], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x10c0]
call fcn.1400a2660
lea rcx, [rsp + 0x1eb8]
call fcn.140011d30
lea rax, [rax + rax + 2]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x1400807fb
lea rcx, [0x1401ed158]
call fcn.1400a3220
mov byte [rsp + 0x4c], al
movzx eax, byte [rsp + 0x4c]
test eax, eax
jne 0x14008072a
jmp 0x1400807c3
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed158]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0xbc
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x1200]
call fcn.1400a2490
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x250], rax
mov rcx, qword [rsp + 0x250]
call fcn.14000d2c0
mov qword [rsp + 0x258], rax
lea rdx, str.___couldnt_alloc_string
mov rcx, qword [rsp + 0x258]
call fcn.140016580
nop
lea rcx, [rsp + 0x1200]
call fcn.1400a2660
mov byte [rsp + 0x4d], 0
lea rcx, [rsp + 0x1eb8]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1f00]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1ee0]
call fcn.140011e70
movzx eax, byte [rsp + 0x4d]
jmp 0x14008114e
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x4e], al
movzx eax, byte [rsp + 0x4e]
test eax, eax
jne 0x140080819
jmp 0x1400808dd
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0xc0
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x1340]
call fcn.1400a2490
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x268], rax
mov rcx, qword [rsp + 0x268]
call fcn.14000d2c0
mov qword [rsp + 0x270], rax
lea rdx, str.___allocated_string_at
mov rcx, qword [rsp + 0x270]
call fcn.140016580
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x280], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x1340]
call fcn.1400a2660
lea rdx, str.LdrLoadDll
mov rcx, qword [rsp + 0x98]
call qword [0x140161340]
mov qword [rsp + 0x1e88], rax
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rsp + 0x98]
call qword [0x140161340]
mov qword [rsp + 0x1e80], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x1e90], rax
cmp qword [rsp + 0x70], 0
je 0x140080984
lea rcx, [rsp + 0x1eb8]
call fcn.140011d30
lea rax, [rax + rax + 2]
mov qword [rsp + 0x288], rax
lea rcx, [rsp + 0x1eb8]
call fcn.14000deb0
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x288]
mov r8, qword [rsp + 0x290]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x4f], al
movzx eax, byte [rsp + 0x4f]
test eax, eax
jne 0x1400809a2
jmp 0x140080a66
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, Ordinal_208
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x1480]
call fcn.1400a2490
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x2a0], rax
mov rcx, qword [rsp + 0x2a0]
call fcn.14000d2c0
mov qword [rsp + 0x2a8], rax
lea rdx, str.___wrote_string_at:
mov rcx, qword [rsp + 0x2a8]
call fcn.140016580
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x2b8], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x1480]
call fcn.1400a2660
lea rax, [rsp + 0x1ed8]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x1e80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140080b88
lea rcx, [0x1401ed158]
call fcn.1400a3220
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x50]
test eax, eax
jne 0x140080ab7
jmp 0x140080b50
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed158]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, reloc.WLDAP32.dll_Ordinal_208
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x15c0]
call fcn.1400a2490
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x2c8], rax
mov rcx, qword [rsp + 0x2c8]
call fcn.14000d2c0
mov qword [rsp + 0x2d0], rax
lea rdx, str.___couldnt_write_struct
mov rcx, qword [rsp + 0x2d0]
call fcn.140016580
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400a2660
mov byte [rsp + 0x51], 0
lea rcx, [rsp + 0x1eb8]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1f00]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1ee0]
call fcn.140011e70
movzx eax, byte [rsp + 0x51]
jmp 0x14008114e
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x52], al
movzx eax, byte [rsp + 0x52]
test eax, eax
jne 0x140080ba6
jmp 0x140080c6a
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, reloc.WLDAP32.dll_Ordinal_219
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x1700]
call fcn.1400a2490
mov qword [rsp + 0x2d8], rax
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0x2e0], rax
mov rcx, qword [rsp + 0x2e0]
call fcn.14000d2c0
mov qword [rsp + 0x2e8], rax
lea rdx, str.___wrote_struct_at
mov rcx, qword [rsp + 0x2e8]
call fcn.140016580
mov qword [rsp + 0x2f0], rax
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x2f8], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x1700]
call fcn.1400a2660
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
jne 0x140080d91
lea rcx, [0x1401ed158]
call fcn.1400a3220
mov byte [rsp + 0x53], al
movzx eax, byte [rsp + 0x53]
test eax, eax
jne 0x140080cc0
jmp 0x140080d59
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed158]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0xe3
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x1840]
call fcn.1400a2490
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x308], rax
mov rcx, qword [rsp + 0x308]
call fcn.14000d2c0
mov qword [rsp + 0x310], rax
lea rdx, str.___couldnt_alloc_loader_shellcode
mov rcx, qword [rsp + 0x310]
call fcn.140016580
nop
lea rcx, [rsp + 0x1840]
call fcn.1400a2660
mov byte [rsp + 0x54], 0
lea rcx, [rsp + 0x1eb8]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1f00]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1ee0]
call fcn.140011e70
movzx eax, byte [rsp + 0x54]
jmp 0x14008114e
lea rax, [fcn.140009090]
lea rcx, [0x14007f8e0]
sub eax, ecx
mov eax, eax
mov qword [rsp + 0x20], 0
mov r9d, eax
lea r8, [0x14007f8e0]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140080ec0
lea rcx, [0x1401ed158]
call fcn.1400a3220
mov byte [rsp + 0x55], al
movzx eax, byte [rsp + 0x55]
test eax, eax
jne 0x140080def
jmp 0x140080e88
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed158]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0xeb
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x1980]
call fcn.1400a2490
mov qword [rsp + 0x318], rax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x320], rax
mov rcx, qword [rsp + 0x320]
call fcn.14000d2c0
mov qword [rsp + 0x328], rax
lea rdx, str.___couldnt_write_loader_shellcode
mov rcx, qword [rsp + 0x328]
call fcn.140016580
nop
lea rcx, [rsp + 0x1980]
call fcn.1400a2660
mov byte [rsp + 0x56], 0
lea rcx, [rsp + 0x1eb8]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1f00]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1ee0]
call fcn.140011e70
movzx eax, byte [rsp + 0x56]
jmp 0x14008114e
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x57], al
movzx eax, byte [rsp + 0x57]
test eax, eax
jne 0x140080ede
jmp 0x140080fee
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0xf0
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x1ac0]
call fcn.1400a2490
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x338], rax
mov rcx, qword [rsp + 0x338]
call fcn.14000d2c0
mov qword [rsp + 0x340], rax
lea rdx, str.___writing_shellcode
mov rcx, qword [rsp + 0x340]
call fcn.140016580
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x350], rax
lea rdx, [0x14007f8e0]
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov qword [rsp + 0x358], rax
lea rdx, [0x1401bbc98]
mov rcx, qword [rsp + 0x358]
call fcn.140016580
mov qword [rsp + 0x360], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x368], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x1ac0]
call fcn.1400a2660
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtResumeProcess]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [0x1401ed1d0]
call fcn.1400a3220
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x58]
test eax, eax
jne 0x140081079
jmp 0x140081112
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], socket
lea rax, [0x1401840bc]
mov qword [rsp + 0x28], rax
lea rax, [0x1401ed1d0]
mov qword [rsp + 0x20], rax
lea r9, str.bool___cdecl_load_bypass_cs_unsigned_long_
mov r8d, 0xf9
lea rdx, str.C:UsersgeekhOneDriveDesktop_newwaymenu.xyzNewWay_Loader_V3NewWay_Loader_V3_srcInjectionpreventVACload.hpp
lea rcx, [rsp + 0x1c00]
call fcn.1400a2490
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x378], rax
mov rcx, qword [rsp + 0x378]
call fcn.14000d2c0
mov qword [rsp + 0x380], rax
lea rdx, str.___executed_shellcode
mov rcx, qword [rsp + 0x380]
call fcn.140016580
nop
lea rcx, [rsp + 0x1c00]
call fcn.1400a2660
mov byte [rsp + 0x59], 1
lea rcx, [rsp + 0x1eb8]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1f00]
call fcn.140011e70
nop
lea rcx, [rsp + 0x1ee0]
call fcn.140011e70
movzx eax, byte [rsp + 0x59]
jmp 0x14008114e
mov rcx, qword [rsp + 0x2850]
xor rcx, rsp
call fcn.140156eb0
add rsp, 0x2868
ret