Function at 0x140001b30
Capabilities:
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x140072180]
xor rax, rsp
mov qword [rbp + 0x2f], rax
lea rdi, [0x140079550]
xor eax, eax
mov ecx, 0x114
rep stosb byte [rdi], al
mov dword [0x140079550], 0x114
lea rcx, [0x140079550]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
movups xmm0, xmmword [str._KYlUSZP7A]
movups xmmword [rbp - 0x41], xmm0
mov eax, dword [0x14005f550]
mov dword [rbp - 0x31], eax
cmp word [0x14005f552], 0
je 0x140001bdd
mov eax, 0x67
mov word [rbp - 0x41], ax
xor word [rbp - 0x3f], 0x39
xor word [rbp - 0x3d], 0x3a
xor word [rbp - 0x3b], 0x3b
xor word [rbp - 0x39], 0x3c
xor word [rbp - 0x37], 0x3d
xor word [rbp - 0x35], 0x3e
xor word [rbp - 0x33], 0x3f
xor word [rbp - 0x31], 0x40
xor word [rbp - 0x2f], 0x41
xor edx, edx
lea rcx, [rbp - 0x41]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140001c14
lea r9d, [rax + 0x10]
lea r8, str.An_error_occurred
lea rdx, str._Please_open_FiveM
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x28], 0xdbb0d97
mov dword [rbp - 0x7d], 0xdb10da5
mov dword [rbp - 0x79], 0xd890d98
mov dword [rbp - 0x75], 0xdea0db5
mov dword [rbp - 0x71], 0xdea0de1
mov dword [rbp - 0x6d], 0xd830de9
mov dword [rbp - 0x69], 0xd8a0d9a
mov dword [rbp - 0x65], 0xdb00d9e
mov dword [rbp - 0x61], 0xd8d0d93
mov dword [rbp - 0x5d], 0xd810d80
mov dword [rbp - 0x59], 0xd950d96
mov dword [rbp - 0x55], 0xd8d0dc9
mov dword [rbp - 0x51], 0xd8f0d91
xor ebx, ebx
mov word [rbp - 0x4d], bx
mov byte [rbp - 0x4b], 1
mov ecx, ebx
mov r14d, 0xdd1
nop dword [rax]
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x28], ax
inc rcx
cmp rcx, 0x1a
jb 0x140001c90
mov byte [rbp - 0x4b], bl
lea rcx, [rsp + 0x28]
call fcn.140001800
mov esi, eax
test eax, eax
jne 0x140001ed5
mov dword [rsp + 0x28], 0xdbb0d97
mov dword [rbp - 0x7d], 0xdb10da5
mov dword [rbp - 0x79], 0xd890d98
mov dword [rbp - 0x75], 0xdea0db5
mov dword [rbp - 0x71], 0xdea0de1
mov dword [rbp - 0x6d], 0xd830de9
mov dword [rbp - 0x69], 0xd8a0d9a
mov dword [rbp - 0x65], 0xdb00d9e
mov dword [rbp - 0x61], 0xd8d0d93
mov dword [rbp - 0x5d], 0xd810d80
mov dword [rbp - 0x59], 0xd950d96
mov dword [rbp - 0x55], 0xd8d0dc9
mov dword [rbp - 0x51], 0xd8f0d91
mov word [rbp - 0x4d], bx
mov byte [rbp - 0x4b], 1
mov rcx, rbx
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x28], ax
inc rcx
cmp rcx, 0x1a
jb 0x140001d20
mov byte [rbp - 0x4b], bl
lea rcx, [rsp + 0x28]
call fcn.140001800
mov esi, eax
test eax, eax
jne 0x140001ed5
mov dword [rsp + 0x28], 0xdbb0d97
mov dword [rbp - 0x7d], 0xdb10da5
mov dword [rbp - 0x79], 0xd890d98
mov dword [rbp - 0x75], 0xdea0db5
mov dword [rbp - 0x71], 0xde30def
mov dword [rbp - 0x6d], 0xd830de2
mov dword [rbp - 0x69], 0xd8a0d9a
mov dword [rbp - 0x65], 0xdb00d9e
mov dword [rbp - 0x61], 0xd8d0d93
mov dword [rbp - 0x5d], 0xd810d80
mov dword [rbp - 0x59], 0xd950d96
mov dword [rbp - 0x55], 0xd8d0dc9
mov dword [rbp - 0x51], 0xd8f0d91
mov word [rbp - 0x4d], bx
mov byte [rbp - 0x4b], 1
mov rcx, rbx
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x28], ax
inc rcx
cmp rcx, 0x1a
jb 0x140001db0
mov byte [rbp - 0x4b], bl
lea rcx, [rsp + 0x28]
call fcn.140001800
mov esi, eax
test eax, eax
jne 0x140001ed5
mov dword [rbp - 1], 0xdbb0d97
mov dword [rbp + 3], 0xdb10da5
mov dword [rbp + 7], 0xd890d98
mov dword [rbp + 0xb], 0xd8c0d90
mov dword [rbp + 0xf], 0xd8a0d98
mov dword [rbp + 0x13], 0xdb30da9
mov dword [rbp + 0x17], 0xdbb0dbe
mov dword [rbp + 0x1b], 0xd930dac
mov dword [rbp + 0x1f], 0xd870dcf
mov dword [rbp + 0x23], 0xd810d9b
mov word [rbp + 0x27], bx
mov byte [rbp + 0x29], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rbp + rcx*2 - 1], ax
inc rcx
cmp rcx, 0x14
jb 0x140001e30
mov byte [rbp + 0x29], bl
lea rcx, [rbp - 1]
call fcn.140001800
mov esi, eax
test eax, eax
jne 0x140001ed5
lea rdx, str._e_31m____Process_Not_found__0x_lX__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a70
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a70
lea rdx, str._e_31m____Pls_Open_FiveM_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a70
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp - 0x49], 0xa0beb2
mov byte [rbp - 0x45], 1
nop dword [rax]
lea eax, [rbx - 0x2f]
xor byte [rbp + rbx - 0x49], al
inc rbx
cmp rbx, 3
jb 0x140001eb0
mov byte [rbp - 0x45], 0
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x1400027ec
mov dword [rsp + 0x28], 0xdbb0d97
mov dword [rbp - 0x7d], 0xdb10da5
mov dword [rbp - 0x79], 0xd890d98
mov dword [rbp - 0x75], 0xd8c0d90
mov dword [rbp - 0x71], 0xd8a0d98
mov dword [rbp - 0x6d], 0xdb30da9
mov dword [rbp - 0x69], 0xdbb0dbe
mov r15d, 0xdac
mov dword [rbp - 0x65], 0xd930dac
mov dword [rbp - 0x61], 0xd870dcf
mov dword [rbp - 0x5d], 0xd810d9b
mov word [rbp - 0x59], bx
mov byte [rbp - 0x57], 1
mov rcx, rbx
nop dword [rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x28], ax
inc rcx
cmp rcx, 0x14
jb 0x140001f30
mov byte [rbp - 0x57], bl
lea rcx, [rsp + 0x28]
call fcn.140001800
cmp esi, eax
jne 0x1400021ca
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x21], bl
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x41], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003c40
mov rax, qword [rbp - 9]
cmp rax, 0x14
jb 0x140001fc7
lea rdi, [rbp - 0x21]
cmp rax, 0xf
cmova rdi, qword [rbp - 0x21]
mov qword [rbp - 0x11], shutdown
mov r8d, shutdown
lea rdx, str.FiveM_GTAProcess.exe
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x14], 0
jmp 0x140001fe2
lea r9, str.FiveM_GTAProcess.exe
movzx r8d, byte [rsp + 0x20]
mov edx, shutdown
lea rcx, [rbp - 0x21]
call fcn.140004920
mov rax, qword [rbp - 0x29]
cmp rax, 0x1c
jb 0x14000201c
lea rdi, [rbp - 0x41]
cmp rax, 0xf
cmova rdi, qword [rbp - 0x41]
mov qword [rbp - 0x31], 0x1c
mov r8d, 0x1c
lea rdx, str.C:Windowsgta_core_00x1.dll
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x1c], 0
jmp 0x140002037
lea r9, str.C:Windowsgta_core_00x1.dll
movzx r8d, byte [rsp + 0x20]
mov edx, 0x1c
lea rcx, [rbp - 0x41]
call fcn.140004920
lea r8, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova r8, qword [rbp - 0x41]
add r8, qword [rbp - 0x31]
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova rdx, qword [rbp - 0x41]
lea rcx, [rbp - 1]
call fcn.140003ea0
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova rcx, qword [rbp - 0x21]
call fcn.140001a00
mov edi, eax
test eax, eax
jne 0x14000210e
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a70
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a70
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14005f280]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova rdx, qword [rbp - 0x41]
mov ecx, edi
call fcn.1400018c0
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x14000213e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002138
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002138
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, 0x31
lea r8, [0x14005f170]
lea rdx, str.English_n_n_Please_press_OK_when_the_characters_feet_touch_the_ground.__n_nThai_n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x1400020ba
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140052644
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14000217c
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002177
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002177
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052644
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x41], 0
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x1400021ca
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052644
mov dword [rsp + 0x28], 0xdbb0d97
mov dword [rbp - 0x7d], 0xdb10da5
mov dword [rbp - 0x79], 0xd890d98
mov dword [rbp - 0x75], 0xdea0db5
mov dword [rbp - 0x71], 0xde30def
mov dword [rbp - 0x6d], 0xd830de2
mov dword [rbp - 0x69], 0xd8a0d9a
mov dword [rbp - 0x65], 0xdb00d9e
mov dword [rbp - 0x61], 0xd8d0d93
mov dword [rbp - 0x5d], 0xd810d80
mov dword [rbp - 0x59], 0xd950d96
mov dword [rbp - 0x55], 0xd8d0dc9
mov dword [rbp - 0x51], 0xd8f0d91
mov word [rbp - 0x4d], bx
mov byte [rbp - 0x4b], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x28], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002240
mov byte [rbp - 0x4b], 0
lea rcx, [rsp + 0x28]
call fcn.140001800
cmp esi, eax
jne 0x1400024df
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x21], 0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x41], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003c40
mov rax, qword [rbp - 9]
cmp rax, 0x1a
jb 0x1400022d9
lea rdi, [rbp - 0x21]
cmp rax, 0xf
cmova rdi, qword [rbp - 0x21]
mov qword [rbp - 0x11], 0x1a
mov r8d, 0x1a
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x1a], 0
jmp 0x1400022f4
lea r9, str.FiveM_b2699_GTAProcess.exe
movzx r8d, byte [rsp + 0x20]
mov edx, 0x1a
lea rcx, [rbp - 0x21]
call fcn.140004920
mov rax, qword [rbp - 0x29]
cmp rax, 0x1c
jb 0x14000232e
lea rdi, [rbp - 0x41]
cmp rax, 0xf
cmova rdi, qword [rbp - 0x41]
mov qword [rbp - 0x31], 0x1c
mov r8d, 0x1c
lea rdx, str.C:Windowsgta_core_00x1.dll
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x1c], 0
jmp 0x140002349
lea r9, str.C:Windowsgta_core_00x1.dll
movzx r8d, byte [rsp + 0x20]
mov edx, 0x1c
lea rcx, [rbp - 0x41]
call fcn.140004920
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova rdx, qword [rbp - 0x41]
mov r8, qword [rbp - 0x31]
add r8, rdx
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova rdx, qword [rbp - 0x41]
lea rcx, [rbp - 1]
call fcn.140003ea0
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova rcx, qword [rbp - 0x21]
call fcn.140001a00
mov edi, eax
test eax, eax
jne 0x140002423
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a70
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a70
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14005f280]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova rdx, qword [rbp - 0x41]
mov ecx, edi
call fcn.1400018c0
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x140002453
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000244d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000244d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, 0x31
lea r8, [0x14005f170]
lea rdx, str.English_n_n_Please_press_OK_when_the_characters_feet_touch_the_ground.__n_nThai_n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x1400023cf
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140052644
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x140002491
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000248c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000248c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052644
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x41], 0
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x1400024df
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400024da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052644
mov dword [rsp + 0x28], 0xdbb0d97
mov dword [rbp - 0x7d], 0xdb10da5
mov dword [rbp - 0x79], 0xd890d98
mov dword [rbp - 0x75], 0xdea0db5
mov dword [rbp - 0x71], 0xdea0de1
mov dword [rbp - 0x6d], 0xd830de9
mov dword [rbp - 0x69], 0xd8a0d9a
mov dword [rbp - 0x65], 0xdb00d9e
mov dword [rbp - 0x61], 0xd8d0d93
mov dword [rbp - 0x5d], 0xd810d80
mov dword [rbp - 0x59], 0xd950d96
mov dword [rbp - 0x55], 0xd8d0dc9
mov dword [rbp - 0x51], 0xd8f0d91
mov word [rbp - 0x4d], bx
mov byte [rbp - 0x4b], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x28], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002550
mov byte [rbp - 0x4b], 0
lea rcx, [rsp + 0x28]
call fcn.140001800
cmp esi, eax
jne 0x1400027ec
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x21], 0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x41], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003c40
mov rax, qword [rbp - 9]
cmp rax, 0x1a
jb 0x1400025e9
lea rdi, [rbp - 0x21]
cmp rax, 0xf
cmova rdi, qword [rbp - 0x21]
mov qword [rbp - 0x11], 0x1a
mov r8d, 0x1a
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x1a], 0
jmp 0x140002604
lea r9, str.FiveM_b2802_GTAProcess.exe
movzx r8d, byte [rsp + 0x20]
mov edx, 0x1a
lea rcx, [rbp - 0x21]
call fcn.140004920
mov rax, qword [rbp - 0x29]
cmp rax, 0x1c
jb 0x14000263e
lea rdi, [rbp - 0x41]
cmp rax, 0xf
cmova rdi, qword [rbp - 0x41]
mov qword [rbp - 0x31], 0x1c
mov r8d, 0x1c
lea rdx, str.C:Windowsgta_core_00x1.dll
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x1c], 0
jmp 0x140002659
lea r9, str.C:Windowsgta_core_00x1.dll
movzx r8d, byte [rsp + 0x20]
mov edx, 0x1c
lea rcx, [rbp - 0x41]
call fcn.140004920
lea r8, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova r8, qword [rbp - 0x41]
add r8, qword [rbp - 0x31]
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova rdx, qword [rbp - 0x41]
lea rcx, [rbp - 1]
call fcn.140003ea0
nop
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova rcx, qword [rbp - 0x21]
call fcn.140001a00
mov edi, eax
test eax, eax
jne 0x140002730
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a70
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a70
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14005f280]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova rdx, qword [rbp - 0x41]
mov ecx, edi
call fcn.1400018c0
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x140002760
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000275a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000275a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, 0x31
lea r8, [0x14005f170]
lea rdx, str.English_n_n_Please_press_OK_when_the_characters_feet_touch_the_ground.__n_nThai_n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x1400026dc
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140052644
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14000279e
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002799
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002799
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052644
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x41], 0
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x1400027ec
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052644
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400523a0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret