Function at 0x140001780
Capabilities:
Allocate or change rwx memory
Create thread
Get session user name
Inject thread
Set console window title
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov dword [rbp - 0x48], 0x101
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, str.Celestial__Website:_C3lestial.lol__Discord:_https:__discord.gg_5TPeEYVKJV
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, str._Celestial__If_u_bought_this_u_got_scammed__3__n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d40
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._Celestial__Waiting_for_FiveM.__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d40
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000183f
nop dword [rax + rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140001820
lea rdx, str._Celestial__Attempting_injection...__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d40
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140001891
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [rbp - 0x50]
mov dword [0x140007818], eax
mov dword [0x14000781c], 0x43a
xor r9d, r9d
lea r8, [0x140007710]
mov edx, 0x104
lea rcx, str.Celestial.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor edi, edi
lea r15d, [rdi + 0x16]
cmp dword [0x140007818], edi
jne 0x140001907
mov qword [rsp + 0x48], rdi
lea ecx, [rdi + 0x20]
call fcn.140002400
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0x1f
movups xmm0, xmmword [str.Invalid_process_index_n]
movups xmmword [rax], xmm0
mov ecx, dword [0x140004778]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14000477c]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], dil
lea rdx, [rsp + 0x40]
call fcn.140002230
mov qword [rsp + 0x48], rdi
mov ecx, 0x30
call fcn.140002400
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0x22
mov qword [rsp + 0x58], 0x2f
movups xmm0, xmmword [str.Attempting_to_open_process_handle_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140004790]
movups xmmword [rax + 0x10], xmm1
movzx edx, word [0x1400047a0]
mov word [rax + 0x20], dx
mov byte [rax + 0x22], dil
lea rdx, [rsp + 0x40]
call fcn.140002230
mov r8d, dword [0x140007818]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x1400019dc
mov qword [rsp + 0x20], rdi
mov r9d, 0x104
lea r8, [0x140007710]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
jmp 0x140001a3d
mov qword [rsp + 0x48], rdi
mov ecx, 0x20
call fcn.140002400
mov rdx, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0x1d
mov qword [rsp + 0x58], 0x1f
movups xmm0, xmmword [str.Allocated_memory_was_nullptr_n]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400047b8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400047c0]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x1400047c4]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], dil
lea rdx, [rsp + 0x40]
call fcn.140002230
lea rdx, str._Celestial__Injected__Thanks_for_using_Celestial.__n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d40
lea rax, [rsp + 0x40]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 8
mov qword [rsp + 0x58], 0xf
movabs rax, 0x3038363131373631
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], dil
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov ecx, 0x20
call fcn.140002400
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], 0x19
mov qword [rbp - 0x68], 0x1f
movups xmm0, xmmword [str.Celestial_was_Initialized]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140004810]
movsd qword [rax + 0x10], xmm0
movzx ecx, byte [0x140004818]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001b00
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x140001c45
mov qword [rsp + 0x78], 0xf
cmp rbx, 0x10
jae 0x140001b4b
mov qword [rsp + 0x70], rbx
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x60], 0
jmp 0x140001bdd
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x140001b80
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002400
test rax, rax
je 0x140001ba7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001bbb
mov rsi, rax
cmp rax, 0x16
cmovb rsi, r15
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140001bae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c4b
jmp 0x140001b65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001bbb
call fcn.140002400
mov rdi, rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400011e0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str._Celestial__FiveM_wasnt_found
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001d40
xor eax, eax
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1400023e0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400011c0
nop
call fcn.140001120
int3