Function at 0x18006e880
Capabilities:
Contain obfuscated stackstrings
Create thread
Enumerate threads
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x180119070]
xor rax, rsp
mov qword [rbp + 0xf0], rax
cmp edx, 1
jne 0x180070636
lea rcx, [rbp + 0xb0]
call fcn.180055d20
lea rdi, [0x180123728]
cmp rdi, rax
je 0x18006e8e7
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.180075dc0
lea rcx, [rbp + 0xb0]
call fcn.1800503e0
lea rcx, [rbp + 0xb0]
call fcn.180055fe0
lea r14, [0x1801237a8]
cmp r14, rax
je 0x18006e919
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.180075dc0
lea rcx, [rbp + 0xb0]
call fcn.1800503e0
lea rcx, [rbp + 0xb0]
call fcn.180056ae0
lea r15, [0x180123748]
cmp r15, rax
je 0x18006e94b
xor r8d, r8d
mov rdx, rax
mov rcx, r15
call fcn.180075dc0
lea rcx, [rbp + 0xb0]
call fcn.1800503e0
mov dword [rsp + 0x60], 0xe7a6678
mov dword [rsp + 0x64], 0x641b030c
mov dword [rsp + 0x68], 0xd110f03
mov word [rsp + 0x6c], 4
mov byte [rsp + 0x6e], 1
lea rcx, [rsp + 0x60]
call fcn.1800709c0
lea rax, [rsp + 0x60]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x18006e994
lea rdx, [rsp + 0x60]
lea rcx, [0x1801237e8]
call fcn.180075c60
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.180072f60
nop
lea rax, [rsp + 0x60]
mov qword [rbp - 0x68], rax
mov dword [rsp + 0x50], 0x2751574e
mov dword [rsp + 0x54], 0x1002c28
lea rcx, [rsp + 0x50]
call fcn.180070960
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x60]
call fcn.180078960
mov rbx, rax
mov dword [rsp + 0x40], 0x284b5b50
mov dword [rsp + 0x44], 0x100262e
lea rcx, [rsp + 0x40]
call fcn.180070960
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.180078450
mov rcx, rax
mov rdx, rbx
call fcn.180072c10
lea rax, [rsp + 0x60]
mov qword [rbp - 0x68], rax
lea rdx, [0x1801237e8]
lea rcx, [rsp + 0x60]
call fcn.1800782a0
mov rbx, rax
mov dword [rsp + 0x40], 0x25525f53
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180070f60
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.180078450
mov rcx, rax
mov rdx, rbx
call fcn.180072c10
lea rax, [rsp + 0x60]
mov qword [rbp - 0x68], rax
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1800782a0
mov rdi, rax
mov dword [rsp + 0x40], 0x2f595054
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180070f60
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.180078450
mov rbx, rax
mov dword [rsp + 0x50], 0x24564b48
mov word [rsp + 0x54], 0x100
lea rcx, [rsp + 0x50]
call fcn.180070f60
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180078450
mov rcx, rax
mov rdx, rdi
call fcn.180072c10
lea rax, [rsp + 0x60]
mov qword [rbp - 0x68], rax
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.1800782a0
mov rdi, rax
mov dword [rsp + 0x50], 0x2f595054
mov word [rsp + 0x54], 0x100
lea rcx, [rsp + 0x50]
call fcn.180070f60
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.180078450
mov rbx, rax
mov dword [rsp + 0x40], 0xa5a50
mov byte [rsp + 0x44], 1
lea rcx, [rsp + 0x40]
call fcn.180070990
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180078450
mov rcx, rax
mov rdx, rdi
call fcn.180072c10
lea rax, [rsp + 0x60]
mov qword [rbp - 0x68], rax
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.1800782a0
mov rdi, rax
mov dword [rsp + 0x50], 0x2f595054
mov word [rsp + 0x54], 0x100
lea rcx, [rsp + 0x50]
call fcn.180070f60
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.180078450
mov rbx, rax
mov dword [rsp + 0x40], 0x255b5f4b
mov word [rsp + 0x44], 0x100
lea rcx, [rsp + 0x40]
call fcn.180070f60
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180078450
mov rcx, rax
mov rdx, rdi
call fcn.180072c10
lea rax, [rsp + 0x60]
mov qword [rbp - 0x68], rax
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.180072c80
mov rbx, rax
movdqa xmm0, xmmword [0x1801047a0]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x7e2a2a2c
mov dword [rbp + 0x84], 0x7b3e3d32
mov word [rbp + 0x88], 0x100
lea rcx, [rbp + 0x70]
call fcn.180070830
nop
mov r8, rbx
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xd0]
call fcn.180054190
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
call fcn.180073a50
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.1800509b0
lea rcx, [rbp + 0xd0]
cmp rcx, rax
je 0x18006ec88
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.180075dc0
lea rcx, [rbp + 0x50]
call fcn.1800503e0
xor r15d, r15d
mov qword [rbp + 0x48], r15
lea rcx, [rbp + 0xd0]
call fcn.180073930
mov qword [rbp + 8], rax
mov byte [rsp + 0x20], r15b
mov r9b, 1
lea r8, [rbp + 0x10]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0xa0]
call fcn.180078170
nop
mov dword [rsp + 0x60], 0x147e6a6e
mov dword [rsp + 0x64], 0x171c1114
mov dword [rsp + 0x68], 0xd040510
mov dword [rsp + 0x6c], 0x100191a
lea rcx, [rsp + 0x60]
call fcn.180070e70
mov dword [rsp + 0x50], 0x255b515e
mov word [rsp + 0x54], 0x100
lea rcx, [rsp + 0x50]
call fcn.180070f60
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.180078450
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.180078a30
test al, al
je 0x1800705e5
mov dword [rsp + 0x50], 0x2f595054
mov word [rsp + 0x54], 0x100
lea rcx, [rsp + 0x50]
call fcn.180070f60
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.180078450
mov rbx, rax
mov dword [rsp + 0x40], 0x2549575b
mov word [rsp + 0x44], Ordinal_45
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.180070f00
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180078450
mov rdx, rax
lea rcx, [0x180123788]
call fcn.180080890
mov dword [rsp + 0x50], 0x2f595054
mov word [rsp + 0x54], 0x100
lea rcx, [rsp + 0x50]
call fcn.180070f60
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.180078450
mov rbx, rax
mov dword [rsp + 0x60], 0x2549575b
mov dword [rsp + 0x64], 0x2d371d2c
mov dword [rsp + 0x68], 0x1002328
lea rcx, [rsp + 0x60]
call fcn.180070860
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.180078450
mov rdx, rax
lea rcx, [0x1801236e8]
call fcn.180080890
mov dword [rsp + 0x50], 0x2f595054
mov word [rsp + 0x54], 0x100
lea rcx, [rsp + 0x50]
call fcn.180070f60
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.180078450
mov rbx, rax
mov dword [rsp + 0x60], 0x2549575b
mov dword [rsp + 0x64], 0x30301d2c
mov dword [rsp + 0x68], 0x3b323224
mov word [rsp + 0x6c], 0x100
lea rcx, [rsp + 0x60]
call fcn.180070fa0
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.180078450
mov rdx, rax
lea rcx, [0x1801236c8]
call fcn.180080890
mov dword [rsp + 0x40], 0x1004346
lea rcx, [rsp + 0x40]
call fcn.180070ed0
lea rdx, [rsp + 0x40]
lea rcx, [0x180123788]
call fcn.18007cf40
test al, al
jne 0x1800705e5
movzx eax, byte [0x1800f4880]
xor al, 0x3d
mov byte [rsp + 0x40], al
mov word [rsp + 0x41], 0x100
lea rcx, [rsp + 0x40]
call fcn.180070f90
lea rdx, [rsp + 0x40]
lea rcx, [0x1801236c8]
call fcn.18007cf40
test al, al
jne 0x18006ef07
movzx eax, byte [0x1800f4888]
xor al, 0x3d
mov byte [rsp + 0x40], al
mov word [rsp + 0x41], 0x100
lea rcx, [rsp + 0x40]
call fcn.180070f90
lea rdx, [rsp + 0x40]
lea rcx, [0x1801236c8]
call fcn.18007cf40
test al, al
je 0x1800705e5
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x18006ef73
xor edx, edx
lea rcx, [rbp + 0xa0]
call fcn.180075a00
movzx edx, byte [rbp + 0xa0]
lea rcx, [rbp + 0xa8]
call fcn.180075030
nop
lea rcx, [rbp + 0xd0]
call fcn.1800503e0
nop
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.180075a00
movzx edx, byte [rbp + 0x90]
lea rcx, [rbp + 0x98]
call fcn.180075030
nop
xor eax, eax
jmp 0x18007063b
mov dword [rbp + 0x50], Ordinal_30
lea rdx, [rbp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18006f063
mov dword [rbp - 0x68], 0x6e544d52
mov dword [rbp - 0x64], 0x263a24
mov byte [rbp - 0x60], 1
lea rcx, [rbp - 0x68]
call fcn.180070f30
lea rcx, [rbp - 0x68]
call fcn.180050c50
mov rdi, rax
nop word [rax + rax]
mov eax, dword [rbp + 0x5c]
cmp rax, rdi
jne 0x18006f04e
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov rcx, rax
call fcn.18006dde0
mov r8d, eax
mov edx, edi
lea rcx, [rbp + 0x70]
call fcn.18006dcf0
nop
mov dword [rsp + 0x60], 0x335d5f49
mov dword [rsp + 0x64], 0x206d202a
mov dword [rsp + 0x68], 0x1002a29
lea rcx, [rsp + 0x60]
call fcn.180070860
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x70]
call fcn.1800737a0
cmp rax, 0xffffffffffffffff
je 0x18006f03b
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x70]
call fcn.1800503e0
lea rdx, [rbp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18006efc0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180124ab4], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x180124ab0], eax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x18006dc50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x180104600]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x616063
mov byte [rsp + 0x74], 1
lea rcx, [rsp + 0x60]
call fcn.180070ea0
lea rax, [rsp + 0x60]
inc rsi
cmp byte [rax + rsi], 0
jne 0x18006f0d3
mov r8, rsi
lea rdx, [rsp + 0x60]
lea rcx, [0x180123708]
call fcn.180075c60
lea rdi, str.FiveM_b3095_GTAProcess.exe
lea rsi, str.FiveM_b2944_GTAProcess.exe
lea r14, str.FiveM_b2802_GTAProcess.exe
lea r12, str.FiveM_b2699_GTAProcess.exe
lea r13, str.FiveM_b2612_GTAProcess.exe
lea rbx, str.FiveM_b2545_GTAProcess.exe
lea r15, str.FiveM_b2372_GTAProcess.exe
movdqa xmm0, xmmword [0x180104a50]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x35372b63
mov word [rbp + 0x84], 0x100
lea rcx, [rbp + 0x70]
call fcn.1800708f0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
jne 0x180070300
movdqa xmm0, xmmword [0x180104d10]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x2a3628
mov byte [rbp - 0x74], 1
lea rcx, [rsp + 0x78]
call fcn.180070ea0
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x180070300
movdqa xmm0, xmmword [0x1801043f0]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x352c213f
mov dword [rbp - 0x74], 0x317d2122
mov dword [rbp - 0x70], 0x100332d
lea rcx, [rsp + 0x78]
call fcn.180070890
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x18007019b
movdqa xmm0, xmmword [0x180104840]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
jne 0x18007019b
movdqa xmm0, xmmword [0x180104400]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x352c213f
mov dword [rbp - 0x74], 0x317d2122
mov dword [rbp - 0x70], 0x100332d
lea rcx, [rsp + 0x78]
call fcn.180070890
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x180070036
movdqa xmm0, xmmword [0x180104880]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
jne 0x180070036
movdqa xmm0, xmmword [0x1801043c0]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x352c213f
mov dword [rbp - 0x74], 0x317d2122
mov dword [rbp - 0x70], 0x100332d
lea rcx, [rsp + 0x78]
call fcn.180070890
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x18006fed8
movdqa xmm0, xmmword [0x180104850]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
jne 0x18006fed8
movdqa xmm0, xmmword [0x180104390]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x352c213f
mov dword [rbp - 0x74], 0x317d2122
mov dword [rbp - 0x70], 0x100332d
lea rcx, [rsp + 0x78]
call fcn.180070890
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x18006fd7a
movdqa xmm0, xmmword [0x180104810]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
jne 0x18006fd7a
movdqa xmm0, xmmword [0x1801043e0]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x352c213f
mov dword [rbp - 0x74], 0x317d2122
mov dword [rbp - 0x70], 0x100332d
lea rcx, [rsp + 0x78]
call fcn.180070890
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x18006fc1c
movdqa xmm0, xmmword [0x180104870]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
jne 0x18006fc1c
movdqa xmm0, xmmword [str.WI__f]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x352c213f
mov dword [rbp - 0x74], 0x317d2122
mov dword [rbp - 0x70], 0x100332d
lea rcx, [rsp + 0x78]
call fcn.180070890
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x18006fabe
movdqa xmm0, xmmword [0x180104890]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
jne 0x18006fabe
movdqa xmm0, xmmword [0x1801043d0]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x352c213f
mov dword [rbp - 0x74], 0x317d2122
mov dword [rbp - 0x70], 0x100332d
lea rcx, [rsp + 0x78]
call fcn.180070890
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x18006f950
movdqa xmm0, xmmword [0x180104860]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
jne 0x18006f950
movdqa xmm0, xmmword [0x1801043b0]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x352c213f
mov dword [rbp - 0x74], 0x317d2122
mov dword [rbp - 0x70], 0x100332d
lea rcx, [rsp + 0x78]
call fcn.180070890
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x18006f7e2
movdqa xmm0, xmmword [0x180104830]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
jne 0x18006f7e2
movdqa xmm0, xmmword [0x1801043a0]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x352c213f
mov dword [rbp - 0x74], 0x317d2122
mov dword [rbp - 0x70], 0x100332d
lea rcx, [rsp + 0x78]
call fcn.180070890
lea rcx, [rsp + 0x78]
call fcn.180050c50
test rax, rax
jne 0x18006f67a
movdqa xmm0, xmmword [0x180104820]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
test rax, rax
je 0x18007045d
movdqa xmm0, xmmword [0x180104820]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
lea rcx, str.VMP_b3095_GameProcess.exe
test rax, rax
cmove rcx, rdi
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x2593320
mov dword [0x180124b18], 0x1f58b58
mov dword [0x180124b34], 0x20019e0
mov dword [0x180124b3c], 0x105dfa9
mov dword [0x180124b04], 0x105df64
mov dword [0x180124b00], 0x134
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2f4
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x11c
mov dword [0x180124b08], 0x110
mov dword [0x180124b38], 0xd10
mov dword [0x180124b48], 0x960
mov dword [0x180124b30], 0x10a8
mov dword [0x180124b44], 0xe8
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x150c
mov dword [0x180124b54], 0x1098
mov dword [0x180124b24], 0x10b8
mov dword [0x1801190bc], 0x410
mov dword [rbp - 0x68], 0x175c4c5a
mov dword [rbp - 0x64], 0x2b272c28
mov word [rbp - 0x60], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x5e], 1
lea rcx, [rbp - 0x68]
call fcn.180070930
lea rcx, [rbp - 0x68]
jmp 0x180070450
movdqa xmm0, xmmword [0x180104830]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
lea rcx, str.VMP_b2944_GameProcess.exe
test rax, rax
cmove rcx, rsi
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x257bea0
mov dword [0x180124b18], 0x1f42068
mov dword [0x180124b34], 0x1feaac0
mov dword [0x180124b3c], 0x1052879
mov dword [0x180124b04], 0x1052834
mov dword [0x180124b00], 0x134
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2f4
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x11c
mov dword [0x180124b08], 0x110
mov dword [0x180124b38], 0xd10
mov dword [0x180124b48], 0x918
mov dword [0x180124b30], 0x10a8
mov dword [0x180124b44], 0xe8
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x150c
mov dword [0x180124b54], 0x1098
mov dword [0x180124b24], 0x10b8
mov dword [0x1801190bc], 0x410
mov dword [rsp + 0x50], 0x175c4c5a
mov dword [rsp + 0x54], 0x2b272c28
mov word [rsp + 0x58], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x5a], 1
lea rcx, [rsp + 0x50]
call fcn.180070930
lea rcx, [rsp + 0x50]
jmp 0x180070450
movdqa xmm0, xmmword [0x180104860]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
lea rcx, str.VMP_b2802_GameProcess.exe
test rax, rax
cmove rcx, r14
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x254d448
mov dword [0x180124b18], 0x1f5b820
mov dword [0x180124b34], 0x1fbc100
mov dword [0x180124b3c], 0x10455f5
mov dword [0x180124b04], 0x10455b0
mov dword [0x180124b00], 0x134
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2f4
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x11c
mov dword [0x180124b08], 0x110
mov dword [0x180124b38], 0xd10
mov dword [0x180124b48], 0x918
mov dword [0x180124b30], 0x10a8
mov dword [0x180124b44], 0x88
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x150c
mov dword [0x180124b54], 0x1098
mov dword [0x180124b24], 0x10b8
mov dword [0x1801190bc], 0x410
mov dword [rsp + 0x40], 0x175c4c5a
mov dword [rsp + 0x44], 0x2b272c28
mov word [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.180070930
lea rcx, [rsp + 0x40]
jmp 0x180070450
movdqa xmm0, xmmword [0x180104890]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
lea rcx, str.VMP_b2699_GameProcess.exe
test rax, rax
cmove rcx, r12
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x26684d8
mov dword [0x180124b18], 0x20304c8
mov dword [0x180124b34], 0x20d8c90
mov dword [0x180124b3c], 0x10479f9
mov dword [0x180124b04], 0x10479b4
mov dword [0x180124b00], 0x134
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2f4
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x11c
mov dword [0x180124b08], 0x110
mov dword [0x180124b38], 0xd10
mov dword [0x180124b48], 0x918
mov dword [0x180124b30], 0x10c8
mov dword [0x180124b44], 0x88
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x1530
mov dword [0x180124b54], 0x10b8
mov dword [0x180124b24], 0x10d8
mov dword [rbp - 0x58], 0x175c4c5a
mov dword [rbp - 0x54], 0x2b272c28
mov word [rbp - 0x50], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x4e], 1
lea rcx, [rbp - 0x58]
call fcn.180070930
lea rcx, [rbp - 0x58]
jmp 0x180070450
movdqa xmm0, xmmword [0x180104870]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
lea rcx, str.VMP_b2612_GameProcess.exe
test rax, rax
cmove rcx, r13
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x2567db0
mov dword [0x180124b18], 0x1f77ef0
mov dword [0x180124b34], 0x1fd8570
mov dword [0x180124b3c], 0x1040dbd
mov dword [0x180124b04], 0x1040d78
mov dword [0x180124b00], 0x134
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2f4
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x11c
mov dword [0x180124b08], 0x110
mov dword [0x180124b38], 0xd30
mov dword [0x180124b48], 0x938
mov dword [0x180124b30], 0x10c8
mov dword [0x180124b44], 0x88
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x1530
mov dword [0x180124b54], 0x10b8
mov dword [0x180124b24], 0x10d8
mov dword [rbp - 0x48], 0x175c4c5a
mov dword [rbp - 0x44], 0x2b272c28
mov word [rbp - 0x40], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x3e], 1
lea rcx, [rbp - 0x48]
call fcn.180070930
lea rcx, [rbp - 0x48]
jmp 0x180070450
movdqa xmm0, xmmword [0x180104810]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
lea rcx, str.VMP_b2545_GameProcess.exe
test rax, rax
cmove rcx, rbx
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x25667e8
mov dword [0x180124b18], 0x1f2e7a8
mov dword [0x180124b34], 0x1fd6f70
mov dword [0x180124b3c], 0x103f4ad
mov dword [0x180124b04], 0x103f468
mov dword [0x180124b00], 0x134
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2f4
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x11c
mov dword [0x180124b08], 0x110
mov dword [0x180124b38], 0xd30
mov dword [0x180124b48], 0x938
mov dword [0x180124b30], 0x10c8
mov dword [0x180124b44], 0x88
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x1530
mov dword [0x180124b54], 0x10b8
mov dword [0x180124b24], 0x10d8
mov dword [rbp - 0x38], 0x175c4c5a
mov dword [rbp - 0x34], 0x2b272c28
mov word [rbp - 0x30], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x2e], 1
lea rcx, [rbp - 0x38]
call fcn.180070930
lea rcx, [rbp - 0x38]
jmp 0x180070450
movdqa xmm0, xmmword [0x180104850]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
lea rcx, str.VMP_b2372_GameProcess.exe
test rax, rax
cmove rcx, r15
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x252dcd8
mov dword [0x180124b18], 0x1f05208
mov dword [0x180124b34], 0x1f9e9f0
mov dword [0x180124b3c], 0x1035665
mov dword [0x180124b04], 0x1035620
mov dword [0x180124b00], 0x134
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2f4
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x11c
mov dword [0x180124b08], 0x110
mov dword [0x180124b38], 0xd30
mov dword [0x180124b48], 0x938
mov dword [0x180124b30], 0x10c8
mov dword [0x180124b44], 0x88
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x14e0
mov dword [0x180124b54], 0x10b8
mov dword [0x180124b24], 0x10d8
mov dword [rbp - 0x28], 0x175c4c5a
mov dword [rbp - 0x24], 0x2b272c28
mov word [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x1e], 1
lea rcx, [rbp - 0x28]
call fcn.180070930
lea rcx, [rbp - 0x28]
jmp 0x180070450
movdqa xmm0, xmmword [0x180104880]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
lea rcx, str.VMP_b2189_GameProcess.exe
test rax, rax
lea rax, str.FiveM_b2189_GTAProcess.exe
cmove rcx, rax
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x24e6d90
mov dword [0x180124b18], 0x1ee18a8
mov dword [0x180124b34], 0x1f888c0
mov dword [0x180124b3c], 0x102f8e9
mov dword [0x180124b04], 0x102f8a4
mov dword [0x180124b00], 0x134
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2f4
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x11c
mov dword [0x180124b08], 0x110
mov dword [0x180124b38], 0xd30
mov dword [0x180124b48], 0x938
mov dword [0x180124b30], 0x10c8
mov dword [0x180124b44], 0x78
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x14e0
mov dword [0x180124b54], 0x10b8
mov dword [0x180124b24], 0x10d8
mov dword [rbp - 0x18], 0x175c4c5a
mov dword [rbp - 0x14], 0x2b272c28
mov word [rbp - 0x10], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0xe], 1
lea rcx, [rbp - 0x18]
call fcn.180070930
lea rcx, [rbp - 0x18]
jmp 0x180070450
movdqa xmm0, xmmword [0x180104840]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x232a2d22
mov dword [rbp + 0x84], 0x2c367c22
mov word [rbp + 0x88], Ordinal_50
mov byte [rbp + 0x8a], 1
lea rcx, [rbp + 0x70]
call fcn.1800708c0
lea rcx, [rbp + 0x70]
call fcn.180050c50
lea rcx, str.VMP_b2060_GameProcess.exe
test rax, rax
lea rax, str.FiveM_b2060_GTAProcess.exe
cmove rcx, rax
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x24c8858
mov dword [0x180124b18], 0x1ec3828
mov dword [0x180124b34], 0x1f6a7e0
mov dword [0x180124b3c], 0x101b6d9
mov dword [0x180124b04], 0x101b694
mov dword [0x180124b00], 0x134
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2f4
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x11c
mov dword [0x180124b08], 0x110
mov dword [0x180124b38], 0xd30
mov dword [0x180124b48], 0x938
mov dword [0x180124b30], 0x10c8
mov dword [0x180124b44], 0x78
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x14e0
mov dword [0x180124b54], 0x10b8
mov dword [0x180124b24], 0x10d8
mov dword [rbp - 8], 0x175c4c5a
mov dword [rbp - 4], 0x2b272c28
mov word [rbp], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 2], 1
lea rcx, [rbp - 8]
call fcn.180070930
lea rcx, [rbp - 8]
jmp 0x180070450
movdqa xmm0, xmmword [0x180104d10]
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x78], 0x2a3628
mov byte [rbp - 0x74], 1
lea rcx, [rsp + 0x78]
call fcn.180070ea0
lea rcx, [rsp + 0x78]
call fcn.180050c50
lea rcx, str.VMP_GameProcess.exe
test rax, rax
lea rax, str.FiveM_GTAProcess.exe
cmove rcx, rax
mov qword [0x180124ad0], rcx
mov dword [0x180124b28], 0x247f840
mov dword [0x180124b18], 0x1efd4c8
mov dword [0x180124b34], 0x2087780
mov dword [0x180124b3c], 0xec58f1
mov dword [0x180124b04], 0xec58ac
mov dword [0x180124b00], 0x12c
mov dword [0x180124b0c], 0x74
mov dword [0x180124b1c], 0x2e8
mov dword [0x180124b40], 0x28c
mov dword [0x180124b4c], 0xb0
mov dword [0x180124b10], 0x114
mov dword [0x180124b08], 0x108
mov dword [0x180124b38], 0xd28
mov dword [0x180124b48], 0x918
mov dword [0x180124b30], 0x10b8
mov dword [0x180124b44], 0x60
mov dword [0x180124b14], 0x60
mov dword [0x180124b2c], 0x90
mov dword [0x180124b20], 0x280
mov dword [0x180124b50], 0x14b8
mov dword [0x180124b54], 0x10a8
mov dword [0x180124b24], 0x10c8
mov dword [rsp + 0x60], 0x175c4c5a
mov dword [rsp + 0x64], 0x2b272c28
mov word [rsp + 0x68], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x6a], 1
lea rcx, [rsp + 0x60]
call fcn.180070930
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x18007046d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18006f121
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..METABL
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x180124ae8], rax
mov dword [rsp + 0x60], 0x175c4c5a
mov dword [rsp + 0x64], 0x2b272c28
mov word [rsp + 0x68], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x6a], 1
lea rcx, [rsp + 0x60]
call fcn.180070930
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str._Founded
lea rcx, [rbp + 0xb0]
call fcn.180073a10
nop
lea r8, [rbp + 0xb0]
mov rdx, qword [0x180124ad0]
lea rcx, [rbp + 0x70]
call fcn.1800778b0
lea rbx, [0x180123708]
cmp rbx, rax
je 0x18007051c
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.180075dc0
lea rcx, [rbp + 0x70]
call fcn.1800503e0
xor r8d, r8d
lea rdx, [0x1800f2e32]
mov rcx, rbx
call fcn.180075c60
mov rcx, qword [0x180124ad0]
call fcn.180050c50
mov dword [0x180124b58], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x180124b68], rax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180050d30
mov qword [0x180124b60], rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180057a10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180059540]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x18006ded0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x1801248a9], 1
lea rcx, [rbp + 0xb0]
call fcn.1800503e0
nop
xor edx, edx
lea rcx, [rbp + 0xa0]
call fcn.180075a00
movzx edx, byte [rbp + 0xa0]
lea rcx, [rbp + 0xa8]
call fcn.180075030
nop
lea rcx, [rbp + 0xd0]
call fcn.1800503e0
nop
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.180075a00
movzx edx, byte [rbp + 0x90]
lea rcx, [rbp + 0x98]
call fcn.180075030
nop
mov eax, 1
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1800dedc0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret