Function at 0x180035fe0
Capabilities:
Access peb ldr_data
Encode data using xor
Generate random numbers using a mersenne twister
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x1630
call fcn.1800d0f60
sub rsp, rax
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x180230100]
xor rax, rsp
mov qword [rbp + 0x15d0], rax
xor eax, eax
mov dword [rbp + 8], eax
cmp edx, 1
jne 0x18003835c
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movabs rax, 0x9c96a5f51f514285
mov qword [rbp + 0x1580], rax
movabs rax, 0xbcc9bde086430566
mov qword [rbp + 0x1588], rax
movabs rax, 0xf9e0cc867a3926e4
mov qword [rbp + 0x20], rax
movabs rax, 0xbcc9bde0ea2f6148
mov qword [rbp + 0x28], rax
movaps xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x1580]
movdqa xmmword [rbp + 0x20], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180036113
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180036113
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xd287f1f6
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003610e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800360f0
cmp edi, 0xc480d1fb
je 0x180036118
test r8d, r8d
jne 0x1800360d0
mov rax, qword [rax]
jmp 0x1800360a0
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
lea rcx, [rbp + 0x20]
call rdx
mov qword [0x180232290], rax
test rax, rax
je 0x18003849c
mov dword [rbp + 0xd0], 1
movzx r15d, byte [rbp]
movzx ebx, byte [rbp]
movzx r13d, byte [rbp]
movzx r14d, byte [rbp]
movzx r12d, byte [rbp]
movzx esi, byte [rbp]
mov edi, dword [rbp + 8]
nop
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x180], al
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], al
mov qword [rbp + 0x1c0], rax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1554], 0xffffffff
mov dword [rbp + 0x1d4], eax
mov edx, 1
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1d4], eax
inc rdx
cmp rdx, 0x270
jb 0x1800361e0
mov dword [rbp + 0x1d0], 0x270
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xor r10d, r10d
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], r10b
or edi, 1
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
lea edx, [r10 + 0x1a]
lea rcx, [rbp + 0x10]
call fcn.18001af00
movzx ecx, byte [rax + rdi]
mov qword [rbp + 0x30], 1
lea rax, [rbp + 0x20]
mov byte [rax], cl
mov byte [rax + 1], 0
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x10]
call fcn.18001af00
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x1800362b2
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800362c4
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18000d470
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x10]
call fcn.18001af00
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x180036316
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180036328
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18000d470
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x10]
call fcn.18001af00
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x18003637a
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18003638c
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18000d470
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x10]
call fcn.18001af00
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x1800363de
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800363f0
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18000d470
lea r9, [rbp + 0x20]
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x10], rax
cmp qword [rbp + 0x38], 0xf
cmova r9, rax
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x180036410
mov qword [rbp + 0xa0], rax
mov rcx, qword [rbp + 0x198]
cmp rax, rcx
ja 0x180036466
lea rdi, [rbp + 0x180]
cmp rcx, 0xf
cmova rdi, qword [rbp + 0x180]
mov qword [rbp + 0x190], rax
mov r8, rax
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp + 0xa0]
mov byte [rdi + rax], 0
mov rcx, qword [rbp + 0x10]
jmp 0x18003647d
movzx r8d, r15b
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.18000e490
mov rcx, qword [rbp + 0x20]
mov edi, dword [rbp + 4]
and edi, 0xfffffffe
mov rax, qword [rbp + 0x38]
cmp rax, 0xf
jbe 0x1800364bc
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800364b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036afa
call fcn.1800d084c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xor eax, eax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], 7
mov word [rbp + 0xd8], ax
or edi, 4
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
mov word [rsp + 0x20], ax
mov r9d, 0x105
movzx r8d, r13b
mov edx, r9d
lea rcx, [rbp + 0xd8]
call fcn.180020320
lea rcx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 7
cmova rcx, qword [rbp + 0xd8]
call fcn.1800d0318
mov qword [rbp + 0xa0], rax
mov ecx, eax
mov r8, qword [rbp + 0xe8]
cmp rcx, r8
ja 0x180036561
mov qword [rbp + 0xe8], rcx
lea rax, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 7
cmova rax, qword [rbp + 0xd8]
xor r10d, r10d
mov word [rax + rcx*2], r10w
jmp 0x1800365d3
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp + 0xf0]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x1800365b4
mov qword [rbp + 0xe8], rcx
lea r9, [rbp + 0xd8]
cmp rdi, 7
cmova r9, qword [rbp + 0xd8]
lea rdi, [r9 + r8*2]
xor r10d, r10d
test rdx, rdx
je 0x1800365a9
movzx eax, r10w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r10w
jmp 0x1800365d0
xor r10d, r10d
mov word [rsp + 0x20], r10w
mov r9, rdx
movzx r8d, r14b
lea rcx, [rbp + 0xd8]
call fcn.180020320
mov edi, dword [rbp + 4]
mov eax, dword [rbp + 0xa4]
cmp eax, 0xffffffff
jne 0x1800365fb
mov dword [rbp + 0x40], reloc.WS2_32.dll_sendto
lea rax, [0x18022f640]
mov qword [rbp + 0x48], rax
movaps xmm0, xmmword [rbp + 0x40]
mov eax, reloc.WS2_32.dll_sendto
jmp 0x180036616
mov dword [rbp + 0xb0], eax
lea rcx, [0x18022f650]
mov qword [rbp + 0xb8], rcx
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x20], xmm0
and edi, 0xfffffffb
or edi, 2
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
test eax, eax
jne 0x1800384a5
lea rax, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 7
cmova rax, qword [rbp + 0xd8]
mov qword [rbp + 0xa0], rax
mov rdi, qword [rbp + 0xe8]
mov qword [rbp + 0x20], rdi
call fcn.1800cfbf8
mov dword [rbp + 0x10], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xor edx, edx
mov qword [rbp + 0x70], rdx
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], dl
mov ecx, dword [rbp + 4]
or ecx, 0x40
mov dword [rbp + 4], ecx
mov dword [rbp + 8], ecx
test rdi, rdi
je 0x180036791
cmp rdi, 0x7fffffff
ja 0x1800384d2
mov dword [rsp + 0x20], edx
xor r9d, r9d
mov r8d, edi
mov rdx, qword [rbp + 0xa0]
mov ecx, eax
call fcn.1800cfc68
mov rdi, rax
mov qword [rbp + 0x1580], rax
shr rax, 0x20
test eax, eax
jne 0x1800384c6
movsxd rdx, edi
mov r8, qword [rbp + 0x70]
cmp rdx, r8
ja 0x1800366ec
mov qword [rbp + 0x70], rdx
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rax, qword [rbp + 0x60]
mov byte [rax + rdx], 0
jmp 0x18003675c
mov rcx, rdx
sub rcx, r8
mov qword [rbp + 0x1580], rcx
mov r9, qword [rbp + 0x78]
mov rax, r9
sub rax, r8
cmp rcx, rax
ja 0x180036744
mov qword [rbp + 0x70], rdx
lea rax, [rbp + 0x60]
cmp r9, 0xf
cmova rax, qword [rbp + 0x60]
add rax, r8
mov qword [rbp + 0x118], rax
mov r8, rcx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x1580]
mov byte [rcx + rax], 0
jmp 0x18003675c
mov byte [rsp + 0x20], 0
mov r9, rcx
movzx r8d, r12b
mov rdx, rcx
lea rcx, [rbp + 0x60]
call fcn.18000dfc0
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r9, qword [rbp + 0x60]
mov dword [rsp + 0x20], edi
mov r8d, dword [rbp + 0x20]
mov rdx, qword [rbp + 0xa0]
mov ecx, dword [rbp + 0x10]
call fcn.1800cfc68
mov qword [rbp + 0x20], rax
shr rax, 0x20
test eax, eax
jne 0x1800384bd
mov edi, dword [rbp + 4]
and edi, 0xffffffbf
or edi, 0x38
mov dword [rbp + 8], edi
mov qword [rbp + 0x20], 0xa
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1554], 0xffffffff
mov dword [rbp + 0x1d4], eax
mov edx, 1
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1d4], eax
inc rdx
cmp rdx, 0x270
jb 0x1800367c0
mov dword [rbp + 0x1d0], 0x270
xorps xmm0, xmm0
movups xmmword [rbp + 0x1560], xmm0
xor r10d, r10d
mov ebx, r10d
mov qword [rbp + 0x1570], rbx
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x1578], r15
mov byte [rbp + 0x1560], bl
bts edi, 7
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
mov r13, qword [rbp + 0x20]
dec r13
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x20], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x20]
call fcn.18001af00
movzx r9d, byte [rdi + rax]
cmp rbx, r15
jae 0x18003687a
lea rax, [rbx + 1]
mov qword [rbp + 0x1570], rax
lea rax, [rbp + 0x1560]
cmp r15, 0xf
cmova rax, qword [rbp + 0x1560]
mov byte [rax + rbx], r9b
mov byte [rax + rbx + 1], 0
jmp 0x18003688f
movzx r8d, sil
mov edx, 1
lea rcx, [rbp + 0x1560]
call fcn.18000d470
test r13, r13
je 0x1800368a4
mov rbx, qword [rbp + 0x1570]
mov r15, qword [rbp + 0x1578]
jmp 0x180036824
lea rdx, [rbp + 0x1560]
cmp qword [rbp + 0x1578], 0xf
cmova rdx, qword [rbp + 0x1560]
mov r8, qword [rbp + 0x1570]
lea rcx, [rbp + 0x60]
call fcn.180009ea0
lea rcx, [rbp + 0x1a0]
cmp rcx, rax
movzx ebx, byte [rbp]
movzx r15d, byte [rbp]
movzx r13d, byte [rbp]
je 0x180036902
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1800368f3
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.18000c2c0
mov edi, dword [rbp + 4]
btr edi, 7
mov rdx, qword [rbp + 0x1578]
cmp rdx, 0xf
jbe 0x18003694b
inc rdx
mov rcx, qword [rbp + 0x1560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180036945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036b01
call fcn.1800d084c
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x180036986
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180036981
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036b08
call fcn.1800d084c
xor eax, eax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], al
and edi, 0xfffffffd
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
lea rcx, [rbp + 0xd8]
call fcn.18001c120
mov rdi, qword [0x18022f0f8]
cmp rdi, qword [0x18022f100]
je 0x180036a0f
mov qword [rbp + 0x20], rdi
lea rdx, [rbp + 0x180]
mov rcx, rdi
call fcn.18000a2f0
nop
lea rcx, [rdi + 0x20]
lea rdx, [rbp + 0x1a0]
call fcn.18000a2f0
nop
mov rax, qword [rbp + 0x1c0]
mov qword [rdi + 0x40], rax
mov rcx, qword [rbp + 0x1c0]
test rcx, rcx
je 0x180036a05
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbp + 0x1c0]
add qword [0x18022f0f8], 0x48
jmp 0x180036a2c
lea r8, [rbp + 0x180]
mov rdx, rdi
lea rcx, [0x18022f0f0]
call fcn.18001f4d0
mov rcx, qword [rbp + 0x1c0]
test rcx, rcx
je 0x180036a46
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor edi, edi
test al, al
je 0x180036a48
mov qword [rbp + 0x1c0], rdi
jmp 0x180036a48
xor edi, edi
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x180036a89
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180036a84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036b0f
call fcn.1800d084c
mov qword [rbp + 0x1b0], rdi
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x180036adf
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180036ada
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036b0f
call fcn.1800d084c
mov eax, dword [rbp + 0xd0]
inc eax
mov dword [rbp + 0xd0], eax
cmp eax, 0x32
jg 0x180036b16
mov edi, dword [rbp + 4]
jmp 0x180036170
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movdqa xmm0, xmmword [0x18019e3c0]
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0xf3f8b7ea
mov dword [rbp + 0x54], 0xc4b1fbef
mov dword [rbp + 0x58], 0x100cecd
lea rdx, [rbp + 0x1560]
lea rcx, [rbp + 0x40]
call fcn.180022ee0
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.180022240
mov r8, qword [rax]
movdqa xmm0, xmmword [0x18019e3c0]
movdqu xmmword [rbp + 0xb0], xmm0
mov dword [rbp + 0xc0], 0xf3f8b7ea
mov dword [rbp + 0xc4], 0xc4b1fbef
mov dword [rbp + 0xc8], 0x100cecd
xor r14d, r14d
mov ecx, r14d
nop
lea eax, [rcx - 0x77]
xor byte [rbp + rcx + 0xb0], al
inc rcx
cmp rcx, 0x1a
jb 0x180036b90
mov byte [rbp + 0xcb], r14b
lea rdx, [rbp + 0xb0]
lea rcx, [rbp]
call fcn.180027630
movdqa xmm0, xmmword [0x18019e270]
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x18019e260]
movdqu xmmword [rbp + 0x70], xmm1
mov dword [rbp + 0x80], 0x9c928a9f
mov word [rbp + 0x84], 0x100
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx + 0x60], al
inc rcx
cmp rcx, 0x24
jb 0x180036bf0
mov byte [rbp + 0x85], r14b
movdqa xmm0, xmmword [0x18019e3c0]
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0xf3f8b7ea
mov dword [rbp + 0x54], 0xc4b1fbef
mov dword [rbp + 0x58], 0x100cecd
mov rcx, r14
nop dword [rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx + 0x40], al
inc rcx
cmp rcx, 0x1a
jb 0x180036c30
mov byte [rbp + 0x5b], r14b
lea r9, [rbp]
lea r8, [rbp + 0x5a]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1560]
call fcn.180012740
nop
mov rsi, qword [0x180232168]
mov rdi, qword [rsi + 8]
mov qword [rbp + 0x160], rdi
mov dword [rbp + 0x168], r14d
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x180036cbe
nop
mov qword [rbp + 0x160], rdi
lea rcx, [rdi + 0x20]
lea rdx, [rbp + 0x1560]
call fcn.18001d520
test al, al
jns 0x180036ca8
mov dword [rbp + 0x168], r14d
mov rdi, qword [rdi + 0x10]
jmp 0x180036cb8
mov dword [rbp + 0x168], 1
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180036c80
cmp byte [rbx + 0x19], 0
jne 0x180036cdc
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x1560]
call fcn.18001d520
test al, al
jns 0x180036da1
movabs rax, 0x38e38e38e38e38e
cmp qword [0x180232170], rax
je 0x1800384dd
lea rbx, [0x180232168]
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], r14
mov edx, 1
mov rcx, rbx
call fcn.180032460
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], r14
mov qword [rax + 0x38], r14
movups xmm0, xmmword [rbp + 0x1560]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x1570]
movups xmmword [rax + 0x30], xmm1
mov qword [rbp + 0x1570], r14
mov qword [rbp + 0x1578], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1560], 0
mov qword [rax + 0x40], r14
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
mov qword [rbp + 0x128], r14
lea rcx, [rbp + 0x120]
call fcn.1800225f0
movups xmm0, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0xb0], xmm0
mov r8, rdi
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call fcn.1800154f0
mov rbx, rax
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x180036e6e
movsxd rax, dword [rbx + 0x3c]
mov edi, dword [rax + rbx + 0x50]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rax
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x160]
lea rcx, [0x180232b10]
call fcn.180022fd0
mov r9, qword [rbp + 0x168]
mov r10, qword [rbp + 0x160]
sub r9, r10
sar r9, 2
inc dword [0x18023290c]
mov r11d, edi
sub r11, r9
je 0x180036e62
mov edx, r14d
mov r8d, r14d
test r9, r9
je 0x180036e3e
nop
mov rax, r14
nop dword [rax]
nop word [rax + rax]
mov edi, dword [r10 + rax*4]
lea eax, [rdx + r8]
movzx eax, byte [rax + rbx]
cmp eax, edi
je 0x180036e35
cmp edi, 0xffffffff
jne 0x180036e52
inc edx
mov eax, edx
cmp rax, r9
jb 0x180036e20
mov edi, r8d
add rdi, rbx
lea rcx, [rbp + 0x160]
call fcn.180010050
jmp 0x180036e71
inc r8d
mov eax, r8d
cmp rax, r11
jae 0x180036e62
mov edx, r14d
jmp 0x180036e10
lea rcx, [rbp + 0x160]
call fcn.180010050
mov rdi, r14
lea rcx, [rbp + 0x1560]
call fcn.180009fd0
movsxd rcx, dword [rdi + 3]
add rcx, 7
add rcx, rdi
lea rax, vtable.._AV___Func_impl_no_alloc_V_lambda_1___6____Connect_V_lambda_3___4__DllMain__YAEPEAUHINSTANCE____KPEAX_Z____fwEvent_PEAVResource_fx____QEAA_A_PV_lambda_3___4__DllMain__YAEPEAUHINSTANCE____KPEAX_Z_H_Z__NPEAVResource_fx___std__.0
mov qword [rbp + 0xd8], rax
movzx eax, byte [rbp]
mov byte [rbp + 0xe0], al
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x110], rax
xor r8d, r8d
lea rdx, [rbp + 0xd8]
call fcn.1800281b0
mov rax, qword [0x180232b28]
test rax, rax
jne 0x180036f86
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r11d, dword [rax + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x180036f66
mov edi, dword [r11 + 0x18]
test edi, edi
je 0x180036f66
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec edi
lea rax, [r10 + rdi*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov edx, 0x7dd19ff1
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x180036f62
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x180036f40
cmp edx, 0x3cac260
je 0x180037168
test edi, edi
jne 0x180036f20
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x180036f7c
cmp qword [rax + 0x30], 0
jne 0x180036ef0
mov rax, r14
mov qword [0x180232b28], rax
movabs r15, 0x9c96a5f51f514285
mov qword [rbp + 0x1560], r15
movabs r12, 0xbcc9bde086430566
mov qword [rbp + 0x1568], r12
movabs rsi, 0xe80cf5cb6b8bda57
mov qword [rbp + 0x1570], rsi
movabs rbx, 0x2b80704e03e5bba8
mov qword [rbp + 0x1578], rbx
movabs rdi, 0xb1f8c08f76252be6
mov qword [rbp + 0x15a0], rdi
movabs rcx, 0xd2a0c990ef316615
mov qword [rbp + 0x15a8], rcx
movabs rcx, 0x8468dbaa1ee7f730
mov qword [rbp + 0x15b0], rcx
movabs rcx, 0x2b80704e03e5bbc4
mov qword [rbp + 0x15b8], rcx
movups xmm0, xmmword [rbp + 0x15a0]
movaps xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rbp + 0x15b0]
movaps xmmword [rbp + 0x70], xmm1
vmovdqu ymm0, ymmword [rbp + 0x1560]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rcx, [rbp + 0x60]
vzeroupper
call rax
add rax, 0x99ae0
mov qword [0x180232920], rax
mov qword [rbp + 0x15a0], r15
mov qword [rbp + 0x15a8], r12
mov qword [rbp + 0x15b0], rsi
mov qword [rbp + 0x15b8], rbx
mov qword [rbp + 0x140], rdi
movabs rax, 0xdda7cf85ff226916
mov qword [rbp + 0x148], rax
movabs rax, 0x8d7a9cad46f8bf3a
mov qword [rbp + 0x150], rax
movabs rax, 0x2b80704e6f89df86
mov qword [rbp + 0x158], rax
movups xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0x1560], xmm0
movups xmm1, xmmword [rbp + 0x150]
movaps xmmword [rbp + 0x1570], xmm1
vmovdqu ymm0, ymmword [rbp + 0x15a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1560]
vmovdqa ymmword [rbp + 0x1560], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180037163
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180037163
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0x36f73ab4
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003715e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180037140
cmp edi, 0x8075583d
je 0x180037185
test r8d, r8d
jne 0x180037120
mov rax, qword [rax]
jmp 0x1800370f0
mov ecx, dword [r11 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180036f7f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, [rbp + 0x1560]
call rax
add rax, 0x15300
mov qword [0x180232998], rax
mov byte [0x180232a00], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov ebx, dword [rdx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180037253
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180037253
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov edi, 0x9a9aebb0
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x18003724e
nop dword [rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x180037230
cmp edi, 0xe66b7351
je 0x180037258
test r8d, r8d
jne 0x180037210
mov rcx, qword [rcx]
jmp 0x1800371e0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b3095_GTAProcess.exe
call rax
test rax, rax
je 0x180037357
lea rax, [rsi + 0x79bb34]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x2593320]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x20019e0]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x1f58b58]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x20025b8]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x1624f80]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x1098
mov dword [0x1802329c8], 0x150c
mov dword [0x1802329d4], 0xd10
mov dword [0x1802329d0], 0x10b8
mov dword [0x1802329d8], 0x10c8
mov dword [0x1802329dc], 0x2f4
mov dword [0x1802329e0], 0x84
mov dword [0x1802329f4], 0x134
mov dword [0x1802329e4], 0x20
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5f0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800373e3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800373e3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xd9773664
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800373de
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800373c0
cmp edi, 0x52046ced
je 0x1800373e8
test r8d, r8d
jne 0x1800373a0
mov rax, qword [rax]
jmp 0x180037370
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2802_GTAProcess.exe
call rax
test rax, rax
je 0x1800374ee
lea rax, [rsi + 0x794784]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x254d448]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x1fbc100]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x1f5b820]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x1fbccd8]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x15ea2a5]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x1098
mov dword [0x1802329c8], 0x150c
mov dword [0x1802329d4], 0xd10
mov dword [0x1802329d0], 0x10b8
mov dword [0x1802329d8], 0x10a8
mov dword [0x1802329dc], 0x2f4
mov dword [0x1802329e0], 0x84
mov dword [0x1802329f4], 0x134
mov dword [0x1802329e4], 0x20
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5f0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x28c
mov byte [0x180232a00], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180037573
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180037573
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0x5f69d0ac
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003756e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180037550
cmp edi, 0xaa0d42f5
je 0x180037578
test r8d, r8d
jne 0x180037530
mov rax, qword [rax]
jmp 0x180037500
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2944_GTAProcess.exe
call rax
test rax, rax
je 0x18003767e
lea rax, [rsi + 0x795f9c]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x257bea0]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x1feaac0]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x1f42068]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x1feb968]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x160ff90]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x1098
mov dword [0x1802329c8], 0x150c
mov dword [0x1802329d4], 0xd10
mov dword [0x1802329d0], 0x10b8
mov dword [0x1802329d8], 0x10a8
mov dword [0x1802329dc], 0x2f4
mov dword [0x1802329e0], 0x84
mov dword [0x1802329f4], 0x134
mov dword [0x1802329e4], 0x20
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5f0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x28c
mov byte [0x180232a00], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180037703
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180037703
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0xcf3b35bd
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800376fe
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800376e0
cmp edi, 0xe83a3c14
je 0x180037708
test r8d, r8d
jne 0x1800376c0
mov rax, qword [rax]
jmp 0x180037690
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2699_GTAProcess.exe
call rax
test rax, rax
je 0x180037807
lea rax, [rsi + 0x78f450]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x26684d8]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x20d8c90]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x20304c8]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x20d9868]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x15d6cec]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x10b8
mov dword [0x1802329c8], 0x1530
mov dword [0x1802329d4], 0xd30
mov dword [0x1802329d0], 0x10d8
mov dword [0x1802329d8], 0x10c8
mov dword [0x1802329dc], 0x2f4
mov dword [0x1802329e0], 0x84
mov dword [0x1802329f4], 0x134
mov dword [0x1802329e4], 0x20
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5f0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180037893
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180037893
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0x8e7b1b1b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003788e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180037870
cmp edi, 0x6c13353e
je 0x180037898
test r8d, r8d
jne 0x180037850
mov rax, qword [rax]
jmp 0x180037820
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2612_GTAProcess.exe
call rax
test rax, rax
je 0x180037997
lea rax, [rsi + 0x78c758]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x2567db0]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x1fd8570]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x1f77ef0]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x1fd9148]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x15dfe20]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x10b8
mov dword [0x1802329c8], 0x1530
mov dword [0x1802329d4], 0xd30
mov dword [0x1802329d0], 0x10d8
mov dword [0x1802329d8], 0x10c8
mov dword [0x1802329dc], 0x2f4
mov dword [0x1802329e0], 0x84
mov dword [0x1802329f4], 0x134
mov dword [0x1802329e4], 0x20
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5f0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180037a23
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180037a23
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0x37fe15a4
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180037a1e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180037a00
cmp edi, 0xa680cd2d
je 0x180037a28
test r8d, r8d
jne 0x1800379e0
mov rax, qword [rax]
jmp 0x1800379b0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2545_GTAProcess.exe
call rax
test rax, rax
je 0x180037b27
lea rax, [rsi + 0x78c5e4]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x25667e8]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x1fd6f70]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x1f2e7a8]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x1fd7b48]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x15deeb0]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x10b8
mov dword [0x1802329c8], 0x1530
mov dword [0x1802329d4], 0xd30
mov dword [0x1802329d0], 0x10d8
mov dword [0x1802329d8], 0x10c8
mov dword [0x1802329dc], 0x2f4
mov dword [0x1802329e0], 0x84
mov dword [0x1802329f4], 0x134
mov dword [0x1802329e4], 0x20
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5f0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180037bb3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180037bb3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0x800541f1
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180037bae
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180037b90
cmp edi, 0x612ae460
je 0x180037bb8
test r8d, r8d
jne 0x180037b70
mov rax, qword [rax]
jmp 0x180037b40
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2372_GTAProcess.exe
call rax
test rax, rax
je 0x180037cb7
lea rax, [rsi + 0x787fe4]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x252dcd8]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x1f9e9f0]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x1f05208]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x1f9f5c8]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x15cd2c0]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x10b8
mov dword [0x1802329c8], 0x14e0
mov dword [0x1802329d4], 0xd30
mov dword [0x1802329d0], 0x10d8
mov dword [0x1802329d8], 0x10c8
mov dword [0x1802329dc], 0x2f4
mov dword [0x1802329e0], 0x84
mov dword [0x1802329f4], 0x134
mov dword [0x1802329e4], 0x20
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5f0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180037d43
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180037d43
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xe20141f7
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180037d3e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180037d20
cmp edi, 0x41909662
je 0x180037d48
test r8d, r8d
jne 0x180037d00
mov rax, qword [rax]
jmp 0x180037cd0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2189_GTAProcess.exe
call rax
test rax, rax
je 0x180037e51
lea rax, [rsi + 0x79b5dc]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x24e6d90]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x1f888c0]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x1ee18a8]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x1f89498]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x15b1008]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x10b8
mov dword [0x1802329c8], 0x14e0
mov dword [0x1802329d4], 0xd30
mov dword [0x1802329d0], 0x10d8
mov dword [0x1802329d8], 0x10c8
mov dword [0x1802329dc], 0x2f4
mov dword [0x1802329e0], 0x84
mov dword [0x1802329f4], 0x134
mov dword [0x1802329e4], 0x20
mov dword [0x1802329fc], 0x908
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5f0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180037ee3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180037ee3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xc0f49282
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180037ede
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180037ec0
cmp edi, 0x727b328f
je 0x180037ee8
test r8d, r8d
jne 0x180037ea0
mov rax, qword [rax]
jmp 0x180037e70
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2060_GTAProcess.exe
call rax
test rax, rax
je 0x180037fe7
lea rax, [rsi + 0x7935d0]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x24c8858]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x1f6a7e0]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x1ec3828]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x1f6b3c0]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x159b224]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x10b8
mov dword [0x1802329c8], 0x14e0
mov dword [0x1802329d4], 0xd30
mov dword [0x1802329d0], 0x10d8
mov dword [0x1802329d8], 0x10c8
mov dword [0x1802329dc], 0x2f4
mov dword [0x1802329e0], 0x84
mov dword [0x1802329f4], 0x134
mov dword [0x1802329e4], 0x20
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5f0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180038073
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180038073
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0x623ed5ef
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003806e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180038050
cmp edi, 0xad52ef9a
je 0x180038078
test r8d, r8d
jne 0x180038030
mov rax, qword [rax]
jmp 0x180038000
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_GTAProcess.exe
call rax
test rax, rax
je 0x180038180
lea rax, [rsi + 0x779d64]
mov qword [0x1802329b0], rax
lea rax, [rsi + 0x247f840]
mov qword [0x1802329a0], rax
lea rax, [rsi + 0x2087780]
mov qword [0x1802329c0], rax
lea rax, [rsi + 0x1efd4c8]
mov qword [0x1802329a8], rax
lea rax, [rsi + 0x20d9868]
mov qword [0x1802329b8], rax
lea rax, [rsi + 0x1561e30]
mov qword [0x180232a08], rax
mov dword [0x1802329cc], 0x10a8
mov dword [0x1802329c8], 0x14b8
mov dword [0x1802329d4], 0xd30
mov dword [0x1802329d0], 0x10c8
mov dword [0x1802329d8], 0x10b8
mov dword [0x1802329dc], 0x2e8
mov dword [0x1802329e0], 0x74
mov dword [0x1802329f4], 0x12c
mov dword [0x1802329e4], 0x20
mov dword [0x1802329ec], 0x24
mov dword [0x1802329e8], 0x5e0
mov dword [0x1802329f8], 0x146b
mov dword [0x1802329f0], 0x25c
nop word [rax + rax]
mov qword [rbp + 0x15c0], r15
mov qword [rbp + 0x15c8], r12
movabs rax, 0xf7f9cabd4c0216d7
mov qword [rbp + 0x130], rax
movabs rax, 0xbca5d184a8773315
mov qword [rbp + 0x138], rax
movaps xmm0, xmmword [rbp + 0x130]
xorps xmm0, xmmword [rbp + 0x15c0]
movdqa xmmword [rbp + 0x15c0], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180038253
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180038253
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov ecx, dword [rcx + r9]
add rcx, r9
mov edi, 0xa6500bf7
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18003824e
nop dword [rax]
movsx edx, dl
xor edx, edi
imul edi, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x180038230
cmp edi, 0xea25e062
je 0x180038258
test r8d, r8d
jne 0x180038210
mov rax, qword [rax]
jmp 0x1800381e0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, [rbp + 0x15c0]
call rax
test rax, rax
je 0x1800383a8
mov rax, qword [0x180232b20]
test rax, rax
jne 0x180038342
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax + rax]
mov r8, qword [rbx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r11d, dword [rax + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x180038322
mov edi, dword [r11 + 0x18]
test edi, edi
je 0x180038322
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec edi
lea rax, [r10 + rdi*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov edx, 0x5d043893
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18003831e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x180038300
cmp edx, 0xce0e9840
je 0x18003838e
test edi, edi
jne 0x1800382e0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x180038338
cmp qword [rax + 0x30], 0
jne 0x1800382b0
mov rax, r14
mov qword [0x180232b20], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x18002e480]
xor edx, edx
xor ecx, ecx
call rax
mov al, 1
mov rcx, qword [rbp + 0x15d0]
xor rcx, rsp
call fcn.1800d08e0
lea r11, [rsp + 0x1630]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x18003833b
movdqa xmm1, xmmword [0x18019e110]
movdqu xmmword [rbp + 0x160], xmm1
mov dl, 0x2b
mov dil, 2
mov r8b, Ordinal_26
mov r9b, 3
mov r10b, 9
mov r11b, 0x4c
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp + 0x161], al
xor byte [rbp + 0x162], cl
xor byte [rbp + 0x163], cl
xor byte [rbp + 0x164], cl
xor byte [rbp + 0x165], cl
xor byte [rbp + 0x166], cl
xor byte [rbp + 0x167], cl
xor byte [rbp + 0x168], cl
xor byte [rbp + 0x169], cl
xor byte [rbp + 0x16a], cl
xor byte [rbp + 0x16b], cl
xor byte [rbp + 0x16c], cl
xor byte [rbp + 0x16d], cl
xor byte [rbp + 0x16e], cl
xor byte [rbp + 0x16f], cl
xor dl, cl
mov byte [rbp + 0x170], dl
xor dil, cl
mov byte [rbp + 0x171], dil
xor r8b, cl
mov byte [rbp + 0x172], r8b
xor r9b, cl
mov byte [rbp + 0x173], r9b
xor r10b, cl
mov byte [rbp + 0x174], r10b
xor r11b, cl
mov byte [rbp + 0x175], r11b
mov byte [rbp + 0x176], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, [rbp + 0x161]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0x20]
lea rcx, str.temp_directory_path
call fcn.180032270
nop
mov ecx, dword [rbp + 0x24]
call fcn.1800323e0
int3
mov ecx, dword [rbp + 0x1584]
call fcn.1800323e0
int3
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.1800323a0
nop
call fcn.180002bd0
int3