Function at 0x180032280
Capabilities:
Access peb ldr_data
Encode data using xor
Generate random numbers using a mersenne twister
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x1630
call fcn.1800cc490
sub rsp, rax
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x180229ec0]
xor rax, rsp
mov qword [rbp + 0x15d0], rax
xor eax, eax
mov dword [rbp + 8], eax
cmp edx, 1
jne 0x1800345fc
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movabs rax, 0xf8ab7995db9a2285
mov qword [rbp + 0x1580], rax
movabs rax, 0x4f075b8c3a83d906
mov qword [rbp + 0x1588], rax
movabs rax, 0x9ddd10e6bef246e4
mov qword [rbp + 0x20], rax
movabs rax, 0x4f075b8c56efbd28
mov qword [rbp + 0x28], rax
movaps xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x1580]
movdqa xmmword [rbp + 0x20], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800323b3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800323b3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xfa66816d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800323ae
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180032390
cmp edi, 0x5372de84
je 0x1800323b8
test r8d, r8d
jne 0x180032370
mov rax, qword [rax]
jmp 0x180032340
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
lea rcx, [rbp + 0x20]
call rdx
mov qword [0x18022c050], rax
test rax, rax
je 0x18003473c
mov dword [rbp + 0xd0], 1
movzx r15d, byte [rbp]
movzx ebx, byte [rbp]
movzx r13d, byte [rbp]
movzx r14d, byte [rbp]
movzx r12d, byte [rbp]
movzx esi, byte [rbp]
mov edi, dword [rbp + 8]
nop
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x180], al
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], al
mov qword [rbp + 0x1c0], rax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1554], 0xffffffff
mov dword [rbp + 0x1d4], eax
mov edx, 1
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1d4], eax
inc rdx
cmp rdx, 0x270
jb 0x180032480
mov dword [rbp + 0x1d0], 0x270
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xor r10d, r10d
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], r10b
or edi, 1
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
lea edx, [r10 + 0x1a]
lea rcx, [rbp + 0x10]
call fcn.18001ade0
movzx ecx, byte [rax + rdi]
mov qword [rbp + 0x30], 1
lea rax, [rbp + 0x20]
mov byte [rax], cl
mov byte [rax + 1], 0
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x10]
call fcn.18001ade0
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x180032552
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180032564
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18000d3f0
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x10]
call fcn.18001ade0
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x1800325b6
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800325c8
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18000d3f0
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x10]
call fcn.18001ade0
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x18003261a
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18003262c
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18000d3f0
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x10], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x10]
call fcn.18001ade0
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x18003267e
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180032690
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18000d3f0
lea r9, [rbp + 0x20]
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x10], rax
cmp qword [rbp + 0x38], 0xf
cmova r9, rax
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x1800326b0
mov qword [rbp + 0xa0], rax
mov rcx, qword [rbp + 0x198]
cmp rax, rcx
ja 0x180032706
lea rdi, [rbp + 0x180]
cmp rcx, 0xf
cmova rdi, qword [rbp + 0x180]
mov qword [rbp + 0x190], rax
mov r8, rax
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp + 0xa0]
mov byte [rdi + rax], 0
mov rcx, qword [rbp + 0x10]
jmp 0x18003271d
movzx r8d, r15b
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.18000e3d0
mov rcx, qword [rbp + 0x20]
mov edi, dword [rbp + 4]
and edi, 0xfffffffe
mov rax, qword [rbp + 0x38]
cmp rax, 0xf
jbe 0x18003275c
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032756
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180032d9a
call fcn.1800cbd7c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xor eax, eax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], 7
mov word [rbp + 0xd8], ax
or edi, 4
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
mov word [rsp + 0x20], ax
mov r9d, 0x105
movzx r8d, r13b
mov edx, r9d
lea rcx, [rbp + 0xd8]
call fcn.18001ea10
lea rcx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 7
cmova rcx, qword [rbp + 0xd8]
call fcn.1800cb848
mov qword [rbp + 0xa0], rax
mov ecx, eax
mov r8, qword [rbp + 0xe8]
cmp rcx, r8
ja 0x180032801
mov qword [rbp + 0xe8], rcx
lea rax, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 7
cmova rax, qword [rbp + 0xd8]
xor r10d, r10d
mov word [rax + rcx*2], r10w
jmp 0x180032873
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp + 0xf0]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x180032854
mov qword [rbp + 0xe8], rcx
lea r9, [rbp + 0xd8]
cmp rdi, 7
cmova r9, qword [rbp + 0xd8]
lea rdi, [r9 + r8*2]
xor r10d, r10d
test rdx, rdx
je 0x180032849
movzx eax, r10w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r10w
jmp 0x180032870
xor r10d, r10d
mov word [rsp + 0x20], r10w
mov r9, rdx
movzx r8d, r14b
lea rcx, [rbp + 0xd8]
call fcn.18001ea10
mov edi, dword [rbp + 4]
mov eax, dword [rbp + 0xa4]
cmp eax, 0xffffffff
jne 0x18003289b
mov dword [rbp + 0x40], reloc.WS2_32.dll_sendto
lea rax, [0x180229648]
mov qword [rbp + 0x48], rax
movaps xmm0, xmmword [rbp + 0x40]
mov eax, reloc.WS2_32.dll_sendto
jmp 0x1800328b6
mov dword [rbp + 0xb0], eax
lea rcx, [0x180229658]
mov qword [rbp + 0xb8], rcx
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x20], xmm0
and edi, 0xfffffffb
or edi, 2
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
test eax, eax
jne 0x180034745
lea rax, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 7
cmova rax, qword [rbp + 0xd8]
mov qword [rbp + 0xa0], rax
mov rdi, qword [rbp + 0xe8]
mov qword [rbp + 0x20], rdi
call fcn.1800cb128
mov dword [rbp + 0x10], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xor edx, edx
mov qword [rbp + 0x70], rdx
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], dl
mov ecx, dword [rbp + 4]
or ecx, 0x40
mov dword [rbp + 4], ecx
mov dword [rbp + 8], ecx
test rdi, rdi
je 0x180032a31
cmp rdi, 0x7fffffff
ja 0x180034772
mov dword [rsp + 0x20], edx
xor r9d, r9d
mov r8d, edi
mov rdx, qword [rbp + 0xa0]
mov ecx, eax
call fcn.1800cb198
mov rdi, rax
mov qword [rbp + 0x1580], rax
shr rax, 0x20
test eax, eax
jne 0x180034766
movsxd rdx, edi
mov r8, qword [rbp + 0x70]
cmp rdx, r8
ja 0x18003298c
mov qword [rbp + 0x70], rdx
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rax, qword [rbp + 0x60]
mov byte [rax + rdx], 0
jmp 0x1800329fc
mov rcx, rdx
sub rcx, r8
mov qword [rbp + 0x1580], rcx
mov r9, qword [rbp + 0x78]
mov rax, r9
sub rax, r8
cmp rcx, rax
ja 0x1800329e4
mov qword [rbp + 0x70], rdx
lea rax, [rbp + 0x60]
cmp r9, 0xf
cmova rax, qword [rbp + 0x60]
add rax, r8
mov qword [rbp + 0x118], rax
mov r8, rcx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x1580]
mov byte [rcx + rax], 0
jmp 0x1800329fc
mov byte [rsp + 0x20], 0
mov r9, rcx
movzx r8d, r12b
mov rdx, rcx
lea rcx, [rbp + 0x60]
call fcn.18000df40
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r9, qword [rbp + 0x60]
mov dword [rsp + 0x20], edi
mov r8d, dword [rbp + 0x20]
mov rdx, qword [rbp + 0xa0]
mov ecx, dword [rbp + 0x10]
call fcn.1800cb198
mov qword [rbp + 0x20], rax
shr rax, 0x20
test eax, eax
jne 0x18003475d
mov edi, dword [rbp + 4]
and edi, 0xffffffbf
or edi, 0x38
mov dword [rbp + 8], edi
mov qword [rbp + 0x20], 0xa
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1554], 0xffffffff
mov dword [rbp + 0x1d4], eax
mov edx, 1
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1d4], eax
inc rdx
cmp rdx, 0x270
jb 0x180032a60
mov dword [rbp + 0x1d0], 0x270
xorps xmm0, xmm0
movups xmmword [rbp + 0x1560], xmm0
xor r10d, r10d
mov ebx, r10d
mov qword [rbp + 0x1570], rbx
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x1578], r15
mov byte [rbp + 0x1560], bl
bts edi, 7
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
mov r13, qword [rbp + 0x20]
dec r13
mov rdi, qword [section..data]
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x20], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 0x20]
call fcn.18001ade0
movzx r9d, byte [rdi + rax]
cmp rbx, r15
jae 0x180032b1a
lea rax, [rbx + 1]
mov qword [rbp + 0x1570], rax
lea rax, [rbp + 0x1560]
cmp r15, 0xf
cmova rax, qword [rbp + 0x1560]
mov byte [rax + rbx], r9b
mov byte [rax + rbx + 1], 0
jmp 0x180032b2f
movzx r8d, sil
mov edx, 1
lea rcx, [rbp + 0x1560]
call fcn.18000d3f0
test r13, r13
je 0x180032b44
mov rbx, qword [rbp + 0x1570]
mov r15, qword [rbp + 0x1578]
jmp 0x180032ac4
lea rdx, [rbp + 0x1560]
cmp qword [rbp + 0x1578], 0xf
cmova rdx, qword [rbp + 0x1560]
mov r8, qword [rbp + 0x1570]
lea rcx, [rbp + 0x60]
call fcn.180009e20
lea rcx, [rbp + 0x1a0]
cmp rcx, rax
movzx ebx, byte [rbp]
movzx r15d, byte [rbp]
movzx r13d, byte [rbp]
je 0x180032ba2
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x180032b93
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.18000c240
mov edi, dword [rbp + 4]
btr edi, 7
mov rdx, qword [rbp + 0x1578]
cmp rdx, 0xf
jbe 0x180032beb
inc rdx
mov rcx, qword [rbp + 0x1560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032be5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180032da1
call fcn.1800cbd7c
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x180032c26
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032c21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180032da8
call fcn.1800cbd7c
xor eax, eax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], al
and edi, 0xfffffffd
mov dword [rbp + 4], edi
mov dword [rbp + 8], edi
lea rcx, [rbp + 0xd8]
call fcn.18001b9c0
mov rdi, qword [0x1802290f8]
cmp rdi, qword [0x180229100]
je 0x180032caf
mov qword [rbp + 0x20], rdi
lea rdx, [rbp + 0x180]
mov rcx, rdi
call fcn.18000a270
nop
lea rcx, [rdi + 0x20]
lea rdx, [rbp + 0x1a0]
call fcn.18000a270
nop
mov rax, qword [rbp + 0x1c0]
mov qword [rdi + 0x40], rax
mov rcx, qword [rbp + 0x1c0]
test rcx, rcx
je 0x180032ca5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbp + 0x1c0]
add qword [0x1802290f8], 0x48
jmp 0x180032ccc
lea r8, [rbp + 0x180]
mov rdx, rdi
lea rcx, [0x1802290f0]
call fcn.18001dbc0
mov rcx, qword [rbp + 0x1c0]
test rcx, rcx
je 0x180032ce6
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor edi, edi
test al, al
je 0x180032ce8
mov qword [rbp + 0x1c0], rdi
jmp 0x180032ce8
xor edi, edi
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x180032d29
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180032daf
call fcn.1800cbd7c
mov qword [rbp + 0x1b0], rdi
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x180032d7f
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032d7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180032daf
call fcn.1800cbd7c
mov eax, dword [rbp + 0xd0]
inc eax
mov dword [rbp + 0xd0], eax
cmp eax, 0x32
jg 0x180032db6
mov edi, dword [rbp + 4]
jmp 0x180032410
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movdqa xmm0, xmmword [0x180198c80]
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0x303d702f
mov dword [rbp + 0x54], 0x74c0412
mov dword [rbp + 0x58], 0x1000908
lea rdx, [rbp + 0x1560]
lea rcx, [rbp + 0x40]
call fcn.1800215d0
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.180020930
mov r8, qword [rax]
movdqa xmm0, xmmword [0x180198c80]
movdqu xmmword [rbp + 0xb0], xmm0
mov dword [rbp + 0xc0], 0x303d702f
mov dword [rbp + 0xc4], 0x74c0412
mov dword [rbp + 0xc8], 0x1000908
xor r14d, r14d
mov ecx, r14d
nop
lea eax, [rcx + 0x4c]
xor byte [rbp + rcx + 0xb0], al
inc rcx
cmp rcx, 0x1a
jb 0x180032e30
mov byte [rbp + 0xcb], r14b
lea rdx, [rbp + 0xb0]
lea rcx, [rbp]
call fcn.180025d20
movdqa xmm0, xmmword [0x180198de0]
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x180198dd0]
movdqu xmmword [rbp + 0x70], xmm1
mov dword [rbp + 0x80], 0x5f574d5a
mov word [rbp + 0x84], 0x100
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx + 0x4c]
xor byte [rbp + rcx + 0x60], al
inc rcx
cmp rcx, 0x24
jb 0x180032e90
mov byte [rbp + 0x85], r14b
movdqa xmm0, xmmword [0x180198c80]
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0x303d702f
mov dword [rbp + 0x54], 0x74c0412
mov dword [rbp + 0x58], 0x1000908
mov rcx, r14
nop dword [rax]
lea eax, [rcx + 0x4c]
xor byte [rbp + rcx + 0x40], al
inc rcx
cmp rcx, 0x1a
jb 0x180032ed0
mov byte [rbp + 0x5b], r14b
lea r9, [rbp]
lea r8, [rbp + 0x5a]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1560]
call fcn.180012660
nop
mov rsi, qword [0x18022bf28]
mov rdi, qword [rsi + 8]
mov qword [rbp + 0x160], rdi
mov dword [rbp + 0x168], r14d
mov rbx, rsi
cmp byte [rdi + 0x19], 0
jne 0x180032f5e
nop
mov qword [rbp + 0x160], rdi
lea rcx, [rdi + 0x20]
lea rdx, [rbp + 0x1560]
call fcn.18001bc10
test al, al
jns 0x180032f48
mov dword [rbp + 0x168], r14d
mov rdi, qword [rdi + 0x10]
jmp 0x180032f58
mov dword [rbp + 0x168], 1
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x180032f20
cmp byte [rbx + 0x19], 0
jne 0x180032f7c
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x1560]
call fcn.18001bc10
test al, al
jns 0x180033041
movabs rax, 0x38e38e38e38e38e
cmp qword [0x18022bf30], rax
je 0x18003477d
lea rbx, [0x18022bf28]
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], r14
mov edx, 1
mov rcx, rbx
call fcn.18002f580
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], r14
mov qword [rax + 0x38], r14
movups xmm0, xmmword [rbp + 0x1560]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x1570]
movups xmmword [rax + 0x30], xmm1
mov qword [rbp + 0x1570], r14
mov qword [rbp + 0x1578], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1560], 0
mov qword [rax + 0x40], r14
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
mov qword [rbp + 0x128], r14
lea rcx, [rbp + 0x120]
call fcn.180020ce0
movups xmm0, xmmword [rbp + 0x160]
movaps xmmword [rbp + 0xb0], xmm0
mov r8, rdi
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call fcn.1800153d0
mov rbx, rax
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x18003310e
movsxd rax, dword [rbx + 0x3c]
mov edi, dword [rax + rbx + 0x50]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], rax
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x160]
lea rcx, [0x18022c8d8]
call fcn.1800216c0
mov r9, qword [rbp + 0x168]
mov r10, qword [rbp + 0x160]
sub r9, r10
sar r9, 2
inc dword [0x18022c6d0]
mov r11d, edi
sub r11, r9
je 0x180033102
mov edx, r14d
mov r8d, r14d
test r9, r9
je 0x1800330de
nop
mov rax, r14
nop dword [rax]
nop word [rax + rax]
mov edi, dword [r10 + rax*4]
lea eax, [rdx + r8]
movzx eax, byte [rax + rbx]
cmp eax, edi
je 0x1800330d5
cmp edi, 0xffffffff
jne 0x1800330f2
inc edx
mov eax, edx
cmp rax, r9
jb 0x1800330c0
mov edi, r8d
add rdi, rbx
lea rcx, [rbp + 0x160]
call fcn.18000ff90
jmp 0x180033111
inc r8d
mov eax, r8d
cmp rax, r11
jae 0x180033102
mov edx, r14d
jmp 0x1800330b0
lea rcx, [rbp + 0x160]
call fcn.18000ff90
mov rdi, r14
lea rcx, [rbp + 0x1560]
call fcn.180009f50
movsxd rcx, dword [rdi + 3]
add rcx, 7
add rcx, rdi
lea rax, vtable.._AV___Func_impl_no_alloc_V_lambda_1___6____Connect_V_lambda_3___4__DllMain__YAEPEAUHINSTANCE____KPEAX_Z____fwEvent_PEAVResource_fx____QEAA_A_PV_lambda_3___4__DllMain__YAEPEAUHINSTANCE____KPEAX_Z_H_Z__NPEAVResource_fx___std__.0
mov qword [rbp + 0xd8], rax
movzx eax, byte [rbp]
mov byte [rbp + 0xe0], al
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x110], rax
xor r8d, r8d
lea rdx, [rbp + 0xd8]
call fcn.1800268a0
mov rax, qword [0x18022c8f0]
test rax, rax
jne 0x180033226
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r11d, dword [rax + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x180033206
mov edi, dword [r11 + 0x18]
test edi, edi
je 0x180033206
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec edi
lea rax, [r10 + rdi*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov edx, 0x8ee209b5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x180033202
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1800331e0
cmp edx, 0xa299bf6c
je 0x180033408
test edi, edi
jne 0x1800331c0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x18003321c
cmp qword [rax + 0x30], 0
jne 0x180033190
mov rax, r14
mov qword [0x18022c8f0], rax
movabs r15, 0xf8ab7995db9a2285
mov qword [rbp + 0x1560], r15
movabs r12, 0x4f075b8c3a83d906
mov qword [rbp + 0x1568], r12
movabs rsi, 0x4e5576ab26a0f947
mov qword [rbp + 0x1570], rsi
movabs rbx, 0x8d79ccda1f530ed8
mov qword [rbp + 0x1578], rbx
movabs rdi, 0xd5c51cefb2ee4be6
mov qword [rbp + 0x15a0], rdi
movabs rcx, 0x216e2ffc53f1ba75
mov qword [rbp + 0x15a8], rcx
movabs rcx, 0x223158ca53ccd420
mov qword [rbp + 0x15b0], rcx
movabs rcx, 0x8d79ccda1f530eb4
mov qword [rbp + 0x15b8], rcx
movups xmm0, xmmword [rbp + 0x15a0]
movaps xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rbp + 0x15b0]
movaps xmmword [rbp + 0x70], xmm1
vmovdqu ymm0, ymmword [rbp + 0x1560]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rcx, [rbp + 0x60]
vzeroupper
call rax
add rax, 0x99ae0
mov qword [0x18022c6e8], rax
mov qword [rbp + 0x15a0], r15
mov qword [rbp + 0x15a8], r12
mov qword [rbp + 0x15b0], rsi
mov qword [rbp + 0x15b8], rbx
mov qword [rbp + 0x140], rdi
movabs rax, 0x2e6929e943e2b576
mov qword [rbp + 0x148], rax
movabs rax, 0x2b231fcd0bd39c2a
mov qword [rbp + 0x150], rax
movabs rax, 0x8d79ccda733f6af6
mov qword [rbp + 0x158], rax
movups xmm0, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0x1560], xmm0
movups xmm1, xmmword [rbp + 0x150]
movaps xmmword [rbp + 0x1570], xmm1
vmovdqu ymm0, ymmword [rbp + 0x15a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1560]
vmovdqa ymmword [rbp + 0x1560], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180033403
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180033403
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0x54aab7ec
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800333fe
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800333e0
cmp edi, 0xf9b83d35
je 0x180033425
test r8d, r8d
jne 0x1800333c0
mov rax, qword [rax]
jmp 0x180033390
mov ecx, dword [r11 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x18003321f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, [rbp + 0x1560]
call rax
add rax, 0x15300
mov qword [0x18022c760], rax
mov byte [0x18022c7c8], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov ebx, dword [rdx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800334f3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800334f3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov edi, 0x372abe96
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1800334ee
nop dword [rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x1800334d0
cmp edi, 0x392391b
je 0x1800334f8
test r8d, r8d
jne 0x1800334b0
mov rcx, qword [rcx]
jmp 0x180033480
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b3095_GTAProcess.exe
call rax
test rax, rax
je 0x1800335f7
lea rax, [rsi + 0x79bb34]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x2593320]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x20019e0]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x1f58b58]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x20025b8]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x1624f80]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x1098
mov dword [0x18022c790], 0x150c
mov dword [0x18022c79c], 0xd10
mov dword [0x18022c798], 0x10b8
mov dword [0x18022c7a0], 0x10c8
mov dword [0x18022c7a4], 0x2f4
mov dword [0x18022c7a8], 0x84
mov dword [0x18022c7bc], 0x134
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5f0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180033683
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180033683
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xe295712b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003367e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180033660
cmp edi, 0x893f8c0e
je 0x180033688
test r8d, r8d
jne 0x180033640
mov rax, qword [rax]
jmp 0x180033610
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2802_GTAProcess.exe
call rax
test rax, rax
je 0x18003378e
lea rax, [rsi + 0x794784]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x254d448]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x1fbc100]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x1f5b820]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x1fbccd8]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x15ea2a5]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x1098
mov dword [0x18022c790], 0x150c
mov dword [0x18022c79c], 0xd10
mov dword [0x18022c798], 0x10b8
mov dword [0x18022c7a0], 0x10a8
mov dword [0x18022c7a4], 0x2f4
mov dword [0x18022c7a8], 0x84
mov dword [0x18022c7bc], 0x134
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5f0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x28c
mov byte [0x18022c7c8], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180033813
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180033813
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0x491e14f4
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003380e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800337f0
cmp edi, 0x7ed0a27d
je 0x180033818
test r8d, r8d
jne 0x1800337d0
mov rax, qword [rax]
jmp 0x1800337a0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2944_GTAProcess.exe
call rax
test rax, rax
je 0x18003391e
lea rax, [rsi + 0x795f9c]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x257bea0]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x1feaac0]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x1f42068]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x1feb968]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x160ff90]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x1098
mov dword [0x18022c790], 0x150c
mov dword [0x18022c79c], 0xd10
mov dword [0x18022c798], 0x10b8
mov dword [0x18022c7a0], 0x10a8
mov dword [0x18022c7a4], 0x2f4
mov dword [0x18022c7a8], 0x84
mov dword [0x18022c7bc], 0x134
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5f0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x28c
mov byte [0x18022c7c8], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800339a3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800339a3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0x92caf8e9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003399e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180033980
cmp edi, 0xd8efed98
je 0x1800339a8
test r8d, r8d
jne 0x180033960
mov rax, qword [rax]
jmp 0x180033930
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2699_GTAProcess.exe
call rax
test rax, rax
je 0x180033aa7
lea rax, [rsi + 0x78f450]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x26684d8]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x20d8c90]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x20304c8]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x20d9868]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x15d6cec]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x10b8
mov dword [0x18022c790], 0x1530
mov dword [0x18022c79c], 0xd30
mov dword [0x18022c798], 0x10d8
mov dword [0x18022c7a0], 0x10c8
mov dword [0x18022c7a4], 0x2f4
mov dword [0x18022c7a8], 0x84
mov dword [0x18022c7bc], 0x134
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5f0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180033b33
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180033b33
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0x33145418
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180033b2e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180033b10
cmp edi, 0x81435c19
je 0x180033b38
test r8d, r8d
jne 0x180033af0
mov rax, qword [rax]
jmp 0x180033ac0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2612_GTAProcess.exe
call rax
test rax, rax
je 0x180033c37
lea rax, [rsi + 0x78c758]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x2567db0]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x1fd8570]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x1f77ef0]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x1fd9148]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x15dfe20]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x10b8
mov dword [0x18022c790], 0x1530
mov dword [0x18022c79c], 0xd30
mov dword [0x18022c798], 0x10d8
mov dword [0x18022c7a0], 0x10c8
mov dword [0x18022c7a4], 0x2f4
mov dword [0x18022c7a8], 0x84
mov dword [0x18022c7bc], 0x134
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5f0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180033cc3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180033cc3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0xdf61b716
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180033cbe
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180033ca0
cmp edi, 0xf938519b
je 0x180033cc8
test r8d, r8d
jne 0x180033c80
mov rax, qword [rax]
jmp 0x180033c50
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2545_GTAProcess.exe
call rax
test rax, rax
je 0x180033dc7
lea rax, [rsi + 0x78c5e4]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x25667e8]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x1fd6f70]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x1f2e7a8]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x1fd7b48]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x15deeb0]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x10b8
mov dword [0x18022c790], 0x1530
mov dword [0x18022c79c], 0xd30
mov dword [0x18022c798], 0x10d8
mov dword [0x18022c7a0], 0x10c8
mov dword [0x18022c7a4], 0x2f4
mov dword [0x18022c7a8], 0x84
mov dword [0x18022c7bc], 0x134
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5f0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180033e53
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180033e53
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0xeb313fc8
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180033e4e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180033e30
cmp edi, 0x7e8c2089
je 0x180033e58
test r8d, r8d
jne 0x180033e10
mov rax, qword [rax]
jmp 0x180033de0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2372_GTAProcess.exe
call rax
test rax, rax
je 0x180033f57
lea rax, [rsi + 0x787fe4]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x252dcd8]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x1f9e9f0]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x1f05208]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x1f9f5c8]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x15cd2c0]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x10b8
mov dword [0x18022c790], 0x14e0
mov dword [0x18022c79c], 0xd30
mov dword [0x18022c798], 0x10d8
mov dword [0x18022c7a0], 0x10c8
mov dword [0x18022c7a4], 0x2f4
mov dword [0x18022c7a8], 0x84
mov dword [0x18022c7bc], 0x134
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5f0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180033fe3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180033fe3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xdaed417a
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180033fde
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180033fc0
cmp edi, 0x779cb8e7
je 0x180033fe8
test r8d, r8d
jne 0x180033fa0
mov rax, qword [rax]
jmp 0x180033f70
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2189_GTAProcess.exe
call rax
test rax, rax
je 0x1800340f1
lea rax, [rsi + 0x79b5dc]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x24e6d90]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x1f888c0]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x1ee18a8]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x1f89498]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x15b1008]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x10b8
mov dword [0x18022c790], 0x14e0
mov dword [0x18022c79c], 0xd30
mov dword [0x18022c798], 0x10d8
mov dword [0x18022c7a0], 0x10c8
mov dword [0x18022c7a4], 0x2f4
mov dword [0x18022c7a8], 0x84
mov dword [0x18022c7bc], 0x134
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7c4], 0x908
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5f0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180034183
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180034183
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xadce41b3
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003417e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180034160
cmp edi, 0xf99e3d16
je 0x180034188
test r8d, r8d
jne 0x180034140
mov rax, qword [rax]
jmp 0x180034110
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2060_GTAProcess.exe
call rax
test rax, rax
je 0x180034287
lea rax, [rsi + 0x7935d0]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x24c8858]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x1f6a7e0]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x1ec3828]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x1f6b3c0]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x159b224]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x10b8
mov dword [0x18022c790], 0x14e0
mov dword [0x18022c79c], 0xd30
mov dword [0x18022c798], 0x10d8
mov dword [0x18022c7a0], 0x10c8
mov dword [0x18022c7a4], 0x2f4
mov dword [0x18022c7a8], 0x84
mov dword [0x18022c7bc], 0x134
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5f0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180034313
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180034313
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xcc85981b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18003430e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800342f0
cmp edi, 0xef36f23e
je 0x180034318
test r8d, r8d
jne 0x1800342d0
mov rax, qword [rax]
jmp 0x1800342a0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_GTAProcess.exe
call rax
test rax, rax
je 0x180034420
lea rax, [rsi + 0x779d64]
mov qword [0x18022c778], rax
lea rax, [rsi + 0x247f840]
mov qword [0x18022c768], rax
lea rax, [rsi + 0x2087780]
mov qword [0x18022c788], rax
lea rax, [rsi + 0x1efd4c8]
mov qword [0x18022c770], rax
lea rax, [rsi + 0x20d9868]
mov qword [0x18022c780], rax
lea rax, [rsi + 0x1561e30]
mov qword [0x18022c7d0], rax
mov dword [0x18022c794], 0x10a8
mov dword [0x18022c790], 0x14b8
mov dword [0x18022c79c], 0xd30
mov dword [0x18022c798], 0x10c8
mov dword [0x18022c7a0], 0x10b8
mov dword [0x18022c7a4], 0x2e8
mov dword [0x18022c7a8], 0x74
mov dword [0x18022c7bc], 0x12c
mov dword [0x18022c7ac], 0x20
mov dword [0x18022c7b4], 0x24
mov dword [0x18022c7b0], 0x5e0
mov dword [0x18022c7c0], 0x146b
mov dword [0x18022c7b8], 0x25c
nop word [rax + rax]
mov qword [rbp + 0x15c0], r15
mov qword [rbp + 0x15c8], r12
movabs rax, 0x93c416dd88c976d7
mov qword [rbp + 0x130], rax
movabs rax, 0x4f6b37e814b7ef75
mov qword [rbp + 0x138], rax
movaps xmm0, xmmword [rbp + 0x130]
xorps xmm0, xmmword [rbp + 0x15c0]
movdqa xmmword [rbp + 0x15c0], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800344f3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800344f3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov ecx, dword [rcx + r9]
add rcx, r9
mov edi, 0xa785dbd1
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800344ee
nop dword [rax]
movsx edx, dl
xor edx, edi
imul edi, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1800344d0
cmp edi, 0x9b3c7fc0
je 0x1800344f8
test r8d, r8d
jne 0x1800344b0
mov rax, qword [rax]
jmp 0x180034480
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, [rbp + 0x15c0]
call rax
test rax, rax
je 0x180034648
mov rax, qword [0x18022c8e8]
test rax, rax
jne 0x1800345e2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax + rax]
mov r8, qword [rbx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r11d, dword [rax + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x1800345c2
mov edi, dword [r11 + 0x18]
test edi, edi
je 0x1800345c2
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec edi
lea rax, [r10 + rdi*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov edx, 0xac723413
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1800345be
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1800345a0
cmp edx, 0xeca527c0
je 0x18003462e
test edi, edi
jne 0x180034580
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x1800345d8
cmp qword [rax + 0x30], 0
jne 0x180034550
mov rax, r14
mov qword [0x18022c8e8], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x18002ca70]
xor edx, edx
xor ecx, ecx
call rax
mov al, 1
mov rcx, qword [rbp + 0x15d0]
xor rcx, rsp
call fcn.1800cbe10
lea r11, [rsp + 0x1630]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x1800345db
movdqa xmm1, xmmword [0x180198bc0]
movdqu xmmword [rbp + 0x160], xmm1
mov dl, 0x55
mov dil, 0x7c
mov r8b, 0x66
mov r9b, 0x7d
mov r10b, 0x77
mov r11b, reloc.WLDAP32.dll_Ordinal_50
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp + 0x161], al
xor byte [rbp + 0x162], cl
xor byte [rbp + 0x163], cl
xor byte [rbp + 0x164], cl
xor byte [rbp + 0x165], cl
xor byte [rbp + 0x166], cl
xor byte [rbp + 0x167], cl
xor byte [rbp + 0x168], cl
xor byte [rbp + 0x169], cl
xor byte [rbp + 0x16a], cl
xor byte [rbp + 0x16b], cl
xor byte [rbp + 0x16c], cl
xor byte [rbp + 0x16d], cl
xor byte [rbp + 0x16e], cl
xor byte [rbp + 0x16f], cl
xor dl, cl
mov byte [rbp + 0x170], dl
xor dil, cl
mov byte [rbp + 0x171], dil
xor r8b, cl
mov byte [rbp + 0x172], r8b
xor r9b, cl
mov byte [rbp + 0x173], r9b
xor r10b, cl
mov byte [rbp + 0x174], r10b
xor r11b, cl
mov byte [rbp + 0x175], r11b
mov byte [rbp + 0x176], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, [rbp + 0x161]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0x20]
lea rcx, str.temp_directory_path
call fcn.18002f390
nop
mov ecx, dword [rbp + 0x24]
call fcn.18002f500
int3
mov ecx, dword [rbp + 0x1584]
call fcn.18002f500
int3
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.18002f4c0
nop
call fcn.180002bd0
int3