Function at 0x1800675f0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate threads
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x18010f070]
xor rax, rsp
mov qword [rbp + 0xc8], rax
cmp edx, 1
jne 0x180068dd6
lea rcx, [rbp + 8]
call fcn.180052960
mov rbx, rax
lea rdi, [0x18011dee0]
xor r14d, r14d
cmp rdi, rax
je 0x1800676c4
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180067689
mov rcx, qword [0x18011dee0]
inc rdx
cmp rdx, 0x1000
jb 0x180067684
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800676f6
mov rcx, r8
call fcn.1800d5f5c
movdqa xmm0, xmmword [0x1800fab50]
movdqu xmmword [0x18011def0], xmm0
mov byte [0x18011dee0], r14b
movups xmm0, xmmword [rbx]
movups xmmword [0x18011dee0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x18011def0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r14b
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x180067702
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800676fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800676fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d5f5c
lea rcx, [rbp + 8]
call fcn.180052c20
mov rbx, rax
lea r15, [0x18011df60]
cmp r15, rax
je 0x180067792
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180067757
mov rcx, qword [0x18011df60]
inc rdx
cmp rdx, 0x1000
jb 0x180067752
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800677c4
mov rcx, r8
call fcn.1800d5f5c
movdqa xmm0, xmmword [0x1800fab50]
movdqu xmmword [0x18011df70], xmm0
mov byte [0x18011df60], r14b
movups xmm0, xmmword [rbx]
movups xmmword [0x18011df60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x18011df70], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r14b
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x1800677d0
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800677cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800677cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d5f5c
lea rcx, [rbp + 8]
call fcn.180053720
mov rbx, rax
lea r12, [0x18011df00]
cmp r12, rax
je 0x180067860
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x180067825
mov rcx, qword [0x18011df00]
inc rdx
cmp rdx, 0x1000
jb 0x180067820
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180067892
mov rcx, r8
call fcn.1800d5f5c
movdqa xmm0, xmmword [0x1800fab50]
movdqu xmmword [0x18011df10], xmm0
mov byte [0x18011df00], r14b
movups xmm0, xmmword [rbx]
movups xmmword [0x18011df00], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x18011df10], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r14b
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x18006789f
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180067899
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180067899
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d5f5c
nop
mov byte [rbp + 0x50], 0
xor edx, edx
lea rcx, [rbp + 0x58]
call fcn.18006dfa0
lea rcx, [rbp + 0x50]
call fcn.18006d1c0
lea rcx, [rbp + 0x50]
call fcn.18006d1c0
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 0x111b1d00
mov dword [rsp + 0x34], 0x100161e
mov rcx, r14
nop
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 6
jb 0x1800678e0
mov byte [rsp + 0x37], 0
mov byte [rsp + 0x40], 0
xor eax, eax
mov qword [rsp + 0x48], rax
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.18006ca80
mov byte [rsp + 0x40], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1800d654c
mov rbx, rax
lea rax, [rbp + 0x48]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rbx
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180067950
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18006d420
nop
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x40]
call fcn.18006d1c0
lea rcx, [rsp + 0x40]
call fcn.18006d1c0
nop
mov dword [rsp + 0x68], 0x1e01111e
mov dword [rsp + 0x6c], 0x1001c18
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 6
jb 0x1800679a0
mov byte [rsp + 0x6f], 0
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x50]
call fcn.18006f550
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.18006d1c0
movzx ecx, byte [rbx]
movzx eax, byte [rsp + 0x40]
mov byte [rbx], al
mov byte [rsp + 0x40], cl
mov rax, qword [rbx + 8]
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 8], rcx
mov qword [rsp + 0x48], rax
mov rcx, rbx
call fcn.18006d1c0
nop
lea rcx, [rsp + 0x40]
call fcn.18006d1c0
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.18006ca80
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.18006f850
mov rsi, rax
mov dword [rsp + 0x30], 0x19131a1a
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180067a40
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.18006f550
mov r8, rax
mov dword [rsp + 0x30], 0x121c0106
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180067a80
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
mov rcx, r8
call fcn.18006f550
mov rdi, rax
mov rcx, rsi
call fcn.18006d1c0
movzx ecx, byte [rdi]
movzx eax, byte [rsi]
mov byte [rdi], al
mov byte [rsi], cl
mov rax, qword [rdi + 8]
mov r8, qword [rsi + 8]
mov qword [rdi + 8], r8
mov qword [rsi + 8], rax
mov rcx, rdi
call fcn.18006d1c0
nop
mov rcx, rsi
call fcn.18006d1c0
movzx edx, byte [rsi]
lea rcx, [rsi + 8]
call fcn.18006ca80
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.18006f850
mov rsi, rax
mov dword [rsp + 0x30], 0x19131a1a
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180067b20
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.18006f550
mov r8, rax
mov dword [rsp + 0x30], 0x40101e
mov byte [rsp + 0x34], 1
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 3
jb 0x180067b60
mov byte [rsp + 0x34], 0
lea rdx, [rsp + 0x30]
mov rcx, r8
call fcn.18006f550
mov rdi, rax
mov rcx, rsi
call fcn.18006d1c0
movzx ecx, byte [rdi]
movzx eax, byte [rsi]
mov byte [rdi], al
mov byte [rsi], cl
mov rax, qword [rdi + 8]
mov r8, qword [rsi + 8]
mov qword [rdi + 8], r8
mov qword [rsi + 8], rax
mov rcx, rdi
call fcn.18006d1c0
nop
mov rcx, rsi
call fcn.18006d1c0
movzx edx, byte [rsi]
lea rcx, [rsi + 8]
call fcn.18006ca80
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.18006f850
mov rsi, rax
mov dword [rsp + 0x30], 0x19131a1a
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180067c00
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.18006f550
mov r8, rax
mov dword [rsp + 0x30], 0x13111505
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180067c40
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
mov rcx, r8
call fcn.18006f550
mov rdi, rax
mov rcx, rsi
call fcn.18006d1c0
movzx ecx, byte [rdi]
movzx eax, byte [rsi]
mov byte [rdi], al
mov byte [rsi], cl
mov rax, qword [rdi + 8]
mov rdx, qword [rsi + 8]
mov qword [rdi + 8], rdx
mov qword [rsi + 8], rax
mov rcx, rdi
call fcn.18006d1c0
nop
mov rcx, rsi
call fcn.18006d1c0
movzx edx, byte [rsi]
lea rcx, [rsi + 8]
call fcn.18006ca80
nop
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.18006a6c0
mov r8, rax
movdqa xmm0, xmmword [0x1800fb270]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xf5e7e1f4
mov dword [rbp + 0x3c], 0xa5ecfcee
mov word [rbp + 0x40], 0x100
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rbp + rcx + 0x28], al
inc rcx
cmp rcx, 0x18
jb 0x180067ce0
mov byte [rbp + 0x41], 0
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xa8]
call fcn.180051080
nop
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x60]
call fcn.18006b510
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.18004dab0
mov rbx, rax
lea rax, [rbp + 0xa8]
cmp rax, rbx
je 0x180067da8
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x180067d6d
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180067d68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067dda
call fcn.1800d5f5c
movdqa xmm0, xmmword [0x1800fab50]
movdqu xmmword [rbp + 0xb8], xmm0
mov byte [rbp + 0xa8], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x180067de6
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180067de1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180067de1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d5f5c
mov qword [rbp], r14
lea rax, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0x10
cmovae rax, qword [rbp + 0xa8]
mov qword [rsp + 0x68], rax
lea r8, [rbp - 0x38]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x98]
call fcn.18006f420
nop
mov dword [rsp + 0x40], 0x22342020
mov dword [rsp + 0x44], 0x29262b22
mov dword [rsp + 0x48], 0x3b3e3f2e
mov dword [rsp + 0x4c], 0x100d32c
mov rcx, r14
nop
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xe
jb 0x180067e40
mov byte [rsp + 0x4f], 0
mov dword [rsp + 0x30], 0x13111b10
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180067e70
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x98]
call fcn.18006f550
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.18006f910
test al, al
je 0x180068db3
mov dword [rsp + 0x30], 0x19131a1a
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180067ec0
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x98]
call fcn.18006f550
mov r8, rax
mov dword [rsp + 0x30], 0x13031d15
mov word [rsp + 0x34], reloc.WLDAP32.dll_Ordinal_26
mov byte [rsp + 0x36], 1
mov rcx, r14
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x180067f00
mov byte [rsp + 0x36], 0
lea rdx, [rsp + 0x30]
mov rcx, r8
call fcn.18006f550
cmp byte [rax], 3
jne 0x180068e54
mov rdx, qword [rax + 8]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180067f3d
mov rdx, qword [rdx]
lea rcx, [0x18011df40]
call fcn.18006d420
mov dword [rsp + 0x30], 0x19131a1a
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180067f60
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x98]
call fcn.18006f550
mov r8, rax
mov dword [rsp + 0x40], 0x13031d15
mov dword [rsp + 0x44], 0x130d271a
mov dword [rsp + 0x48], 0x1001916
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x180067fb0
mov byte [rsp + 0x4b], 0
lea rdx, [rsp + 0x40]
mov rcx, r8
call fcn.18006f550
cmp byte [rax], 3
jne 0x180068e9f
mov rdx, qword [rax + 8]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180067fed
mov rdx, qword [rdx]
lea rcx, [0x18011dea0]
call fcn.18006d420
mov dword [rsp + 0x30], 0x19131a1a
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x180068010
mov byte [rsp + 0x35], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x98]
call fcn.18006f550
mov r8, rax
mov dword [rsp + 0x40], 0x13031d15
mov dword [rsp + 0x44], 0xe0a271a
mov dword [rsp + 0x48], 0xd08081a
mov word [rsp + 0x4c], 0x100
mov rcx, r14
nop dword [rax + rax]
lea eax, [rcx + 0x73]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180068060
mov byte [rsp + 0x4d], 0
lea rdx, [rsp + 0x40]
mov rcx, r8
call fcn.18006f550
mov rcx, rax
cmp byte [rax], 3
jne 0x180068e0b
call fcn.180081a50
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180081a30
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
lea rcx, [0x18011de80]
call fcn.18006d420
mov dword [rsp + 0x30], 0x1000908
lea rcx, [rsp + 0x30]
call fcn.180053c60
mov rdx, rax
call fcn.18006f3c0
test al, al
je 0x180068db3
movzx eax, byte [0x1800eb890]
xor al, 0x73
mov byte [rsp + 0x30], al
mov word [rsp + 0x31], 0x100
lea rcx, [rsp + 0x30]
call fcn.180050760
mov rdx, rax
lea rcx, [0x18011de80]
call fcn.18006eeb0
test al, al
jne 0x18006813e
movzx eax, byte [0x1800eb898]
xor al, 0x73
mov byte [rsp + 0x30], al
mov word [rsp + 0x31], 0x100
lea rcx, [rsp + 0x30]
call fcn.180050760
mov rdx, rax
lea rcx, [0x18011de80]
call fcn.18006eeb0
test al, al
je 0x180068db3
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18006817c
lea rcx, [rbp + 0x98]
call fcn.18006a690
nop
lea rcx, [rbp + 0xa8]
call fcn.18004d4e0
nop
lea rcx, [rbp + 0x50]
call fcn.18006a690
xor eax, eax
jmp 0x180068ddb
mov dword [rbp + 8], Ordinal_30
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18006825a
mov dword [rsp + 0x58], 0x581e071c
mov dword [rsp + 0x5c], 0x1c0012
mov byte [rsp + 0x60], 1
lea rcx, [rsp + 0x58]
call fcn.1800514d0
mov rcx, rax
call fcn.18004dd50
mov rdi, rax
mov eax, dword [rbp + 0x14]
cmp rax, rdi
jne 0x180068245
mov r8d, dword [rbp + 0x10]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov rcx, rax
call fcn.180066c20
mov r8d, eax
mov edx, edi
lea rcx, [rbp + 0x28]
call fcn.180066b30
mov dword [rsp + 0x40], 0x5171507
mov dword [rsp + 0x44], 0x1e571a1c
mov dword [rsp + 0x48], 0x1001017
lea rcx, [rsp + 0x40]
call fcn.1800661a0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.18006b1d0
cmp rax, 0xffffffffffffffff
je 0x180068233
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x28]
call fcn.18004d4e0
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1800681c2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x18011f250], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x18011f03c], eax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180066a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x1800fb5d0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xabaaad
mov byte [rsp + 0x54], 1
lea rcx, [rsp + 0x40]
call fcn.180053cc0
mov rdx, rax
lea rcx, [0x18011dec0]
call fcn.18006b3f0
lea rbx, str.FiveM_GTAProcess.exe
lea rdi, str.FiveM_b2060_GTAProcess.exe
lea rsi, str.FiveM_b2189_GTAProcess.exe
lea r15, str.FiveM_b2372_GTAProcess.exe
lea r12, str.FiveM_b2545_GTAProcess.exe
lea r13, str.FiveM_b2612_GTAProcess.exe
lea r14, str.FiveM_b2699_GTAProcess.exe
nop word [rax + rax]
movdqa xmm0, xmmword [0x1800fb890]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3fde1ad
mov word [rbp + 0x3c], 0x100
lea rcx, [rbp + 0x28]
call fcn.1800660e0
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x1800683d5
mov qword [0x18011f260], rbx
mov dword [0x18011f290], 0x247f840
mov dword [0x18011f284], 0x1efd4c8
mov dword [0x18011f29c], 0x2087780
mov dword [0x18011f2a0], 0xd28
mov dword [0x18011f2a8], 0x918
mov dword [0x18011f298], 0x10b8
mov dword [0x18011f2a4], 0x60
mov dword [0x18011f2ac], 0x14b8
mov dword [0x18011f2b0], 0x10a8
mov dword [0x18011f28c], 0x10c8
mov dword [rsp + 0x58], 0x21160614
mov dword [rsp + 0x5c], 0x151d161e
mov word [rsp + 0x60], recvfrom
mov byte [rsp + 0x62], 1
lea rcx, [rsp + 0x58]
jmp 0x180068a7b
movdqa xmm0, xmmword [0x1800fb450]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3e6ebf1
mov dword [rbp + 0x3c], 0xefa7fbf4
mov dword [rbp + 0x40], 0x100e9f3
lea rcx, [rbp + 0x28]
call fcn.180066140
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x1800684a2
mov qword [0x18011f260], rdi
mov dword [0x18011f290], 0x24c8858
mov dword [0x18011f284], 0x1ec3828
mov dword [0x18011f29c], 0x1f6a7e0
mov dword [0x18011f2a0], 0xd30
mov dword [0x18011f2a8], 0x938
mov dword [0x18011f298], 0x10c8
mov dword [0x18011f2a4], 0x78
mov dword [0x18011f2ac], 0x14e0
mov dword [0x18011f2b0], 0x10b8
mov dword [0x18011f28c], 0x10d8
mov dword [rsp + 0x68], 0x21160614
mov dword [rsp + 0x6c], 0x151d161e
mov word [rsp + 0x70], recvfrom
mov byte [rsp + 0x72], 1
lea rcx, [rsp + 0x68]
jmp 0x180068a7b
movdqa xmm0, xmmword [0x1800fb400]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3e6ebf1
mov dword [rbp + 0x3c], 0xefa7fbf4
mov dword [rbp + 0x40], 0x100e9f3
lea rcx, [rbp + 0x28]
call fcn.180066140
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x18006856f
mov qword [0x18011f260], rsi
mov dword [0x18011f290], 0x24e6d90
mov dword [0x18011f284], 0x1ee18a8
mov dword [0x18011f29c], 0x1f888c0
mov dword [0x18011f2a0], 0xd30
mov dword [0x18011f2a8], 0x938
mov dword [0x18011f298], 0x10c8
mov dword [0x18011f2a4], 0x78
mov dword [0x18011f2ac], 0x14e0
mov dword [0x18011f2b0], 0x10b8
mov dword [0x18011f28c], 0x10d8
mov dword [rsp + 0x30], 0x21160614
mov dword [rsp + 0x34], 0x151d161e
mov word [rsp + 0x38], recvfrom
mov byte [rsp + 0x3a], 1
lea rcx, [rsp + 0x30]
jmp 0x180068a7b
movdqa xmm0, xmmword [0x1800fb460]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3e6ebf1
mov dword [rbp + 0x3c], 0xefa7fbf4
mov dword [rbp + 0x40], 0x100e9f3
lea rcx, [rbp + 0x28]
call fcn.180066140
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x18006863a
mov qword [0x18011f260], r15
mov dword [0x18011f290], 0x252dcd8
mov dword [0x18011f284], 0x1f05208
mov dword [0x18011f29c], 0x1f9e9f0
mov dword [0x18011f2a0], 0xd30
mov dword [0x18011f2a8], 0x938
mov dword [0x18011f298], 0x10c8
mov dword [0x18011f2a4], 0x88
mov dword [0x18011f2ac], 0x14e0
mov dword [0x18011f2b0], 0x10b8
mov dword [0x18011f28c], 0x10d8
mov dword [rsp + 0x78], 0x21160614
mov dword [rsp + 0x7c], 0x151d161e
mov word [rbp - 0x80], recvfrom
mov byte [rbp - 0x7e], 1
lea rcx, [rsp + 0x78]
jmp 0x180068a7b
movdqa xmm0, xmmword [0x1800fb430]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3e6ebf1
mov dword [rbp + 0x3c], 0xefa7fbf4
mov dword [rbp + 0x40], 0x100e9f3
lea rcx, [rbp + 0x28]
call fcn.180066140
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x180068702
mov qword [0x18011f260], r12
mov dword [0x18011f290], 0x25667e8
mov dword [0x18011f284], 0x1f2e7a8
mov dword [0x18011f29c], 0x1fd6f70
mov dword [0x18011f2a0], 0xd30
mov dword [0x18011f2a8], 0x938
mov dword [0x18011f298], 0x10c8
mov dword [0x18011f2a4], 0x88
mov dword [0x18011f2ac], 0x1530
mov dword [0x18011f2b0], 0x10b8
mov dword [0x18011f28c], 0x10d8
mov dword [rbp - 0x78], 0x21160614
mov dword [rbp - 0x74], 0x151d161e
mov word [rbp - 0x70], recvfrom
mov byte [rbp - 0x6e], 1
lea rcx, [rbp - 0x78]
jmp 0x180068a7b
movdqa xmm0, xmmword [0x1800fb480]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3e6ebf1
mov dword [rbp + 0x3c], 0xefa7fbf4
mov dword [rbp + 0x40], 0x100e9f3
lea rcx, [rbp + 0x28]
call fcn.180066140
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x1800687ca
mov qword [0x18011f260], r13
mov dword [0x18011f290], 0x2567db0
mov dword [0x18011f284], 0x1f77ef0
mov dword [0x18011f29c], 0x1fd8570
mov dword [0x18011f2a0], 0xd30
mov dword [0x18011f2a8], 0x938
mov dword [0x18011f298], 0x10c8
mov dword [0x18011f2a4], 0x88
mov dword [0x18011f2ac], 0x1530
mov dword [0x18011f2b0], 0x10b8
mov dword [0x18011f28c], 0x10d8
mov dword [rbp - 0x68], 0x21160614
mov dword [rbp - 0x64], 0x151d161e
mov word [rbp - 0x60], recvfrom
mov byte [rbp - 0x5e], 1
lea rcx, [rbp - 0x68]
jmp 0x180068a7b
movdqa xmm0, xmmword [0x1800fb410]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3e6ebf1
mov dword [rbp + 0x3c], 0xefa7fbf4
mov dword [rbp + 0x40], 0x100e9f3
lea rcx, [rbp + 0x28]
call fcn.180066140
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x180068888
mov qword [0x18011f260], r14
mov dword [0x18011f290], 0x26684d8
mov dword [0x18011f284], 0x20304c8
mov dword [0x18011f29c], 0x20d8c90
mov dword [0x18011f2a8], 0x918
mov dword [0x18011f298], 0x10c8
mov dword [0x18011f2a4], 0x88
mov dword [0x18011f2ac], 0x1530
mov dword [0x18011f2b0], 0x10b8
mov dword [0x18011f28c], 0x10d8
mov dword [rbp - 0x58], 0x21160614
mov dword [rbp - 0x54], 0x151d161e
mov word [rbp - 0x50], recvfrom
mov byte [rbp - 0x4e], 1
lea rcx, [rbp - 0x58]
jmp 0x180068a71
movdqa xmm0, xmmword [0x1800fb470]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3e6ebf1
mov dword [rbp + 0x3c], 0xefa7fbf4
mov dword [rbp + 0x40], 0x100e9f3
lea rcx, [rbp + 0x28]
call fcn.180066140
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x18006891a
lea rax, str.FiveM_b2802_GTAProcess.exe
mov dword [0x18011f290], 0x254d448
mov dword [0x18011f284], 0x1f5b820
mov dword [0x18011f29c], 0x1fbc100
mov dword [0x18011f2a8], 0x918
mov dword [0x18011f2a4], 0x88
mov dword [rbp - 0x48], 0x21160614
mov dword [rbp - 0x44], 0x151d161e
mov word [rbp - 0x40], recvfrom
mov byte [rbp - 0x3e], 1
lea rcx, [rbp - 0x48]
jmp 0x180068a38
movdqa xmm0, xmmword [0x1800fb440]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3e6ebf1
mov dword [rbp + 0x3c], 0xefa7fbf4
mov dword [rbp + 0x40], 0x100e9f3
lea rcx, [rbp + 0x28]
call fcn.180066140
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x1800689a2
lea rax, str.FiveM_b2944_GTAProcess.exe
mov dword [0x18011f290], 0x257bea0
mov dword [0x18011f284], 0x1f42068
mov dword [0x18011f29c], 0x1feaac0
mov dword [0x18011f2a8], 0x918
mov dword [rbp + 0x60], 0x21160614
mov dword [rbp + 0x64], 0x151d161e
mov word [rbp + 0x68], recvfrom
mov byte [rbp + 0x6a], 1
lea rcx, [rbp + 0x60]
jmp 0x180068a2e
movdqa xmm0, xmmword [0x1800fb420]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0xe3e6ebf1
mov dword [rbp + 0x3c], 0xefa7fbf4
mov dword [rbp + 0x40], 0x100e9f3
lea rcx, [rbp + 0x28]
call fcn.180066140
mov rcx, rax
call fcn.18004dd50
test rax, rax
je 0x180068aae
lea rax, str.FiveM_b3095_GTAProcess.exe
mov dword [0x18011f290], 0x2593320
mov dword [0x18011f284], 0x1f58b58
mov dword [0x18011f29c], 0x20019e0
mov dword [0x18011f2a8], 0x960
mov dword [rsp + 0x40], 0x21160614
mov dword [rsp + 0x44], 0x151d161e
mov word [rsp + 0x48], recvfrom
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
mov dword [0x18011f2a4], 0xe8
mov qword [0x18011f260], rax
mov dword [0x18011f298], 0x10a8
mov dword [0x18011f2ac], 0x150c
mov dword [0x18011f2b0], 0x1098
mov dword [0x18011f28c], 0x10b8
mov dword [0x18010f0bc], 0x410
mov dword [0x18011f2a0], 0xd10
mov dword [0x18011f288], 0x280
mov dword [0x18011f294], 0x90
mov dword [0x18011f280], 0x60
call fcn.1800585e0
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x180068abe
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180068310
mov dword [rsp + 0x40], 0x21160614
mov dword [rsp + 0x44], 0x151d161e
mov word [rsp + 0x48], recvfrom
mov byte [rsp + 0x4a], 1
lea rcx, [rsp + 0x40]
call fcn.1800585e0
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str._Founded
lea rcx, [rbp + 0x60]
call fcn.18006b4d0
nop
lea r8, [rbp + 0x60]
mov rdx, qword [0x18011f260]
lea rcx, [rbp + 0x28]
call fcn.18006ea80
mov rdx, rax
lea rcx, [0x18011dec0]
call fcn.18006b440
lea rcx, [rbp + 0x28]
call fcn.18004d4e0
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1800fb510]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x100
lea rcx, [rsp + 0x40]
call fcn.180058610
mov rdx, rax
lea rcx, [0x18011dec0]
call fcn.18006b3f0
lea rsi, [rbp + 0xf8]
lea rdi, [0x18006f7f0]
lea rbx, [0x180000000]
xor r14d, r14d
nop dword [rax]
mov dword [rsp + 0x30], 0x77
lea rcx, [rbp + 0x28]
call fcn.180066200
mov rdx, rsi
lea rcx, [rbp + 0x28]
call fcn.18004a380
nop
mov ecx, r14d
mov rax, qword [0x180138440]
test rax, rax
je 0x180068bd9
mov rdx, r14
cmp rax, rdi
je 0x180068bc8
inc ecx
mov edx, ecx
mov rax, qword [rbx + rcx*8 + 0x138440]
test rax, rax
jne 0x180068bb0
jmp 0x180068bd9
mov r8, qword [rbx + rdx*8 + 0x137ad0]
test r8, r8
jne 0x180068cbf
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x180068c00
mov r8, r14
jmp 0x180068c9e
mov rcx, rdi
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x180068c10
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x180138760]
mov qword [rbx + rax*8 + 0x138440], rdi
mov qword [rbx + rax*8 + 0x137ad0], r8
inc rax
mov qword [0x180138760], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r8
movzx edx, ax
mov rcx, qword [rbp + 0x28]
xor rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x38]
mov qword [rax], rcx
test dx, dx
jne 0x180068cf5
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180068b80
lea rdx, [0x1800e9e42]
lea rcx, [0x18011dec0]
call fcn.18006b3f0
mov rcx, qword [0x18011f260]
call fcn.18004dd50
mov dword [0x18011f2b4], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x18011f2c0], rax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.18004de30
mov qword [0x18011f2b8], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180053d20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x1800548d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180066d10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x18011f039], 1
lea rcx, [rbp + 0x60]
call fcn.18004d4e0
nop
lea rcx, [rbp + 0x98]
call fcn.18006a690
nop
lea rcx, [rbp + 0xa8]
call fcn.18004d4e0
nop
lea rcx, [rbp + 0x50]
call fcn.18006a690
mov eax, 1
mov rcx, qword [rbp + 0xc8]
xor rcx, rsp
call fcn.1800d5ca0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18006d130
nop
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.18006b4d0
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x28]
call fcn.18006ebe0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x60]
call fcn.18006fd60
lea rdx, [0x18010bcc0]
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rcx, rax
call fcn.18006d130
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.18006b4d0
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x28]
call fcn.18006ebe0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x60]
call fcn.18006fd60
lea rdx, [0x18010bcc0]
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rcx, rax
call fcn.18006d130
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.18006b4d0
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x28]
call fcn.18006ebe0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x60]
call fcn.18006fd60
lea rdx, [0x18010bcc0]
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3