Function at 0x180004b90
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1803dc080]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp edx, 1
jne 0x180004e65
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov ecx, 0x104
call fcn.18039e76c
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x104
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str.UnityCrashHandler
mov rcx, rbx
call fcn.1803a0224
test rax, rax
je 0x180004c11
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
test rax, rax
je 0x180004c11
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180372220
test al, al
jne 0x180004c2f
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18039e280
add rsp, 0x50
pop rbx
ret
lea rdx, str.RealmStock_Exalt_MultiTool
lea rcx, [rsp + 0x20]
call fcn.180005410
lea rdx, [rsp + 0x20]
lea rcx, [0x180004a00]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 7
jbe 0x180004c96
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004c91
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004e7d
call fcn.18039e2a0
test ebx, ebx
je 0x180004cbb
mov r9d, 0x40000
lea r8, str.Exalt_MultiTool
lea rdx, str.ERROR:_MutliTool_is_not_running__mods_will_not_function.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x180004e65
mov rax, qword gs:[0x58]
mov ecx, dword [0x1803dec54]
mov edx, 4
mov qword [rsp + 0x68], rsi
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x180563df0], eax
jle 0x180004d14
lea rcx, [0x180563df0]
call fcn.18039e6f4
cmp dword [0x180563df0], 0xffffffff
jne 0x180004d14
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x180563df0]
mov qword [0x180563de0], rax
call fcn.18039e688
mov r9, qword [0x180563de0]
mov rcx, r9
mov qword [rsp + 0x40], r9
call fcn.1800034f0
lea rsi, str.ERROR:_Already_hooked:
test al, al
je 0x180004d4e
lea rdx, [r9 + rsi]
xor ecx, ecx
mov r9d, 0x40000
lea r8, str.Exalt_Multi_Tool
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x180004da6
mov qword [rsp + 0x70], rdi
call fcn.180374b30
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180375060
lea rdi, [0x180004f70]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180374110
call fcn.180374bb0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
call fcn.1800035c0
mov rcx, qword [rax]
mov qword [rcx + 0x18], rdi
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x70]
mov qword [0x180563de0], rax
mov eax, dword [rbx]
cmp dword [0x180563df4], eax
jle 0x180004ddf
lea rcx, [0x180563df4]
call fcn.18039e6f4
cmp dword [0x180563df4], 0xffffffff
jne 0x180004ddf
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [0x180563df4]
mov qword [0x180563de8], rax
call fcn.18039e688
mov r9, qword [0x180563de8]
mov rcx, r9
mov qword [rsp + 0x40], r9
call fcn.1800034f0
test al, al
je 0x180004e12
lea rdx, [r9 + rsi]
xor ecx, ecx
mov r9d, 0x40000
lea r8, str.Exalt_Multi_Tool
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x180004e60
call fcn.180374b30
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180375060
lea rbx, [0x180005120]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.180374110
call fcn.180374bb0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
call fcn.1800035c0
mov rcx, qword [rax]
mov qword [rcx + 0x18], rbx
mov rax, qword [rsp + 0x40]
mov qword [0x180563de8], rax
mov rsi, qword [rsp + 0x68]
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18039e280
add rsp, 0x50
pop rbx
ret
call fcn.1803a53b0
int3