Function at 0x140002b10
Capabilities:
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x140085080]
xor rax, rsp
mov qword [rbp + 0x27], rax
movups xmm0, xmmword [str.TFVaV_UL_]
movups xmmword [rbp - 0x49], xmm0
mov eax, dword [0x14007a6f8]
mov dword [rbp - 0x39], eax
cmp word [reloc.WLDAP32.dll_Ordinal_60], 0
je 0x140002b96
mov eax, 0x67
mov word [rbp - 0x49], ax
xor word [rbp - 0x47], 0x34
xor word [rbp - 0x45], 0x35
xor word [rbp - 0x43], 0x36
xor word [rbp - 0x41], 0x37
xor word [rbp - 0x3f], 0x38
xor word [rbp - 0x3d], 0x39
xor word [rbp - 0x3b], 0x3a
xor word [rbp - 0x39], 0x3b
xor word [rbp - 0x37], 0x3c
xor edx, edx
lea rcx, [rbp - 0x49]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140002bcd
lea r9d, [rax + 0x10]
lea r8, str.An_error_occurred
lea rdx, str._Please_open_FiveM
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17e017b3
mov dword [rbp - 0x79], 0x17e017ea
mov dword [rbp - 0x75], 0x178917e1
mov dword [rbp - 0x71], 0x178c1790
mov dword [rbp - 0x6d], 0x178a1798
mov dword [rbp - 0x69], 0x17b317a9
mov dword [rbp - 0x65], 0x17bb17be
mov dword [rbp - 0x61], 0x179317ac
mov dword [rbp - 0x5d], 0x178717cf
mov dword [rbp - 0x59], 0x1781179b
xor edi, edi
mov word [rbp - 0x55], di
mov byte [rbp - 0x53], 1
mov ecx, edi
mov r14d, 0x17cb
nop dword [rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002c40
mov byte [rbp - 0x53], dil
lea rcx, [rsp + 0x20]
call fcn.140002570
mov esi, eax
test eax, eax
jne 0x140002fe5
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17e017b3
mov dword [rbp - 0x79], 0x17e417eb
mov dword [rbp - 0x75], 0x178917e7
mov dword [rbp - 0x71], 0x178c1790
mov dword [rbp - 0x6d], 0x178a1798
mov dword [rbp - 0x69], 0x17b317a9
mov dword [rbp - 0x65], 0x17bb17be
mov dword [rbp - 0x61], 0x179317ac
mov dword [rbp - 0x5d], 0x178717cf
mov dword [rbp - 0x59], 0x1781179b
mov word [rbp - 0x55], di
mov byte [rbp - 0x53], 1
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002ce0
mov byte [rbp - 0x53], dil
lea rcx, [rsp + 0x20]
call fcn.140002570
mov esi, eax
test eax, eax
jne 0x140002fe5
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17e017b3
mov dword [rbp - 0x79], 0x17ed17e5
mov dword [rbp - 0x75], 0x178917ec
mov dword [rbp - 0x71], 0x178c1790
mov dword [rbp - 0x6d], 0x178a1798
mov dword [rbp - 0x69], 0x17b317a9
mov dword [rbp - 0x65], 0x17bb17be
mov dword [rbp - 0x61], 0x179317ac
mov dword [rbp - 0x5d], 0x178717cf
mov dword [rbp - 0x59], 0x1781179b
mov word [rbp - 0x55], di
mov byte [rbp - 0x53], 1
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002d80
mov byte [rbp - 0x53], dil
lea rcx, [rsp + 0x20]
call fcn.140002570
mov esi, eax
test eax, eax
jne 0x140002fe5
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17e017b3
mov dword [rbp - 0x79], 0x17e417eb
mov dword [rbp - 0x75], 0x178917e7
mov dword [rbp - 0x71], 0x178c1790
mov dword [rbp - 0x6d], 0x178a1798
mov dword [rbp - 0x69], 0x17b317a9
mov dword [rbp - 0x65], 0x17bb17be
mov dword [rbp - 0x61], 0x179317ac
mov dword [rbp - 0x5d], 0x178717cf
mov dword [rbp - 0x59], 0x1781179b
mov word [rbp - 0x55], di
mov byte [rbp - 0x53], 1
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002e20
mov byte [rbp - 0x53], dil
lea rcx, [rsp + 0x20]
call fcn.140002570
mov esi, eax
test eax, eax
jne 0x140002fe5
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17e117b3
mov dword [rbp - 0x79], 0x17ed17e3
mov dword [rbp - 0x75], 0x178917e0
mov dword [rbp - 0x71], 0x178c1790
mov dword [rbp - 0x6d], 0x178a1798
mov dword [rbp - 0x69], 0x17b317a9
mov dword [rbp - 0x65], 0x17bb17be
mov dword [rbp - 0x61], 0x179317ac
mov dword [rbp - 0x5d], 0x178717cf
mov dword [rbp - 0x59], 0x1781179b
mov word [rbp - 0x55], di
mov byte [rbp - 0x53], 1
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002ec0
mov byte [rbp - 0x53], dil
lea rcx, [rsp + 0x20]
call fcn.140002570
mov esi, eax
test eax, eax
jne 0x140002fe5
mov dword [rbp - 9], 0x17a5178d
mov dword [rbp - 5], 0x17ab17bb
mov dword [rbp - 1], 0x178f1782
mov dword [rbp + 3], 0x17861796
mov dword [rbp + 7], 0x17841792
mov dword [rbp + 0xb], 0x17b917a7
mov dword [rbp + 0xf], 0x17bd17b4
mov dword [rbp + 0x13], 0x17a917aa
mov dword [rbp + 0x17], 0x17b917f5
mov dword [rbp + 0x1b], 0x17bb17a5
mov word [rbp + 0x1f], di
mov byte [rbp + 0x21], 1
mov rcx, rdi
nop dword [rax + rax]
lea eax, [r14 + rcx]
xor word [rbp + rcx*2 - 9], ax
inc rcx
cmp rcx, 0x14
jb 0x140002f40
mov byte [rbp + 0x21], dil
lea rcx, [rbp - 9]
call fcn.140002570
mov esi, eax
test eax, eax
jne 0x140002fe5
lea rdx, str._e_31m____Process_Not_found__0x_lX__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
lea rdx, str._e_31m____Pls_Open_FiveM_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp - 0x51], 0xbea0a8
mov byte [rbp - 0x4d], 1
nop
lea eax, [rdi - 0x35]
xor byte [rbp + rdi - 0x51], al
inc rdi
cmp rdi, 3
jb 0x140002fc0
mov byte [rbp - 0x4d], 0
lea rcx, [rbp - 0x51]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x140003ed5
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17861796
mov dword [rbp - 0x79], 0x17841792
mov dword [rbp - 0x75], 0x17b917a7
mov dword [rbp - 0x71], 0x17bd17b4
mov dword [rbp - 0x6d], 0x17a917aa
mov dword [rbp - 0x69], 0x17b917f5
mov dword [rbp - 0x65], 0x17bb17a5
mov word [rbp - 0x61], di
mov byte [rbp - 0x5f], 1
mov rcx, rdi
nop dword [rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x14
jb 0x140003040
mov byte [rbp - 0x5f], dil
lea rcx, [rsp + 0x20]
call fcn.140002570
cmp esi, eax
jne 0x1400032d2
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], dil
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140004e60
mov rax, qword [rbp - 0x11]
cmp rax, 0x14
jb 0x1400030d9
lea rbx, [rbp - 0x29]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x29]
mov qword [rbp - 0x19], reloc.WS2_32.dll_sendto
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.FiveM_GTAProcess.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x14], 0
jmp 0x1400030ee
lea r9, str.FiveM_GTAProcess.exe
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rbp - 0x29]
call fcn.140005e60
mov rax, qword [rbp - 0x31]
cmp rax, 0x19
jb 0x140003128
lea rbx, [rbp - 0x49]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x49]
mov qword [rbp - 0x39], Ordinal_27
mov r8d, Ordinal_27
lea rdx, str.C:WindowsReFucsiton.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x19], 0
jmp 0x14000313d
lea r9, str.C:WindowsReFucsiton.dll
mov edx, Ordinal_27
lea rcx, [rbp - 0x49]
call fcn.140005e60
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova r8, qword [rbp - 0x49]
add r8, qword [rbp - 0x39]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
lea rcx, [rbp - 9]
call fcn.1400050c0
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rcx, qword [rbp - 0x29]
call fcn.140002770
mov ebx, eax
test eax, eax
jne 0x140003216
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007a440]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
mov ecx, ebx
call fcn.140002630
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x140003246
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003240
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003240
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, Ordinal_50
lea r8, [0x14007a338]
lea rdx, str.English_n_n_Please_press_OK_when_the_characters_feet_touch_the_ground.__n_nThai_n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x1400031c2
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400681f4
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140003284
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000327f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000327f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400032d2
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17e017b3
mov dword [rbp - 0x79], 0x17ed17e5
mov dword [rbp - 0x75], 0x178917ec
mov dword [rbp - 0x71], 0x178c1790
mov dword [rbp - 0x6d], 0x178a1798
mov dword [rbp - 0x69], 0x17b317a9
mov dword [rbp - 0x65], 0x17bb17be
mov dword [rbp - 0x61], 0x179317ac
mov dword [rbp - 0x5d], 0x178717cf
mov dword [rbp - 0x59], 0x1781179b
mov word [rbp - 0x55], di
mov byte [rbp - 0x53], 1
mov rcx, rdi
nop dword [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x140003340
mov byte [rbp - 0x53], 0
lea rcx, [rsp + 0x20]
call fcn.140002570
cmp esi, eax
jne 0x1400035d2
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140004e60
mov rax, qword [rbp - 0x11]
cmp rax, 0x1a
jb 0x1400033d9
lea rbx, [rbp - 0x29]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x29]
mov qword [rbp - 0x19], reloc.WLDAP32.dll_Ordinal_26
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1a], 0
jmp 0x1400033ee
lea r9, str.FiveM_b2699_GTAProcess.exe
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp - 0x29]
call fcn.140005e60
mov rax, qword [rbp - 0x31]
cmp rax, 0x19
jb 0x140003428
lea rbx, [rbp - 0x49]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x49]
mov qword [rbp - 0x39], Ordinal_27
mov r8d, Ordinal_27
lea rdx, str.C:WindowsReFucsiton.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x19], 0
jmp 0x14000343d
lea r9, str.C:WindowsReFucsiton.dll
mov edx, Ordinal_27
lea rcx, [rbp - 0x49]
call fcn.140005e60
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova r8, qword [rbp - 0x49]
add r8, qword [rbp - 0x39]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
lea rcx, [rbp - 9]
call fcn.1400050c0
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rcx, qword [rbp - 0x29]
call fcn.140002770
mov ebx, eax
test eax, eax
jne 0x140003516
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007a440]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
mov ecx, ebx
call fcn.140002630
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x140003546
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003540
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003540
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, Ordinal_50
lea r8, [0x14007a338]
lea rdx, str.English_n_n_Please_press_OK_when_the_characters_feet_touch_the_ground.__n_nThai_n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x1400034c2
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400681f4
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140003584
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000357f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000357f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400035d2
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17e017b3
mov dword [rbp - 0x79], 0x17e017ea
mov dword [rbp - 0x75], 0x178917e1
mov dword [rbp - 0x71], 0x178c1790
mov dword [rbp - 0x6d], 0x178a1798
mov dword [rbp - 0x69], 0x17b317a9
mov dword [rbp - 0x65], 0x17bb17be
mov dword [rbp - 0x61], 0x179317ac
mov dword [rbp - 0x5d], 0x178717cf
mov dword [rbp - 0x59], 0x1781179b
mov word [rbp - 0x55], di
mov byte [rbp - 0x53], 1
mov rcx, rdi
nop dword [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x140003640
mov byte [rbp - 0x53], 0
lea rcx, [rsp + 0x20]
call fcn.140002570
cmp esi, eax
jne 0x1400038d2
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140004e60
mov rax, qword [rbp - 0x11]
cmp rax, 0x1a
jb 0x1400036d9
lea rbx, [rbp - 0x29]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x29]
mov qword [rbp - 0x19], reloc.WLDAP32.dll_Ordinal_26
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1a], 0
jmp 0x1400036ee
lea r9, str.FiveM_b2944_GTAProcess.exe
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp - 0x29]
call fcn.140005e60
mov rax, qword [rbp - 0x31]
cmp rax, 0x19
jb 0x140003728
lea rbx, [rbp - 0x49]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x49]
mov qword [rbp - 0x39], Ordinal_27
mov r8d, Ordinal_27
lea rdx, str.C:WindowsReFucsiton.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x19], 0
jmp 0x14000373d
lea r9, str.C:WindowsReFucsiton.dll
mov edx, Ordinal_27
lea rcx, [rbp - 0x49]
call fcn.140005e60
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova r8, qword [rbp - 0x49]
add r8, qword [rbp - 0x39]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
lea rcx, [rbp - 9]
call fcn.1400050c0
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rcx, qword [rbp - 0x29]
call fcn.140002770
mov ebx, eax
test eax, eax
jne 0x140003816
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007a440]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
mov ecx, ebx
call fcn.140002630
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x140003846
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003840
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003840
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, Ordinal_50
lea r8, [0x14007a338]
lea rdx, str.English_n_n_Please_press_OK_when_the_characters_feet_touch_the_ground.__n_nThai_n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x1400037c2
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400681f4
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140003884
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000387f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000387f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400038d2
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17e017b3
mov dword [rbp - 0x79], 0x17e417eb
mov dword [rbp - 0x75], 0x178917e7
mov dword [rbp - 0x71], 0x178c1790
mov dword [rbp - 0x6d], 0x178a1798
mov dword [rbp - 0x69], 0x17b317a9
mov dword [rbp - 0x65], 0x17bb17be
mov dword [rbp - 0x61], 0x179317ac
mov dword [rbp - 0x5d], 0x178717cf
mov dword [rbp - 0x59], 0x1781179b
mov word [rbp - 0x55], di
mov byte [rbp - 0x53], 1
mov rcx, rdi
nop dword [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x140003940
mov byte [rbp - 0x53], 0
lea rcx, [rsp + 0x20]
call fcn.140002570
cmp esi, eax
jne 0x140003bd5
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140004e60
mov rax, qword [rbp - 0x11]
cmp rax, 0x1a
jb 0x1400039d9
lea rbx, [rbp - 0x29]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x29]
mov qword [rbp - 0x19], reloc.WLDAP32.dll_Ordinal_26
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1a], 0
jmp 0x1400039ee
lea r9, str.FiveM_b2802_GTAProcess.exe
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp - 0x29]
call fcn.140005e60
mov rax, qword [rbp - 0x31]
cmp rax, 0x19
jb 0x140003a28
lea rbx, [rbp - 0x49]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x49]
mov qword [rbp - 0x39], Ordinal_27
mov r8d, Ordinal_27
lea rdx, str.C:WindowsReFucsiton.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x19], 0
jmp 0x140003a3d
lea r9, str.C:WindowsReFucsiton.dll
mov edx, Ordinal_27
lea rcx, [rbp - 0x49]
call fcn.140005e60
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
mov r8, qword [rbp - 0x39]
add r8, rdx
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
lea rcx, [rbp - 9]
call fcn.1400050c0
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rcx, qword [rbp - 0x29]
call fcn.140002770
mov ebx, eax
test eax, eax
jne 0x140003b19
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007a440]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
mov ecx, ebx
call fcn.140002630
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x140003b49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, Ordinal_50
lea r8, [0x14007a338]
lea rdx, str.English_n_n_Please_press_OK_when_the_characters_feet_touch_the_ground.__n_nThai_n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x140003ac5
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400681f4
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140003b87
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140003bd5
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov dword [rsp + 0x20], 0x17a5178d
mov dword [rsp + 0x24], 0x17ab17bb
mov dword [rsp + 0x28], 0x178f1782
mov dword [rbp - 0x7d], 0x17e117b3
mov dword [rbp - 0x79], 0x17ed17e3
mov dword [rbp - 0x75], 0x178917e0
mov dword [rbp - 0x71], 0x178c1790
mov dword [rbp - 0x6d], 0x178a1798
mov dword [rbp - 0x69], 0x17b317a9
mov dword [rbp - 0x65], 0x17bb17be
mov dword [rbp - 0x61], 0x179317ac
mov dword [rbp - 0x5d], 0x178717cf
mov dword [rbp - 0x59], 0x1781179b
mov word [rbp - 0x55], di
mov byte [rbp - 0x53], 1
mov rcx, rdi
nop
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0x1a
jb 0x140003c40
mov byte [rbp - 0x53], 0
lea rcx, [rsp + 0x20]
call fcn.140002570
cmp esi, eax
jne 0x140003ed5
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140004e60
mov rax, qword [rbp - 0x11]
cmp rax, 0x1a
jb 0x140003cd9
lea rbx, [rbp - 0x29]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x29]
mov qword [rbp - 0x19], reloc.WLDAP32.dll_Ordinal_26
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1a], 0
jmp 0x140003cee
lea r9, str.FiveM_b3095_GTAProcess.exe
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp - 0x29]
call fcn.140005e60
mov rax, qword [rbp - 0x31]
cmp rax, 0x19
jb 0x140003d28
lea rbx, [rbp - 0x49]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x49]
mov qword [rbp - 0x39], Ordinal_27
mov r8d, Ordinal_27
lea rdx, str.C:WindowsReFucsiton.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x19], 0
jmp 0x140003d3d
lea r9, str.C:WindowsReFucsiton.dll
mov edx, Ordinal_27
lea rcx, [rbp - 0x49]
call fcn.140005e60
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
mov r8, qword [rbp - 0x39]
add r8, rdx
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
lea rcx, [rbp - 9]
call fcn.1400050c0
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rcx, qword [rbp - 0x29]
call fcn.140002770
mov ebx, eax
test eax, eax
jne 0x140003e19
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c90
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14007a440]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdx, qword [rbp - 0x49]
mov ecx, ebx
call fcn.140002630
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x140003e49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, Ordinal_50
lea r8, [0x14007a338]
lea rdx, str.English_n_n_Please_press_OK_when_the_characters_feet_touch_the_ground.__n_nThai_n_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x140003dc5
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400681f4
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140003e87
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140003ed5
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ed0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ed0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400681f4
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140067f50
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret