Function at 0x140002e30
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x1400d1080]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor edi, edi
cmp byte [reloc.WS2_32.dll_accept], dil
je 0x1400035c4
xorps xmm7, xmm7
movss xmm0, dword [0x1400d1128]
movss xmm1, dword [0x1400d112c]
mov rcx, qword [0x1400d1ce0]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
unpcklps xmm0, xmm1
movsd qword [rcx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm7
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x1400d1138]
movss xmm1, dword [0x1400d113c]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or eax, 0x42
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
lea rcx, [0x1400d1ea8]
cmp qword [0x1400d1ec0], 0xf
cmova rcx, qword [0x1400d1ea8]
mov r8d, Ordinal_301
lea rdx, [0x1400d1104]
call fcn.140016090
cmp byte [0x1400d1cd0], dil
je 0x140003192
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x30]
lea rcx, str._________Inject_Galaxy
call fcn.14004a840
test al, al
je 0x14000305f
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
lea r8d, [rdi + 0x1c]
lea rdx, str.G_AlaxYv1590_5823948u49423x1
lea rcx, [rsp + 0x58]
call fcn.140008ba0
nop
xor eax, eax
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], eax
mov word [rbp - 0x74], ax
movdqa xmm0, xmmword [0x1400c3a80]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400c3840]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1400c3a60]
movdqa xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], WSACleanup
lea rcx, [rbp - 0x80]
call fcn.1400035f0
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.140002cc0
nop
mov rdx, rbx
mov rcx, rax
call fcn.1400084b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.140002a00
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14000305f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000305a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000305a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a6044
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, str.Home_Page
call fcn.14004a840
test al, al
je 0x140003084
mov byte [0x1400d1cd0], 0
movss xmm1, dword [0x1400c374c]
xorps xmm0, xmm0
call fcn.14001afb0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, str.Exit_Close
call fcn.14004a840
test al, al
jne 0x1400035aa
mov rcx, qword [0x1400d1ce0]
movss xmm3, dword [rcx + 0x1674]
movss xmm2, dword [rcx + 0x1a80]
movss xmm1, dword [rcx + 0x1684]
addss xmm3, xmm3
addss xmm3, xmm2
addss xmm3, xmm1
mov dword [rsp + 0x30], 0x43520000
addss xmm3, xmm3
addss xmm3, xmm1
addss xmm2, xmm1
addss xmm3, xmm2
movss dword [rsp + 0x34], xmm3
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
lea rdx, str.ChildLog
mov rcx, qword [rcx + 0x1d18]
call fcn.14000d660
mov edx, eax
mov dword [rsp + 0x20], edi
lea r8, [rsp + 0x30]
lea rcx, str.ChildLog
call fcn.140013050
movaps xmm0, xmmword [0x1400c3c50]
movups xmmword [rbp + 0x10], xmm0
lea rdx, str.____UNDETECTED___
lea rcx, [rbp + 0x10]
call fcn.140049ca0
movaps xmm0, xmmword [0x1400c3c50]
movups xmmword [rbp + 0x10], xmm0
lea rdx, str.Stable__Still_In_Beta
lea rcx, [rbp + 0x10]
call fcn.140049ca0
movaps xmm0, xmmword [0x1400c3c50]
movups xmmword [rbp + 0x10], xmm0
lea rdx, str.GTA_Version_1.68_3095
lea rcx, [rbp + 0x10]
call fcn.140049ca0
call fcn.140013260
jmp 0x1400035bf
call fcn.14001b210
movaps xmm0, xmmword [0x1400c3d50]
movups xmmword [rbp + 0x10], xmm0
lea rdx, str.Welcome_To_The_Galaxy
lea rcx, [rbp + 0x10]
call fcn.140049ca0
mov qword [rsp + 0x30], 0x43520000
lea rdx, [rsp + 0x30]
lea rcx, str.Load_GTA_Galaxy_Menu
call fcn.14004a840
test al, al
je 0x1400031d7
mov byte [0x1400d1cd0], 1
mov qword [rsp + 0x30], 0x43520000
lea rdx, [rsp + 0x30]
lea rcx, str.Show_Galaxy_Menu_Info
call fcn.14004a840
test al, al
je 0x140003216
mov rax, qword [0x1400d1ce0]
lea rdx, str.info_popup
mov rcx, qword [rax + 0x1d18]
call fcn.14000d660
mov ecx, eax
call fcn.14001c090
mov rax, qword [0x1400d1ce0]
or dword [rax + 0x1dc0], 2
mov qword [rax + 0x1de4], 0x43750000
mov dword [rax + 0x1dc8], 1
mov edx, 5
lea rcx, str.info_popup
call fcn.14001c8b0
test al, al
je 0x1400033d8
movaps xmm0, xmmword [0x1400c3c60]
movups xmmword [rbp + 0x10], xmm0
lea rdx, str.____The_Galaxy_Team
lea rcx, [rbp + 0x10]
call fcn.140049ca0
lea rcx, [0x1400b61c8]
call fcn.140049d40
movss xmm6, dword [0x1400c374c]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.14001afb0
movaps xmm4, xmmword [0x1400c3d50]
movups xmmword [rbp + 0x10], xmm4
lea rdx, str.Developer___ToXic
lea rcx, [rbp + 0x10]
call fcn.140049ca0
lea rcx, [0x1400b61c8]
call fcn.140049d40
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.14001afb0
movaps xmm4, xmmword [0x1400c3e10]
movups xmmword [rbp + 0x10], xmm4
lea rdx, str.Manager___AlienOG
lea rcx, [rbp + 0x10]
call fcn.140049ca0
lea rcx, [0x1400b61c8]
call fcn.140049d40
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.14001afb0
movaps xmm4, xmmword [0x1400c3cc0]
movups xmmword [rbp + 0x10], xmm4
lea rdx, str.HR___DidYouDie_
lea rcx, [rbp + 0x10]
call fcn.140049ca0
lea rcx, [0x1400b61c8]
call fcn.140049d40
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.14001afb0
movaps xmm4, xmmword [0x1400c3c80]
movups xmmword [rbp + 0x10], xmm4
lea rdx, str.Admin___Arian
lea rcx, [rbp + 0x10]
call fcn.140049ca0
lea rcx, [0x1400b61c8]
call fcn.140049d40
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.14001afb0
movaps xmm4, xmmword [0x1400c3c80]
movups xmmword [rbp + 0x10], xmm4
lea rdx, str.Admin___MJ
lea rcx, [rbp + 0x10]
call fcn.140049ca0
lea rcx, [0x1400b61c8]
call fcn.140049d40
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.14001afb0
movaps xmm4, xmmword [0x1400c3c90]
movups xmmword [rbp + 0x10], xmm4
lea rdx, str.Promoter___ToXic
lea rcx, [rbp + 0x10]
call fcn.140049ca0
lea rcx, [0x1400b61c8]
call fcn.140049d40
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.14001afb0
movaps xmm4, xmmword [0x1400c3ca0]
movups xmmword [rbp + 0x10], xmm4
lea rdx, str.Support___Wolfmaster22
lea rcx, [rbp + 0x10]
call fcn.140049ca0
call fcn.14001c990
mov qword [rsp + 0x30], 0x43520000
lea rdx, [rsp + 0x30]
lea rcx, str.Open_Galaxy_Folder
call fcn.14004a840
test al, al
je 0x14000358c
lea rcx, str.appdata
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140003420
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140008ba0
nop
mov dword [rsp + 0x34], 0x7a
mov word [rsp + 0x30], 0x5c
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.1400088b0
nop
lea rdx, [0x1400d1ea8]
mov rcx, rax
call fcn.1400085c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400034d2
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a6044
lea r8, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r8, qword [rbp + 0x10]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14000353d
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003538
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003538
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a6044
movdqa xmm0, xmmword [0x1400c37c0]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14000358c
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003587
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003587
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a6044
mov qword [rsp + 0x30], 0x43520000
lea rdx, [rsp + 0x30]
lea rcx, str.Exit_The_Galaxy__Loader
call fcn.14004a840
test al, al
je 0x1400035ba
mov byte [reloc.WS2_32.dll_accept], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14001b360
call fcn.1400192e0
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400a5da0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret