Function at 0x1801e4390
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2d0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1802a8008]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r9d, 8
lea r8, str.HKKOHAAALSBUDVJSOJB
mov edx, 0xff
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov byte [rsp + 0x2ae], 0
lea rcx, [rsp + 0x88]
call fcn.1801e41b0
nop
mov rcx, rax
call fcn.18003ddf0
mov r9, rax
lea rax, str.ertgreretzzzzz
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xb0]
call fcn.18003c1f0
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 0x10
jb 0x1801e4487
inc rax
mov rcx, qword [rsp + 0x88]
cmp rax, 0x1000
jb 0x1801e4482
test cl, 0x1f
je 0x1801e4452
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1801e4462
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1801e4472
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1801e447f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rsp + 0xa0], 0xf
xor esi, esi
mov qword [rsp + 0x98], rsi
mov byte [rsp + 0x88], sil
lea rcx, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x80]
cmp rdi, 8
cmovae rcx, rbx
lea r9d, [rsi + 0x24]
lea r8, str.trzurzuruztrutruzttrzuiuztzutiztvcbn
mov rdx, qword [rsp + 0x78]
call fcn.1800373c0
test eax, eax
jne 0x1801e45d7
call fcn.1800bee30
mov dword [0x1802da500], esi
movabs rdi, 0x202709f4c58a0424
mov qword [0x18034fb80], rdi
lea rbx, str.STRING
mov qword [0x1802da5c8], rbx
mov dword [0x1802da4f0], 1
call fcn.1800cf2b0
mov dword [0x1802da500], esi
movabs rax, 0xc63cd5d2920acbe7
mov qword [0x18034fb80], rax
lea rax, str.gLogin_successful
mov qword [0x1802da5c8], rax
mov dword [0x1802da4f0], 1
call fcn.1800cf2b0
movss xmm6, dword [0x180269c70]
movss dword [rsp + 0x38], xmm6
call fcn.18003dcf0
call fcn.1800ad6e0
mov dword [0x1802da500], esi
mov qword [0x18034fb80], rdi
mov qword [0x1802da5c8], rbx
mov dword [0x1802da4f0], 1
call fcn.1800cf2b0
mov dword [0x1802da500], esi
movabs rax, 0x6c188be134e074aa
mov qword [0x18034fb80], rax
lea rax, str.wwelcome
mov qword [0x1802da5c8], rax
mov dword [0x1802da4f0], 1
call fcn.1800cf2b0
movss dword [rsp + 0x38], xmm6
call fcn.18003dcf0
call fcn.1800ad6e0
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x68]
jmp 0x1801e4616
lea rcx, [rsp + 0x68]
cmp rdi, 8
cmovae rcx, rbx
mov r9d, 0x24
lea r8, str.trzurzuruztrutruzttrzuiuztzutiztvcbn
call fcn.1800373c0
test eax, eax
je 0x1801e4616
xor edx, edx
lea rcx, str.Taskkill__F__IM_gta5.exe__F
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.Menu_is_detected_
call fcn.1800bc8e0
nop
cmp rdi, 8
jb 0x1801e4685
lea rax, [rdi + 1]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x1801e4636
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x1801e467d
test bl, 0x1f
je 0x1801e464d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x1801e465d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, rax
cmp rbx, 8
jae 0x1801e466d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rbx, 0x27
jbe 0x1801e467a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rbx, rax
mov rcx, rbx
call fcn.1801e6034
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1801e6050
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret