Function at 0x180018ea0
Capabilities:
Create thread
Enumerate processes
Inject thread
Terminate process

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x2a0
mov rax, qword [0x180068040]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov ebx, r8d
mov rdi, rdx
mov r14, rcx
call fcn.180018da0
test al, al
jne 0x180018ef1
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.The_mod_file_is_invalid___Please_download_mod_again
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x18001919e
mov qword [rsp + 0x2c8], rbp
xor ebp, ebp
mov qword [rsp + 0x2d8], rsi
cmp qword [rdi + 0x10], rbp
je 0x18001903f
xor edx, edx
mov dword [rsp + 0x50], 0x238
mov ecx, 2
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18001903f
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rax, [rsp + 0x7c]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], bx
jne 0x180018f50
cmp qword [rdi + 0x18], 7
mov r9, rdi
mov r10, qword [rdi + 0x10]
jbe 0x180018f6a
mov r9, qword [rdi]
cmp rcx, r10
lea rdx, [rsp + 0x7c]
mov r8, r10
cmovb r8, rcx
test r8, r8
je 0x180018f9a
lea rax, [rsp + 0x7c]
sub r9, rax
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x180018fa4
add rdx, 2
sub r8, 1
jne 0x180018f86
cmp r10, rcx
jb 0x180018fa4
cmovbe ebx, dword [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x180019036
nop word [rax + rax]
lea rax, [rsp + 0x7c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], bp
jne 0x180018fd0
cmp qword [rdi + 0x18], 7
mov r9, rdi
mov r10, qword [rdi + 0x10]
jbe 0x180018fea
mov r9, qword [rdi]
cmp rcx, r10
lea rdx, [rsp + 0x7c]
mov r8, r10
cmovb r8, rcx
test r8, r8
je 0x18001901a
lea rax, [rsp + 0x7c]
sub r9, rax
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x180019024
add rdx, 2
sub r8, 1
jne 0x180019006
cmp r10, rcx
jb 0x180019024
cmovbe ebx, dword [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180018fc0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180019061
mov r8d, 0x1e
lea rdx, str.Open_The_Game_In_Offline_First
lea rcx, [0x180068348]
call fcn.180017830
jmp 0x18001918e
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18001918e
mov r8, qword [r14 + 0x10]
mov r9d, 0x3000
xor edx, edx
mov dword [rsp + 0x20], 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x180019185
cmp qword [r14 + 0x18], 0xf
mov r9, qword [r14 + 0x10]
jbe 0x1800190b4
mov r14, qword [r14]
mov r8, r14
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180019170
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x28], ebp
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x180019170
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
je 0x180019185
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], ebp
jne 0x180019167
mov r8d, 0xa
lea rdx, str.Failed_Run
lea rcx, [0x180068348]
call fcn.180017830
jmp 0x18001918e
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x2c8]
mov rsi, qword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.180053390
add rsp, 0x2a0
pop r14
pop rdi
pop rbx
ret