Function at 0x140009f10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14008f088]
xor rax, rsp
mov qword [rbp + 0x58], rax
xor edx, edx
lea rcx, [0x140073580]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140009f7c
lea r9d, [rax + 0x10]
lea r8, str.An_error_occurred
lea rdx, str._Please_open_FiveM
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x30], 0x389538bd
mov dword [rsp + 0x34], 0x389b388b
mov dword [rsp + 0x38], 0x395f38b2
mov dword [rsp + 0x3c], 0x39303963
mov dword [rsp + 0x40], 0x39333930
mov dword [rsp + 0x44], 0x39593937
mov dword [rsp + 0x48], 0x395c3940
mov dword [rsp + 0x4c], 0x395a3948
mov dword [rsp + 0x50], 0x39633979
mov dword [rsp + 0x54], 0x396b396e
mov dword [rsp + 0x58], 0x3963397c
mov dword [rsp + 0x5c], 0x3977393f
mov dword [rsp + 0x60], 0x3971396b
xor r12d, r12d
mov word [rsp + 0x64], r12w
mov byte [rsp + 0x66], 1
mov ecx, r12d
mov ebx, 0x38fb
nop word [rax + rax]
lea eax, [rbx + rcx]
xor word [rsp + rcx*2 + 0x30], ax
inc rcx
cmp rcx, 0x1a
jb 0x14000a000
mov byte [rsp + 0x66], r12b
lea rcx, [rsp + 0x30]
call fcn.140008320
mov edi, eax
test eax, eax
jne 0x14000a3d1
mov dword [rsp + 0x30], 0x389538bd
mov dword [rsp + 0x34], 0x389b388b
mov dword [rsp + 0x38], 0x395f38b2
mov dword [rsp + 0x3c], 0x39303963
mov dword [rsp + 0x40], 0x393d3935
mov dword [rsp + 0x44], 0x3959393c
mov dword [rsp + 0x48], 0x395c3940
mov dword [rsp + 0x4c], 0x395a3948
mov dword [rsp + 0x50], 0x39633979
mov dword [rsp + 0x54], 0x396b396e
mov dword [rsp + 0x58], 0x3963397c
mov dword [rsp + 0x5c], 0x3977393f
mov dword [rsp + 0x60], 0x3971396b
mov word [rsp + 0x64], r12w
mov byte [rsp + 0x66], 1
mov rcx, r12
lea eax, [rbx + rcx]
xor word [rsp + rcx*2 + 0x30], ax
inc rcx
cmp rcx, 0x1a
jb 0x14000a0a0
mov byte [rsp + 0x66], r12b
lea rcx, [rsp + 0x30]
call fcn.140008320
mov edi, eax
test eax, eax
jne 0x14000a3d1
mov dword [rsp + 0x30], 0x389538bd
mov dword [rsp + 0x34], 0x389b388b
mov dword [rsp + 0x38], 0x395f38b2
mov dword [rsp + 0x3c], 0x39563946
mov dword [rsp + 0x40], 0x39543942
mov dword [rsp + 0x44], 0x39693977
mov dword [rsp + 0x48], 0x396d3964
mov dword [rsp + 0x4c], 0x3979397a
mov dword [rsp + 0x50], 0x39693925
mov dword [rsp + 0x54], 0x396b3975
mov word [rsp + 0x58], r12w
mov byte [rsp + 0x5a], 1
mov rcx, r12
nop dword [rax + rax]
lea eax, [rbx + rcx]
xor word [rsp + rcx*2 + 0x30], ax
inc rcx
cmp rcx, 0x14
jb 0x14000a130
mov byte [rsp + 0x5a], r12b
lea rcx, [rsp + 0x30]
call fcn.140008320
mov edi, eax
test eax, eax
jne 0x14000a3d1
mov dword [rsp + 0x30], 0x389538bd
mov dword [rsp + 0x34], 0x389b388b
mov dword [rsp + 0x38], 0x395f38b2
mov dword [rsp + 0x3c], 0x39303963
mov dword [rsp + 0x40], 0x39353935
mov dword [rsp + 0x44], 0x39593937
mov dword [rsp + 0x48], 0x395c3940
mov dword [rsp + 0x4c], 0x395a3948
mov dword [rsp + 0x50], 0x39633979
mov dword [rsp + 0x54], 0x396b396e
mov dword [rsp + 0x58], 0x3963397c
mov dword [rsp + 0x5c], 0x3977393f
mov dword [rsp + 0x60], 0x3971396b
mov word [rsp + 0x64], r12w
mov byte [rsp + 0x66], 1
mov rcx, r12
lea eax, [rbx + rcx]
xor word [rsp + rcx*2 + 0x30], ax
inc rcx
cmp rcx, 0x1a
jb 0x14000a1d0
mov byte [rsp + 0x66], r12b
lea rcx, [rsp + 0x30]
call fcn.140008320
mov edi, eax
test eax, eax
jne 0x14000a3d1
mov dword [rsp + 0x30], 0x389538bd
mov dword [rsp + 0x34], 0x389b388b
mov dword [rsp + 0x38], 0x395f38b2
mov dword [rsp + 0x3c], 0x39633946
mov dword [rsp + 0x40], 0x3961396e
mov dword [rsp + 0x44], 0x39743955
mov dword [rsp + 0x48], 0x396b3968
mov dword [rsp + 0x4c], 0x3979396c
mov dword [rsp + 0x50], 0x39223978
mov dword [rsp + 0x54], 0x39763968
mov dword [rsp + 0x58], 0x396a
mov byte [rsp + 0x5c], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rbx + rcx]
xor word [rsp + rcx*2 + 0x30], ax
inc rcx
cmp rcx, 0x15
jb 0x14000a260
mov byte [rsp + 0x5c], r12b
lea rcx, [rsp + 0x30]
call fcn.140008320
mov edi, eax
test eax, eax
jne 0x14000a3d1
mov dword [rsp + 0x30], 0x389538bd
mov dword [rsp + 0x34], 0x389b388b
mov dword [rsp + 0x38], 0x395f38b2
mov dword [rsp + 0x3c], 0x39303963
mov dword [rsp + 0x40], 0x3934393b
mov dword [rsp + 0x44], 0x39593937
mov dword [rsp + 0x48], 0x395c3940
mov dword [rsp + 0x4c], 0x395a3948
mov dword [rsp + 0x50], 0x39633979
mov dword [rsp + 0x54], 0x396b396e
mov dword [rsp + 0x58], 0x3963397c
mov dword [rsp + 0x5c], 0x3977393f
mov dword [rsp + 0x60], 0x3971396b
mov word [rsp + 0x64], r12w
mov byte [rsp + 0x66], 1
mov rcx, r12
lea eax, [rbx + rcx]
xor word [rsp + rcx*2 + 0x30], ax
inc rcx
cmp rcx, 0x1a
jb 0x14000a300
mov byte [rsp + 0x66], r12b
lea rcx, [rsp + 0x30]
call fcn.140008320
mov edi, eax
test eax, eax
jne 0x14000a3d1
lea rdx, [0x140073574]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
lea rdx, str._e_31m____Process_Not_found__0x_lX__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140073574]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
lea rdx, str._e_31m____Pls_Open_FiveM_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp - 0x80], 0x8e9098
mov byte [rbp - 0x7c], 1
lea rcx, [rbp - 0x80]
call fcn.140009930
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.14006ec60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp - 0x50], 0x38933898
mov dword [rbp - 0x4c], 0x38963893
mov dword [rbp - 0x48], 0x39733890
mov dword [rbp - 0x44], 0x392f3975
mov dword [rbp - 0x40], 0x39363975
mov dword [rbp - 0x3c], 0x3962392b
mov dword [rbp - 0x38], 0x3964396b
mov word [rbp - 0x34], r12w
mov byte [rbp - 0x32], 1
mov rcx, r12
nop
lea eax, [rbx + rcx]
xor word [rbp + rcx*2 - 0x50], ax
inc rcx
cmp rcx, 0xe
jb 0x14000a410
mov byte [rbp - 0x32], r12b
lea rdx, [rbp - 0x50]
mov ecx, edi
call fcn.140008260
mov rbx, rax
lea rdx, [0x14007360c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
lea rdx, str._________e_90m_e_36me_90m_e_38_2_0_128_255m_ProcID_:e_90m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140005180]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._________e_90m_e_36me_90m_e_38_2_0_128_255m_Base_Address_:e_90m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
lea rdx, [0x140009a70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140005180]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
add rbx, 0x6e5d0
movdqa xmm0, xmmword [0x1400738b0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [str.P__c__vJyH_rL__P__c1_vJyH_rL__2__S]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x140073ad0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [str.jHIJCB]
movdqa xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x70], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 5]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x3f
jb 0x14000a530
mov byte [rsp + 0x70], r12b
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
lea rdx, [0x140009a70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140005180]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov dword [rbp - 0x80], Ordinal_50
mov dword [rbp - 0x7c], 0x330
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r12
mov ecx, 8
call fcn.14006eb10
mov qword [rbp + 0x28], rax
lea rdx, [rax + 8]
mov qword [rbp + 0x38], rdx
mov rcx, qword [rbp - 0x80]
mov qword [rax], rcx
mov qword [rbp + 0x30], rdx
xorps xmm0, xmm0
mov dword [rbp - 0x10], Ordinal_50
mov dword [rbp - 0xc], 0x334
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov ecx, 8
call fcn.14006eb10
mov qword [rbp + 0x40], rax
lea rdx, [rax + 8]
mov qword [rbp + 0x50], rdx
mov rcx, qword [rbp - 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x48], rdx
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 8]
call fcn.1400057b0
mov r8, rax
mov rdx, rbx
mov rcx, rsi
call fcn.1400074f0
mov r14, rax
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.1400057b0
mov r8, rax
mov rdx, rbx
mov rcx, rsi
call fcn.1400074f0
mov r15, rax
movdqa xmm0, xmmword [0x1400738b0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [str.P__c__vJyH_rL__P__c1_vJyH_rL__2__S]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x140073a50]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [str.LmIJ_UBA]
movdqa xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x70], 0x100
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 5]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x40
jb 0x14000a690
mov byte [rsp + 0x71], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
lea rdx, [0x140009a70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140005180]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x10], r12d
mov dword [rbp + 0x14], r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x10]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x14]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movdqa xmm0, xmmword [0x1400738b0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [str.P__c__vJyH_rL__P__c1_vJyH_rL__2__S]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x140073a90]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [str._EB__]
movdqa xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0x7662701
mov dword [rsp + 0x74], 0x612d0f
mov byte [rsp + 0x78], 1
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 5]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x47
jb 0x14000a780
mov byte [rsp + 0x78], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
lea rdx, [0x140009a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140073694]
call fcn.140004690
mov edx, dword [rbp + 0x14]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140005180]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400738b0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140073900]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x140073a80]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [str.HI_iE_]
movdqa xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0x555c7a1b
mov word [rsp + 0x74], 0x5a
mov byte [rsp + 0x76], 1
mov rdx, r12
nop word [rax + rax]
lea eax, [rdx - 5]
xor byte [rsp + rdx + 0x30], al
inc rdx
cmp rdx, 0x45
jb 0x14000a850
mov byte [rsp + 0x76], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov r8d, 7
lea rdx, str.setping
lea rcx, [rbp - 0x70]
call fcn.1400048f0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov r8d, 8
lea rdx, str.Settings
lea rcx, [rbp - 0x30]
call fcn.1400048f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0xa
lea rdx, str.Config.ini
lea rcx, [rsp + 0x30]
call fcn.1400048f0
nop
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call fcn.1400086b0
mov dword [rbp + 0x1c], eax
lea rcx, [rsp + 0x30]
call fcn.140005df0
nop
lea rcx, [rbp - 0x30]
call fcn.140005df0
nop
lea rcx, [rbp - 0x70]
call fcn.140005df0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 8
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
movabs rax, 0x32676e6970746573
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x38], 0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 8
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movabs rbx, 0x73676e6974746553
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x28], 0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], 0xa
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.Config.ini]
movsd qword [rbp - 0x70], xmm0
movzx eax, word [0x1400736b8]
mov word [rbp - 0x68], ax
mov byte [rbp - 0x66], 0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.1400086b0
mov dword [rbp + 0x20], eax
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000a9f5
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a9f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a9f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000aa44
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aa3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aa3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000aa84
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aa7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aa7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], 5
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov eax, dword [str.setpL]
mov dword [rbp - 0x70], eax
movzx eax, byte [0x1400736c0]
mov byte [rbp - 0x6c], al
mov byte [rbp - 0x6b], 0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 8
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x28], 0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0xa
lea rdx, str.Config.ini
lea rcx, [rsp + 0x30]
call fcn.1400048f0
nop
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call fcn.1400086b0
mov dword [rbp + 0x18], eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000ab49
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ab44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ab44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
movdqa xmm0, xmmword [0x1400737e0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000ab9b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ab95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ab95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000abd9
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000abd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000abd4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
mov edi, r12d
mov bl, 1
nop
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rdx, r14
mov rcx, rsi
test bl, bl
lea r8, [rbp + 0x1c]
jne 0x14000abfd
lea r8, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x18]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea ecx, [rdi + 1]
cmp edi, 0xf423e
jne 0x14000ac38
test bl, bl
sete bl
mov edi, r12d
test bl, bl
sete bl
jmp 0x14000abe0
mov edi, ecx
mov eax, 0x25bfafa3
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xd9038
cmp ecx, eax
jne 0x14000abe0
test bl, bl
sete bl
jmp 0x14000abe0