Function at 0x180047510
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Generate random numbers using a mersenne twister
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x1680
call fcn.180154180
sub rsp, rax
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1802242b8]
xor rax, rsp
mov qword [rbp + 0x1620], rax
xor eax, eax
mov dword [rbp + 0x14], eax
cmp edx, 1
jne 0x18004998c
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
movabs rax, 0x9ac1d25a439e1f3f
mov qword [rbp + 0x15c0], rax
movabs rax, 0xdc8c697bbe93abc8
mov qword [rbp + 0x15c8], rax
movabs rax, 0x4a60bbf4631f5079
mov qword [rbp + 0x15d0], rax
movabs rax, 0x898bc9fd38d65b42
mov qword [rbp + 0x15d8], rax
movabs rax, 0xb7afb7202aea765c
mov qword [rbp + 0x15a0], rax
movabs rax, 0xb2e51d0bd7e1c8bb
mov qword [rbp + 0x15a8], rax
movabs rax, 0x2604959516737d1e
mov qword [rbp + 0x15b0], rax
movabs rax, 0x898bc9fd38d65b2e
mov qword [rbp + 0x15b8], rax
movups xmm0, xmmword [rbp + 0x15a0]
movaps xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rbp + 0x15b0]
movaps xmmword [rbp + 0x150], xmm1
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x15c0]
vmovdqa ymmword [rbp + 0x140], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800476b3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800476b3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0x1d928a13
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800476ae
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180047690
cmp edi, 0x47c8a176
je 0x1800476b8
test r8d, r8d
jne 0x180047670
mov rax, qword [rax]
jmp 0x180047640
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
lea rcx, [rbp + 0x140]
call rdx
add rax, 0x64730
mov qword [0x1802265f8], rax
call fcn.180103b30
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180104050
lea rdx, [0x18003bc60]
lea rcx, [0x1802265f8]
call fcn.180103330
call fcn.180103ba0
mov dword [rbp + 0xc0], 1
movzx r15d, byte [rbp]
movzx r14d, byte [rbp]
movzx ebx, byte [rbp]
movzx esi, byte [rbp]
mov r12d, dword [rbp + 0x14]
lea r13, [0x180207848]
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rdi
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], dil
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], rdi
mov qword [rbp + 0x1d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1c0], dil
mov qword [rbp + 0x1e0], rdi
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1594], 0xffffffff
mov dword [rbp + 0x214], eax
lea edx, [rdi + 1]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x214], eax
inc rdx
cmp rdx, 0x270
jb 0x1800477a0
mov dword [rbp + 0x210], 0x270
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], 0
or r12d, 4
mov dword [rbp + 0x10], r12d
mov dword [rbp + 0x14], r12d
mov rdi, qword [section..data]
lea rax, [rbp + 0x210]
mov qword [rbp + 8], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 8]
call fcn.18001e020
movzx ecx, byte [rax + rdi]
mov qword [rbp + 0x30], 1
lea rax, [rbp + 0x20]
mov byte [rax], cl
mov byte [rax + 1], 0
mov rdi, qword [section..data]
lea rax, [rbp + 0x210]
mov qword [rbp + 8], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 8]
call fcn.18001e020
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x180047873
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180047885
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18001dac0
mov rdi, qword [section..data]
lea rax, [rbp + 0x210]
mov qword [rbp + 8], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 8]
call fcn.18001e020
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x1800478d7
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800478e9
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18001dac0
mov rdi, qword [section..data]
lea rax, [rbp + 0x210]
mov qword [rbp + 8], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 8]
call fcn.18001e020
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x18004793b
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18004794d
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18001dac0
mov rdi, qword [section..data]
lea rax, [rbp + 0x210]
mov qword [rbp + 8], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 8]
call fcn.18001e020
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
cmp rcx, rdx
jae 0x18004799f
lea rax, [rcx + 1]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800479b1
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x20]
call fcn.18001dac0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rdx, qword [rbp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1800479c6
lea rcx, [rbp + 0x1a0]
call fcn.18000e970
mov edi, dword [rbp + 0x10]
and edi, 0xfffffffb
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x180047a1e
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047a18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800484b2
call fcn.180153a5c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
xor r12d, r12d
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r12w
or edi, 2
mov dword [rbp + 0x10], edi
mov dword [rbp + 0x14], edi
mov word [rsp + 0x20], r12w
mov r9d, 0x105
movzx r8d, r15b
mov edx, r9d
lea rcx, [rbp + 0x140]
call fcn.180026aa0
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rcx, qword [rbp + 0x140]
call fcn.1801536dc
mov qword [rbp + 8], rax
mov ecx, eax
mov r8, qword [rbp + 0x150]
cmp rcx, r8
ja 0x180047ac0
lea rax, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rax, qword [rbp + 0x140]
mov qword [rbp + 0x150], rcx
mov word [rax + rcx*2], r12w
jmp 0x180047b2c
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp + 0x158]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x180047b10
mov qword [rbp + 0x150], rcx
lea r9, [rbp + 0x140]
cmp rdi, 8
cmovae r9, qword [rbp + 0x140]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x180047b05
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x180047b29
mov word [rsp + 0x20], r12w
mov r9, rdx
movzx r8d, r14b
lea rcx, [rbp + 0x140]
call fcn.180026aa0
mov edi, dword [rbp + 0x10]
mov eax, dword [rbp + 0xc]
cmp eax, 0xffffffff
jne 0x180047b53
mov dword [rbp + 0xd0], reloc.WS2_32.dll_sendto
mov qword [rbp + 0xd8], r13
movaps xmm0, xmmword [rbp + 0xd0]
mov eax, reloc.WS2_32.dll_sendto
jmp 0x180047b65
mov dword [rbp + 0x50], eax
lea rcx, [0x180207858]
mov qword [rbp + 0x58], rcx
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x20], xmm0
and edi, 0xfffffffd
or edi, 1
mov dword [rbp + 0x14], edi
test eax, eax
jne 0x1800499e3
lea r13, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae r13, qword [rbp + 0x140]
mov r12, qword [rbp + 0x150]
call fcn.180152fbc
mov dword [rbp + 8], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x15a0], xmm0
xor ecx, ecx
mov qword [rbp + 0x15b0], rcx
mov qword [rbp + 0x15b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x15a0], cl
or edi, 0x40
mov dword [rbp + 0x10], edi
mov dword [rbp + 0x14], edi
test r12, r12
je 0x180047c59
cmp r12, 0x7fffffff
ja 0x1800499d8
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
mov ecx, eax
call fcn.18015302c
mov rdi, rax
mov qword [rbp + 0x20], rax
shr rax, 0x20
test eax, eax
jne 0x180049a04
movsxd rdx, edi
xor r8d, r8d
lea rcx, [rbp + 0x15a0]
call fcn.180044ce0
lea r9, [rbp + 0x15a0]
cmp qword [rbp + 0x15b8], 0x10
cmovae r9, qword [rbp + 0x15a0]
mov dword [rsp + 0x20], edi
mov r8d, r12d
mov rdx, r13
mov ecx, dword [rbp + 8]
call fcn.18015302c
mov qword [rbp + 8], rax
shr rax, 0x20
test eax, eax
jne 0x1800499fb
mov edi, dword [rbp + 0x10]
and edi, 0xffffffbf
or edi, 0x38
mov dword [rbp + 0x14], edi
mov qword [rbp + 8], 0xa
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1594], 0xffffffff
mov dword [rbp + 0x214], eax
mov edx, 1
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x214], eax
inc rdx
cmp rdx, 0x270
jb 0x180047c90
mov dword [rbp + 0x210], 0x270
xorps xmm0, xmm0
movups xmmword [rbp + 0x15c0], xmm0
xor r13d, r13d
mov qword [rbp + 0x15d0], r13
mov r12d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x15d8], r12
mov byte [rbp + 0x15c0], r13b
bts edi, 7
mov dword [rbp + 0x10], edi
mov dword [rbp + 0x14], edi
mov rbx, qword [rbp + 8]
dec rbx
mov rdi, qword [section..data]
lea rax, [rbp + 0x210]
mov qword [rbp + 8], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rbp + 8]
call fcn.18001e020
movzx r9d, byte [rdi + rax]
cmp r13, r12
jae 0x180047d49
lea rax, [r13 + 1]
mov qword [rbp + 0x15d0], rax
lea rax, [rbp + 0x15c0]
cmp r12, 0x10
cmovae rax, qword [rbp + 0x15c0]
mov byte [rax + r13], r9b
mov byte [rax + r13 + 1], 0
jmp 0x180047d5e
movzx r8d, sil
mov edx, 1
lea rcx, [rbp + 0x15c0]
call fcn.18001dac0
test rbx, rbx
je 0x180047d76
mov r12, qword [rbp + 0x15d8]
mov r13, qword [rbp + 0x15d0]
jmp 0x180047cf2
lea rdx, [rbp + 0x15c0]
cmp qword [rbp + 0x15d8], 0x10
cmovae rdx, qword [rbp + 0x15c0]
mov r8, qword [rbp + 0x15d0]
lea rcx, [rbp + 0x15a0]
call fcn.18000dc80
lea rcx, [rbp + 0x1c0]
cmp rcx, rax
movzx ebx, byte [rbp]
je 0x180047dcd
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x180047dbe
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.18000e970
mov r12d, dword [rbp + 0x10]
btr r12d, 7
mov rdx, qword [rbp + 0x15d8]
cmp rdx, 0x10
jb 0x180047e18
inc rdx
mov rcx, qword [rbp + 0x15c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047e12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800484b9
call fcn.180153a5c
nop
mov rdx, qword [rbp + 0x15b8]
cmp rdx, 0x10
jb 0x180047e59
inc rdx
mov rcx, qword [rbp + 0x15a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047e54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800484c0
call fcn.180153a5c
mov qword [rbp + 0x15b0], 0
mov qword [rbp + 0x15b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x15a0], 0
and r12d, 0xfffffffe
mov dword [rbp + 0x14], r12d
lea rcx, [rbp + 0x140]
call fcn.18000dad0
mov r13, qword [0x180207180]
cmp r13, qword [0x180207188]
je 0x180047ee3
mov qword [rbp + 0x20], r13
lea rdx, [rbp + 0x1a0]
mov rcx, r13
call fcn.18000de40
nop
lea rcx, [r13 + 0x20]
lea rdx, [rbp + 0x1c0]
call fcn.18000de40
nop
mov rdi, qword [rbp + 0x1e0]
mov qword [r13 + 0x40], rdi
test rdi, rdi
je 0x180047ed9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
nop
add qword [0x180207180], 0x48
jmp 0x180047f00
lea r8, [rbp + 0x1a0]
mov rdx, r13
lea rcx, [0x180207178]
call fcn.180020b30
mov rdi, qword [rbp + 0x1e0]
test rdi, rdi
je 0x180047f0f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x180047f50
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047f4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800484c7
call fcn.180153a5c
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x180047f91
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047f8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800484c7
call fcn.180153a5c
mov edi, dword [rbp + 0xc0]
inc edi
mov dword [rbp + 0xc0], edi
cmp edi, 0x28
jle 0x180047730
movdqa xmm0, xmmword [0x1801a83c0]
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x43534d45
mov dword [rbp + 0x64], 0x46454c09
mov word [rbp + 0x68], 0x100
xor r12d, r12d
mov ecx, r12d
nop
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0x50], al
inc rcx
cmp rcx, 0x18
jb 0x180047fd0
mov byte [rbp + 0x69], r12b
lea r9, [rbp]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x15a0]
call fcn.18000f600
lea rdx, [rbp + 0x15a0]
lea rcx, [rbp + 0xa0]
call fcn.18002d850
mov r8, qword [rax]
movdqa xmm0, xmmword [0x1801a83c0]
movdqu xmmword [rbp + 0xd0], xmm0
mov dword [rbp + 0xe0], 0x43534d45
mov dword [rbp + 0xe4], 0x46454c09
mov word [rbp + 0xe8], 0x100
mov rcx, r12
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0xd0], al
inc rcx
cmp rcx, 0x18
jb 0x180048042
mov byte [rbp + 0xe9], r12b
lea rdx, [rbp + 0xd0]
lea rcx, [rbp]
call fcn.1800325c0
movdqa xmm0, xmmword [0x1801a8620]
movdqu xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xb0], 0x420b4155
mov dword [rbp + 0xb4], 0x100444b
mov rcx, r12
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0xa0], al
inc rcx
cmp rcx, 0x16
jb 0x180048093
mov byte [rbp + 0xb7], r12b
lea r9, [rbp]
lea r8, [rbp + 0xb6]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x15a0]
call fcn.18000f600
lea rdx, [rbp + 0x15a0]
lea rcx, [rbp + 0x70]
call fcn.18002d850
mov r8, qword [rax]
movdqa xmm0, xmmword [0x1801a8620]
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x420b4155
mov dword [rbp + 0x64], 0x100444b
mov rcx, r12
nop dword [rax]
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0x50], al
inc rcx
cmp rcx, 0x16
jb 0x180048100
mov byte [rbp + 0x67], r12b
lea rdx, [rbp + 0x50]
lea rcx, [rbp]
call fcn.1800325c0
movdqa xmm0, xmmword [0x1801a8600]
movdqu xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xb0], 0x49460950
mov dword [rbp + 0xb4], 0x4e074d55
mov dword [rbp + 0xb8], 0x1004047
lea rdx, [rbp + 0x15a0]
lea rcx, [rbp + 0xa0]
call fcn.18002eef0
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.18002d850
mov r8, qword [rax]
movdqa xmm0, xmmword [0x1801a8600]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x49460950
mov dword [rbp + 0x84], 0x4e074d55
mov dword [rbp + 0x88], 0x1004047
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0x70], al
inc rcx
cmp rcx, 0x1a
jb 0x1800481b0
mov byte [rbp + 0x8b], r12b
lea rdx, [rbp + 0x70]
lea rcx, [rbp]
call fcn.1800325c0
movdqa xmm0, xmmword [0x1801a8640]
movdqu xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x53490944
mov dword [rbp + 0x84], 0x464d0646
mov word [rbp + 0x88], Ordinal_79
mov byte [rbp + 0x8a], 1
lea rdx, [rbp + 0x15a0]
lea rcx, [rbp + 0x70]
call fcn.18002eeb0
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.18002d850
mov r8, qword [rax]
movdqa xmm0, xmmword [0x1801a8640]
movdqu xmmword [rbp + 0x110], xmm0
mov dword [rbp + 0x120], 0x53490944
mov dword [rbp + 0x124], 0x464d0646
mov word [rbp + 0x128], Ordinal_79
mov byte [rbp + 0x12a], 1
mov rcx, r12
nop
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0x110], al
inc rcx
cmp rcx, 0x19
jb 0x180048260
mov byte [rbp + 0x12a], r12b
lea rdx, [rbp + 0x110]
lea rcx, [rbp]
call fcn.1800325c0
mov dword [rbp + 0x90], 0x737d7072
mov dword [rbp + 0x94], 0x7f6f7164
mov dword [rbp + 0x98], 0x72717835
mov word [rbp + 0x9c], 0x100
lea rdx, [rbp + 0x15a0]
lea rcx, [rbp + 0x90]
call fcn.18002ef30
mov rdx, rax
lea rcx, [rbp + 0x1f0]
call fcn.18002d850
mov r8, qword [rax]
mov dword [rbp + 0x40], 0x737d7072
mov dword [rbp + 0x44], 0x7f6f7164
mov dword [rbp + 0x48], 0x72717835
mov word [rbp + 0x4c], 0x100
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180048300
mov byte [rbp + 0x4d], r12b
lea rdx, [rbp + 0x40]
lea rcx, [rbp]
call fcn.1800325c0
movdqa xmm0, xmmword [str._5.U8_____]
movdqu xmmword [rbp + 0x15c0], xmm0
movdqa xmm1, xmmword [0x1801a8360]
movdqu xmmword [rbp + 0x15d0], xmm1
mov dword [rbp + 0x15e0], 0x60c1405
mov word [rbp + 0x15e4], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0x15c0], al
inc rcx
cmp rcx, 0x24
jb 0x180048360
mov byte [rbp + 0x15e5], r12b
movdqa xmm0, xmmword [0x1801a8600]
movdqu xmmword [rbp + 0xf0], xmm0
mov dword [rbp + 0x100], 0x49460950
mov dword [rbp + 0x104], 0x4e074d55
mov dword [rbp + 0x108], 0x1004047
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rbp + rcx + 0xf0], al
inc rcx
cmp rcx, 0x1a
jb 0x1800483b0
mov byte [rbp + 0x10b], r12b
lea r9, [rbp]
lea r8, [rbp + 0x10a]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x15a0]
call fcn.18000f600
nop
lea rdx, [rbp + 0x15a0]
lea rcx, [0x1802264a8]
call fcn.18002ed70
mov rbx, qword [rax]
test rbx, rbx
je 0x1800484ea
movsxd rax, dword [rbx + 0x3c]
mov edi, dword [rax + rbx + 0x50]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], rax
lea r8, [rbp + 0x15c0]
lea rdx, [rbp + 0x1f0]
lea rcx, [0x18022a770]
call fcn.1800301e0
mov r9, qword [rbp + 0x1f8]
mov r10, qword [rbp + 0x1f0]
sub r9, r10
sar r9, 2
inc dword [0x180226c5c]
mov r11d, edi
sub r11, r9
je 0x1800484de
mov edx, r12d
mov r8d, r12d
test r9, r9
je 0x18004849e
nop
mov rax, r12
nop dword [rax]
nop word [rax + rax]
mov edi, dword [r10 + rax*4]
lea eax, [rdx + r8]
movzx eax, byte [rax + rbx]
cmp eax, edi
je 0x180048495
cmp edi, 0xffffffff
jne 0x1800484ce
inc edx
mov eax, edx
cmp rax, r9
jb 0x180048480
mov edi, r8d
add rdi, rbx
lea rcx, [rbp + 0x1f0]
call fcn.1800122d0
jmp 0x1800484ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
inc r8d
mov eax, r8d
cmp rax, r11
jae 0x1800484de
mov edx, r12d
jmp 0x180048470
lea rcx, [rbp + 0x1f0]
call fcn.1800122d0
mov rdi, r12
lea rcx, [rbp + 0x15a0]
call fcn.18000dda0
movsxd rcx, dword [rdi + 3]
add rcx, 7
add rcx, rdi
lea rax, vtable.._AV___Func_impl_no_alloc_V_lambda_1___6____Connect_V_lambda_3___4__DllMain__YAEPEAUHINSTANCE____KPEAX_Z____fwEvent_PEAVResource_fx____QEAA_A_PV_lambda_3___4__DllMain__YAEPEAUHINSTANCE____KPEAX_Z_H_Z__NPEAVResource_fx___std__.0
mov qword [rbp + 0x140], rax
movzx eax, byte [rbp]
mov byte [rbp + 0x148], al
lea rax, [rbp + 0x140]
mov qword [rbp + 0x178], rax
xor r8d, r8d
lea rdx, [rbp + 0x140]
call fcn.1800353e0
mov rax, qword [0x18022a790]
test rax, rax
jne 0x1800485f6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
mov r8, qword [rbx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r11d, dword [rax + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x1800485d6
mov edi, dword [r11 + 0x18]
test edi, edi
je 0x1800485d6
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec edi
lea rax, [r8 + rdi*4]
mov ecx, dword [rax + r10]
add rcx, r8
mov edx, 0xa436bd8f
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1800485d2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1800485b0
cmp edx, 0x7c46c13a
je 0x1800487e8
test edi, edi
jne 0x180048590
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x1800485ec
cmp qword [rax + 0x30], 0
jne 0x180048560
mov rax, r12
mov qword [0x18022a790], rax
movabs rdi, 0x9ac1d25a439e1f3f
mov qword [rbp + 0x15a0], rdi
movabs rbx, 0xdc8c697bbe93abc8
mov qword [rbp + 0x15a8], rbx
movabs rsi, 0x4a60bbf4631f5079
mov qword [rbp + 0x15b0], rsi
movabs r14, 0x898bc9fd38d65b42
mov qword [rbp + 0x15b8], r14
movabs r15, 0xb7afb7202aea765c
mov qword [rbp + 0x1600], r15
movabs rcx, 0xb2e51d0bd7e1c8bb
mov qword [rbp + 0x1608], rcx
movabs rcx, 0x2604959516737d1e
mov qword [rbp + 0x1610], rcx
movabs rcx, 0x898bc9fd38d65b2e
mov qword [rbp + 0x1618], rcx
movups xmm0, xmmword [rbp + 0x1600]
movaps xmmword [rbp + 0x15c0], xmm0
movups xmm1, xmmword [rbp + 0x1610]
movaps xmmword [rbp + 0x15d0], xmm1
vmovdqu ymm0, ymmword [rbp + 0x15a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x15c0]
vmovdqa ymmword [rbp + 0x15c0], ymm1
lea rcx, [rbp + 0x15c0]
vzeroupper
call rax
add rax, 0x99db0
mov qword [0x180226c70], rax
mov qword [rbp + 0x1600], rdi
mov qword [rbp + 0x1608], rbx
mov qword [rbp + 0x1610], rsi
mov qword [rbp + 0x1618], r14
mov qword [rbp + 0x180], r15
movabs rax, 0xbde21b1ec7f2c7b8
mov qword [rbp + 0x188], rax
movabs rax, 0x2f16d2924e6c3514
mov qword [rbp + 0x190], rax
movabs rax, 0x898bc9fd54ba3f6c
mov qword [rbp + 0x198], rax
movups xmm0, xmmword [rbp + 0x180]
movaps xmmword [rbp + 0x15a0], xmm0
movups xmm1, xmmword [rbp + 0x190]
movaps xmmword [rbp + 0x15b0], xmm1
vmovdqu ymm0, ymmword [rbp + 0x1600]
vpxor ymm1, ymm0, ymmword [rbp + 0x15a0]
vmovdqa ymmword [rbp + 0x15a0], ymm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
vzeroupper
nop dword [rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800487e3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800487e3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov ecx, dword [rcx + r9]
add rcx, r9
mov edi, 0x88a81c2e
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800487de
nop dword [rax]
movsx edx, dl
xor edx, edi
imul edi, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1800487c0
cmp edi, 0xc218d833
je 0x180048805
test r8d, r8d
jne 0x1800487a0
mov rax, qword [rax]
jmp 0x180048770
mov ecx, dword [r11 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x1800485ef
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, [rbp + 0x15a0]
call rax
mov qword [0x1802265f0], rax
add rax, 0x15300
mov qword [0x180227350], rax
mov byte [0x1802273b8], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov ebx, dword [rdx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800488d3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800488d3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
mov edi, 0x60c4f33
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1800488ce
nop dword [rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x1800488b0
cmp edi, 0xb0baaa96
je 0x1800488d8
test r8d, r8d
jne 0x180048890
mov rcx, qword [rcx]
jmp 0x180048860
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b3095_GTAProcess.exe
call rax
test rax, rax
je 0x1800489de
mov byte [0x18022734c], 1
lea rax, [rsi + 0x79bb34]
mov qword [0x180227368], rax
lea rax, [rsi + 0x2593320]
mov qword [0x180227358], rax
lea rax, [rsi + 0x20019e0]
mov qword [0x180227378], rax
lea rax, [rsi + 0x1f58b58]
mov qword [0x180227360], rax
lea rax, [rsi + 0x20025b8]
mov qword [0x180227370], rax
lea rax, [rsi + 0x1624f80]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x1098
mov dword [0x180227380], 0x150c
mov dword [0x18022738c], 0xd10
mov dword [0x180227388], 0x10b8
mov dword [0x180227390], 0x10c8
mov dword [0x180227394], 0x2f4
mov dword [0x180227398], 0x84
mov dword [0x1802273ac], 0x134
mov dword [0x18022739c], 0x20
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5f0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180048a63
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180048a63
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0x6c6b5e79
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180048a5e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180048a40
cmp edi, 0xb45f2468
je 0x180048a68
test r8d, r8d
jne 0x180048a20
mov rax, qword [rax]
jmp 0x1800489f0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2802_GTAProcess.exe
call rax
test rax, rax
je 0x180048b6e
lea rax, [rsi + 0x794784]
mov qword [0x180227368], rax
lea rax, [rsi + 0x254d448]
mov qword [0x180227358], rax
lea rax, [rsi + 0x1fbc100]
mov qword [0x180227378], rax
lea rax, [rsi + 0x1f5b820]
mov qword [0x180227360], rax
lea rax, [rsi + 0x1fbccd8]
mov qword [0x180227370], rax
lea rax, [rsi + 0x15ea2a5]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x1098
mov dword [0x180227380], 0x150c
mov dword [0x18022738c], 0xd10
mov dword [0x180227388], 0x10b8
mov dword [0x180227390], 0x10a8
mov dword [0x180227394], 0x2f4
mov dword [0x180227398], 0x84
mov dword [0x1802273ac], 0x134
mov dword [0x18022739c], 0x20
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5f0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x28c
mov byte [0x1802273b8], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180048bf3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180048bf3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0x596f9367
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180048bee
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180048bd0
cmp edi, 0x1a8dff92
je 0x180048bf8
test r8d, r8d
jne 0x180048bb0
mov rax, qword [rax]
jmp 0x180048b80
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2944_GTAProcess.exe
call rax
test rax, rax
je 0x180048cfe
lea rax, [rsi + 0x795f9c]
mov qword [0x180227368], rax
lea rax, [rsi + 0x257bea0]
mov qword [0x180227358], rax
lea rax, [rsi + 0x1feaac0]
mov qword [0x180227378], rax
lea rax, [rsi + 0x1f42068]
mov qword [0x180227360], rax
lea rax, [rsi + 0x1feb968]
mov qword [0x180227370], rax
lea rax, [rsi + 0x160ff90]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x1098
mov dword [0x180227380], 0x150c
mov dword [0x18022738c], 0xd10
mov dword [0x180227388], 0x10b8
mov dword [0x180227390], 0x10a8
mov dword [0x180227394], 0x2f4
mov dword [0x180227398], 0x84
mov dword [0x1802273ac], 0x134
mov dword [0x18022739c], 0x20
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5f0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x28c
mov byte [0x1802273b8], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180048d83
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180048d83
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xd9dcb7bb
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180048d7e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180048d60
cmp edi, 0xb34dfc5e
je 0x180048d88
test r8d, r8d
jne 0x180048d40
mov rax, qword [rax]
jmp 0x180048d10
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2699_GTAProcess.exe
call rax
test rax, rax
je 0x180048e87
lea rax, [rsi + 0x78f450]
mov qword [0x180227368], rax
lea rax, [rsi + 0x26684d8]
mov qword [0x180227358], rax
lea rax, [rsi + 0x20d8c90]
mov qword [0x180227378], rax
lea rax, [rsi + 0x20304c8]
mov qword [0x180227360], rax
lea rax, [rsi + 0x20d9868]
mov qword [0x180227370], rax
lea rax, [rsi + 0x15d6cec]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x10b8
mov dword [0x180227380], 0x1530
mov dword [0x18022738c], 0xd30
mov dword [0x180227388], 0x10d8
mov dword [0x180227390], 0x10c8
mov dword [0x180227394], 0x2f4
mov dword [0x180227398], 0x84
mov dword [0x1802273ac], 0x134
mov dword [0x18022739c], 0x20
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5f0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180048f13
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180048f13
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r11 + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov edi, 0xb12ef59e
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180048f0e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180048ef0
cmp edi, 0xb70aba23
je 0x180048f18
test r8d, r8d
jne 0x180048ed0
mov rax, qword [rax]
jmp 0x180048ea0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2612_GTAProcess.exe
call rax
test rax, rax
je 0x180049017
lea rax, [rsi + 0x78c758]
mov qword [0x180227368], rax
lea rax, [rsi + 0x2567db0]
mov qword [0x180227358], rax
lea rax, [rsi + 0x1fd8570]
mov qword [0x180227378], rax
lea rax, [rsi + 0x1f77ef0]
mov qword [0x180227360], rax
lea rax, [rsi + 0x1fd9148]
mov qword [0x180227370], rax
lea rax, [rsi + 0x15dfe20]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x10b8
mov dword [0x180227380], 0x1530
mov dword [0x18022738c], 0xd30
mov dword [0x180227388], 0x10d8
mov dword [0x180227390], 0x10c8
mov dword [0x180227394], 0x2f4
mov dword [0x180227398], 0x84
mov dword [0x1802273ac], 0x134
mov dword [0x18022739c], 0x20
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5f0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800490a3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800490a3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0xb3dc8f5e
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18004909e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180049080
cmp edi, 0x2afd2ee3
je 0x1800490a8
test r8d, r8d
jne 0x180049060
mov rax, qword [rax]
jmp 0x180049030
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2545_GTAProcess.exe
call rax
test rax, rax
je 0x1800491a7
lea rax, [rsi + 0x78c5e4]
mov qword [0x180227368], rax
lea rax, [rsi + 0x25667e8]
mov qword [0x180227358], rax
lea rax, [rsi + 0x1fd6f70]
mov qword [0x180227378], rax
lea rax, [rsi + 0x1f2e7a8]
mov qword [0x180227360], rax
lea rax, [rsi + 0x1fd7b48]
mov qword [0x180227370], rax
lea rax, [rsi + 0x15deeb0]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x10b8
mov dword [0x180227380], 0x1530
mov dword [0x18022738c], 0xd30
mov dword [0x180227388], 0x10d8
mov dword [0x180227390], 0x10c8
mov dword [0x180227394], 0x2f4
mov dword [0x180227398], 0x84
mov dword [0x1802273ac], 0x134
mov dword [0x18022739c], 0x20
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5f0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180049233
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180049233
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0xc3e5ab75
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18004922e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180049210
cmp edi, 0x769d5d2c
je 0x180049238
test r8d, r8d
jne 0x1800491f0
mov rax, qword [rax]
jmp 0x1800491c0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2372_GTAProcess.exe
call rax
test rax, rax
je 0x180049337
lea rax, [rsi + 0x787fe4]
mov qword [0x180227368], rax
lea rax, [rsi + 0x252dcd8]
mov qword [0x180227358], rax
lea rax, [rsi + 0x1f9e9f0]
mov qword [0x180227378], rax
lea rax, [rsi + 0x1f05208]
mov qword [0x180227360], rax
lea rax, [rsi + 0x1f9f5c8]
mov qword [0x180227370], rax
lea rax, [rsi + 0x15cd2c0]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x10b8
mov dword [0x180227380], 0x14e0
mov dword [0x18022738c], 0xd30
mov dword [0x180227388], 0x10d8
mov dword [0x180227390], 0x10c8
mov dword [0x180227394], 0x2f4
mov dword [0x180227398], 0x84
mov dword [0x1802273ac], 0x134
mov dword [0x18022739c], 0x20
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5f0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800493c3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800493c3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0xda6b377
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800493be
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800493a0
cmp edi, 0xb2b567e2
je 0x1800493c8
test r8d, r8d
jne 0x180049380
mov rax, qword [rax]
jmp 0x180049350
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2189_GTAProcess.exe
call rax
test rax, rax
je 0x1800494d1
lea rax, [rsi + 0x79b5dc]
mov qword [0x180227368], rax
lea rax, [rsi + 0x24e6d90]
mov qword [0x180227358], rax
lea rax, [rsi + 0x1f888c0]
mov qword [0x180227378], rax
lea rax, [rsi + 0x1ee18a8]
mov qword [0x180227360], rax
lea rax, [rsi + 0x1f89498]
mov qword [0x180227370], rax
lea rax, [rsi + 0x15b1008]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x10b8
mov dword [0x180227380], 0x14e0
mov dword [0x18022738c], 0xd30
mov dword [0x180227388], 0x10d8
mov dword [0x180227390], 0x10c8
mov dword [0x180227394], 0x2f4
mov dword [0x180227398], 0x84
mov dword [0x1802273ac], 0x134
mov dword [0x18022739c], 0x20
mov dword [0x1802273b4], 0x908
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5f0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180049563
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180049563
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0xd3846914
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18004955e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180049540
cmp edi, 0xe387be9d
je 0x180049568
test r8d, r8d
jne 0x180049520
mov rax, qword [rax]
jmp 0x1800494f0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_b2060_GTAProcess.exe
call rax
test rax, rax
je 0x180049667
lea rax, [rsi + 0x7935d0]
mov qword [0x180227368], rax
lea rax, [rsi + 0x24c8858]
mov qword [0x180227358], rax
lea rax, [rsi + 0x1f6a7e0]
mov qword [0x180227378], rax
lea rax, [rsi + 0x1ec3828]
mov qword [0x180227360], rax
lea rax, [rsi + 0x1f6b3c0]
mov qword [0x180227370], rax
lea rax, [rsi + 0x159b224]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x10b8
mov dword [0x180227380], 0x14e0
mov dword [0x18022738c], 0xd30
mov dword [0x180227388], 0x10d8
mov dword [0x180227390], 0x10c8
mov dword [0x180227394], 0x2f4
mov dword [0x180227398], 0x84
mov dword [0x1802273ac], 0x134
mov dword [0x18022739c], 0x20
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5f0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x28c
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800496f3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800496f3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0x5879427d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800496ee
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800496d0
cmp edi, 0x7cba9d4
je 0x1800496f8
test r8d, r8d
jne 0x1800496b0
mov rax, qword [rax]
jmp 0x180049680
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_GTAProcess.exe
call rax
test rax, rax
jne 0x1800497e1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800497b3
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800497b3
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r11]
add rdx, r9
mov edi, 0x49792ae0
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800497ae
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180049790
cmp edi, 0x82504d81
je 0x1800497b8
test r8d, r8d
jne 0x180049770
mov rax, qword [rax]
jmp 0x180049740
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
lea rcx, str.FiveM_GameProcess.exe
call rax
test rax, rax
je 0x1800498b7
lea rax, [rsi + 0x779d64]
mov qword [0x180227368], rax
lea rax, [rsi + 0x247f840]
mov qword [0x180227358], rax
lea rax, [rsi + 0x2087780]
mov qword [0x180227378], rax
lea rax, [rsi + 0x1efd4c8]
mov qword [0x180227360], rax
lea rax, [rsi + 0x20d9868]
mov qword [0x180227370], rax
lea rax, [rsi + 0x1561e30]
mov qword [0x1802273c8], rax
mov dword [0x180227384], 0x10a8
mov dword [0x180227380], 0x14b8
mov dword [0x18022738c], 0xd30
mov dword [0x180227388], 0x10c8
mov dword [0x180227390], 0x10b8
mov dword [0x180227394], 0x2e8
mov dword [0x180227398], 0x74
mov dword [0x1802273ac], 0x12c
mov dword [0x18022739c], 0x20
mov dword [0x1802273a4], 0x24
mov dword [0x1802273a0], 0x5e0
mov dword [0x1802273b0], 0x146b
mov dword [0x1802273a8], 0x25c
mov rax, qword [0x18022a788]
test rax, rax
jne 0x180049972
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop
mov r8, qword [rbx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r11d, dword [rax + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x180049952
mov edi, dword [r11 + 0x18]
test edi, edi
je 0x180049952
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec edi
lea rax, [r8 + rdi*4]
mov ecx, dword [rax + r10]
add rcx, r8
mov edx, 0xde46b9d2
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18004994e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x180049930
cmp edx, 0xd7baec7d
je 0x1800499be
test edi, edi
jne 0x180049910
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x180049968
cmp qword [rax + 0x30], 0
jne 0x1800498e0
mov rax, r12
mov qword [0x18022a788], rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1800409c0]
xor edx, edx
xor ecx, ecx
call rax
mov al, 1
mov rcx, qword [rbp + 0x1620]
xor rcx, rsp
call fcn.180153af0
lea r11, [rsp + 0x1680]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x18004996b
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.18003f1c0
nop
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x20]
lea rcx, str.temp_directory_path
call fcn.18003f090
nop
mov ecx, dword [rbp + 0xc]
call fcn.18003f200
int3
mov ecx, dword [rbp + 0x24]
call fcn.18003f200
int3