Function at 0x14002b960
Capabilities:
Create thread
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x14009d040]
xor rax, rsp
mov qword [rbp + 0x1d8], rax
xor r12d, r12d
lea ecx, [r12 + 8]
call fcn.14002e420
lea rcx, [0x14002d560]
mov qword [rax], rcx
mov qword [rbp + 0x1b0], rax
lea rcx, [rbp + 0x1c8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14002cf60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x14002bfd4
movabs r13, 0x7fffffffffffffff
nop word [rax + rax]
mov byte [0x14009df50], 0
mov dword [rsp + 0x50], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14002bd8d
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14002bd8d
nop dword [rax + rax]
lea rsi, [0x14009df70]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], r12
mov r14, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x14002ba85
mov r14, qword [rsi]
mov rdi, qword [rsi + 0x10]
cmp rdi, r13
ja 0x14002bfc0
cmp rdi, 0xf
ja 0x14002babb
mov qword [rbp + 0x1a0], rdi
mov eax, 0xf
mov qword [rbp + 0x1a8], rax
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x190], xmm0
jmp 0x14002bb6f
mov qword [rbp + 0x1a8], 0xf
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14002bae5
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14002bb0c
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14002bb2e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14002bfac
mov rcx, rax
call fcn.14002e420
mov rcx, rax
test rax, rax
je 0x14002bfb9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14002bb3d
test rcx, rcx
je 0x14002bb3a
call fcn.14002e420
jmp 0x14002bb3d
mov rax, r12
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x1a0], rdi
mov qword [rbp + 0x1a8], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp + 0x1a8]
mov rdi, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x190]
cmp rax, 0xf
jbe 0x14002bb89
mov rdx, qword [rbp + 0x190]
lea r8, [rdi + rdx]
jmp 0x14002bb94
lea r8, [rdi + rcx]
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x30]
call fcn.14002c5f0
cmp qword [rax + 0x18], 7
jbe 0x14002bba8
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14002bbfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bbf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bfb2
call fcn.14002e76c
test ebx, ebx
jne 0x14002bd21
lea rdx, str.found_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002c290
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rdx, qword [rbp + 0x190]
mov r8, qword [rbp + 0x1a0]
mov rcx, rax
call fcn.14002cc00
mov rcx, rax
lea rdx, [0x14002c460]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x30]
call fcn.14002cf90
mov rcx, rax
call fcn.140027b90
mov rdi, rax
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
cmp eax, 0x80
je 0x14002bc98
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, rbx
test rdi, rdi
jne 0x14002bcee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x14002bd62
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bd5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002bd5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
cmp rdi, qword [rbp + 0x1b8]
je 0x14002bd17
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x14002bd62
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bd5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bfb9
call fcn.14002e76c
add rsi, 0x20
lea rax, [0x1400d9bb0]
cmp rsi, rax
jne 0x14002ba60
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x14002ba50
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14002bf87
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14002bf87
lea rdi, [0x14009d440]
nop dword [rax]
mov rdx, rdi
lea rcx, [rbp + 0x190]
call fcn.14002c170
nop
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
jbe 0x14002be0d
mov rdx, qword [rbp + 0x190]
mov rcx, rdx
jmp 0x14002be14
lea rcx, [rbp + 0x190]
mov r8, qword [rbp + 0x1a0]
add r8, rcx
lea rcx, [rsp + 0x30]
call fcn.14002c5f0
cmp qword [rax + 0x18], 7
jbe 0x14002be32
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14002be84
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002be7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bfc6
call fcn.14002e76c
test ebx, ebx
jne 0x14002bf1f
lea rdx, str.found_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002c290
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rdx, qword [rbp + 0x190]
mov r8, qword [rbp + 0x1a0]
mov rcx, rax
call fcn.14002cc00
mov rcx, rax
lea rdx, [0x14002c460]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x30]
call fcn.14002cf90
mov rcx, rax
call fcn.14002a670
mov rsi, rax
test rax, rax
je 0x14002bf1f
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x14002bf5c
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bf57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bfcd
call fcn.14002e76c
add rdi, 0x20
lea rax, str.GTA5.exe
cmp rdi, rax
jne 0x14002bde0
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x14002bdd2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x1b0], 0x3a98
lea rcx, [rbp + 0x1b0]
call fcn.14002c4a0
jmp 0x14002ba00
call fcn.1400275d0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027670
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [rbp + 0x1c8], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3