Function at 0x140034cb0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor r12d, r12d
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140034d2b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140034d2b
lea rdx, [0x1400f0d08]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140034d28
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140034d00
jmp 0x140034d2b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140035068
lea rdx, [0x1400f0d08]
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2140688]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], Ordinal_217
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x70], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140034eb0
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003610a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140034e4f
xor eax, eax
jmp 0x140034e8c
cmp rbx, 0x1000
jb 0x140034e84
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036110
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140034f43
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140034e8c
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140034f72
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003610a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140034f12
xor eax, eax
jmp 0x140034f52
cmp rbx, 0x1000
jb 0x140034f4a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036110
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140034f43
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140034f52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140035024
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003501b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003501b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x140035068
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140035060
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035060
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400350cb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400350cb
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400350c8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400350a0
jmp 0x1400350cb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140035408
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2053218]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], Ordinal_217
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140035250
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036116
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400351ef
xor eax, eax
jmp 0x14003522c
cmp rbx, 0x1000
jb 0x140035224
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003611c
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x1400352e3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003522c
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140035312
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036116
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400352b2
xor eax, eax
jmp 0x1400352f2
cmp rbx, 0x1000
jb 0x1400352ea
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003611c
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x1400352e3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400352f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x1400353c4
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400353bb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400353bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x140035408
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140035400
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035400
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003546b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003546b
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035468
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140035440
jmp 0x14003546b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400357a8
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2024890]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], Ordinal_217
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x1400355f0
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036122
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003558f
xor eax, eax
jmp 0x1400355cc
cmp rbx, 0x1000
jb 0x1400355c4
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036128
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140035683
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400355cc
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400356b2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036122
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140035652
xor eax, eax
jmp 0x140035692
cmp rbx, 0x1000
jb 0x14003568a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036128
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140035683
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140035692
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140035764
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003575b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003575b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x1400357a8
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400357a0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400357a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003580b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003580b
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035808
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400357e0
jmp 0x14003580b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140035b48
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2051258]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], Ordinal_217
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140035990
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003612e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003592f
xor eax, eax
jmp 0x14003596c
cmp rbx, 0x1000
jb 0x140035964
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036134
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140035a23
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003596c
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140035a52
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003612e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400359f2
xor eax, eax
jmp 0x140035a32
cmp rbx, 0x1000
jb 0x140035a2a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036134
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140035a23
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140035a32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140035b04
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140035afb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035afb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x140035b48
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140035b40
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035b40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140035bab
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140035bab
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035ba8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140035b80
jmp 0x140035bab
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140035ee8
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x206a778]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], Ordinal_217
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140035d30
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003613a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140035ccf
xor eax, eax
jmp 0x140035d0c
cmp rbx, 0x1000
jb 0x140035d04
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036104
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140035dc3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140035d0c
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140035df2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003613a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140035d92
xor eax, eax
jmp 0x140035dd2
cmp rbx, 0x1000
jb 0x140035dca
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036104
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140035dc3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140035dd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140035ea4
sub r15, rdi
sar r15, 2
lea rdx, [r15*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140035e9b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035e9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x140035ee8
sub r14, rsi
sar r14, 2
lea rdx, [r14*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140035ee0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035ee0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140035f4b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140035f4b
nop dword [rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035f48
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140035f20
jmp 0x140035f4b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400360f0
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], Ordinal_217
lea r14, [rbp + 0x240]
lea rdi, [rbp + 0x248]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x248], 2
lea rdx, [rbp + 0x248]
call fcn.1400417d0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov r8, rax
mov rdx, rdi
mov rcx, r14
call fcn.140041790
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x248], r12
lea rcx, [rbp + 0x248]
call fcn.140041670
nop
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
lea rax, [rbp + 0x248]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x250]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.140040cc0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140040bd0
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140034bb0
mov rdi, rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.140040bd0
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
lea rcx, [rsp + 0x50]
call fcn.140040b70
nop
lea rcx, [rsp + 0x30]
call fcn.140040b70
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3