Function at 0x14000a950
Capabilities:
Encode data using xor
Enumerate processes
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140153568], rax
test rax, rax
jne 0x14000a9b6
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Fivem_not_found__start_fivem_before_load_
call fcn.140006d10
mov rax, qword [0x140153568]
lea rdx, [0x140153558]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x140153558]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x60], 0x238
mov qword [0x140153550], rax
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov r14d, 1
test eax, eax
je 0x14000aa4f
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000aa4f
lea rdx, [0x140059458]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000aa23
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000ab50
xor ebx, ebx
mov byte [0x140153548], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2545_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.140006ee0
lea rdx, [rsp + 0x30]
lea rcx, [0x140153550]
call fcn.14000bc60
mov rcx, qword [0x140153550]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x140153560], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x25667e8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1f2e7a8
mov qword [0x140153500], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1fd6f70
mov qword [0x140153508], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140153510], rax
mov qword [0x140153540], 0x1fd7b48
jmp 0x14000b38d
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000abbc
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000abbc
nop dword [rax]
lea rdx, [0x1400594b0]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000ab90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000acbd
xor ebx, ebx
mov byte [0x140153548], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.140006ee0
lea rdx, [rsp + 0x30]
lea rcx, [0x140153550]
call fcn.14000bc60
mov rcx, qword [0x140153550]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x140153560], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x26684d8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x20304c8
mov qword [0x140153500], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x20d8c90
mov qword [0x140153508], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140153510], rax
mov qword [0x140153540], 0x20d9868
jmp 0x14000b38d
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000ad2c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000ad2c
nop dword [rax]
lea rdx, [0x140059508]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000ad00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000adb6
xor ebx, ebx
mov byte [0x140153548], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x14]
movups xmmword [rsp + 0x30], xmm0
call fcn.140006ee0
lea rdx, [rsp + 0x30]
lea rcx, [0x140153550]
call fcn.14000bc60
mov rcx, qword [0x140153550]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x140153560], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x247f840]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
add rdx, 0x1efd4c8
jmp 0x14000aea7
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000ae1e
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000ae1e
lea rdx, [0x140059550]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000adf2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000af2e
xor ebx, ebx
mov byte [0x140153548], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2060_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.140006ee0
lea rdx, [rsp + 0x30]
lea rcx, [0x140153550]
call fcn.14000bc60
mov rcx, qword [0x140153550]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x140153560], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x24c8858]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
add rdx, 0x1ec3828
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
mov r9d, 8
mov qword [0x140153500], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r8, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
add rdx, 0x2087780
mov rcx, qword [0x140153550]
mov r9d, 8
mov qword [0x140153508], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140153510], rax
mov qword [0x140153540], 0x20d9868
mov qword [0x140153520], 0xd28
jmp 0x14000b398
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000af9c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000af9c
nop word [rax + rax]
lea rdx, [0x1400595a8]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000af70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000b09d
xor ebx, ebx
mov byte [0x140153548], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2372_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.140006ee0
lea rdx, [rsp + 0x30]
lea rcx, [0x140153550]
call fcn.14000bc60
mov rcx, qword [0x140153550]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x140153560], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x252dcd8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1f05208
mov qword [0x140153500], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1f9e9f0
mov qword [0x140153508], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140153510], rax
mov qword [0x140153540], 0x1fd8570
jmp 0x14000b38d
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000b10c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000b10c
nop dword [rax]
lea rdx, [0x140059600]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000b0e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000b204
xor ebx, ebx
mov byte [0x140153548], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.140006ee0
lea rdx, [rsp + 0x30]
lea rcx, [0x140153550]
call fcn.14000bc60
mov rcx, qword [0x140153550]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x140153560], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x2567db0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1f77ef0
mov qword [0x140153500], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1fd8570
mov qword [0x140153508], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
add rdx, 0x20d9868
jmp 0x14000b358
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000b26c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000b26c
lea rdx, [0x140059658]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000b240
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000b3eb
xor ebx, ebx
mov byte [0x140153548], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2189_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.140006ee0
lea rdx, [rsp + 0x30]
lea rcx, [0x140153550]
call fcn.14000bc60
mov rcx, qword [0x140153550]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x140153560], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x24e6d90]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1ee18a8
mov qword [0x140153500], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1f888c0
mov qword [0x140153508], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
mov r9d, 8
mov qword [0x140153510], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140153540], rax
mov qword [0x140153520], 0xd30
mov rcx, qword [0x140153550]
lea r8, [rsp + 0x50]
mov qword [0x140153528], 0x908
mov r9d, 8
mov qword [0x140153530], 0x938
mov rdx, qword [rdi]
add rdx, 8
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140153518], rax
mov qword [rdi + 0x38], 0x10c8
jmp 0x14000b5d2
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000b45c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000b45c
nop word [rax + rax]
lea rdx, [0x1400596b0]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000b430
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000b60b
xor ebx, ebx
mov byte [0x140153548], r14b
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.140006ee0
lea rdx, [rsp + 0x30]
lea rcx, [0x140153550]
call fcn.14000bc60
mov rcx, qword [0x140153550]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x140153560], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x254d448]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1f5b820
mov qword [0x140153500], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140153560]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
add rdx, 0x1fbc100
mov qword [0x140153508], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
lea r9d, [rbx + 8]
mov rdx, qword [0x140153560]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140153550]
mov qword [0x140153510], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
lea r9d, [rbx + 8]
mov rcx, qword [0x140153550]
lea r8, [rsp + 0x50]
mov qword [0x140153540], rax
mov qword [0x140153520], 0xd10
mov qword [0x140153530], 0x918
mov qword [0x140153528], 0x8e8
mov rdx, qword [rdi]
add rdx, 8
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140153518], rax
mov qword [rdi + 0x38], 0x10a8
call fcn.14000a700
call fcn.14004e860
mov rcx, rax
call fcn.1400545b0
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400555d0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000b67c
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000b67c
nop word [rax + rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rdi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000b650
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000b5e4
lea rcx, [0x140059234]
movaps xmmword [rsp + 0x2b0], xmm6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.14000bbe0
mov edi, dword [0x140069088]
xor ebx, ebx
mov r9, rax
cmp byte [rax + 0x1c], bl
je 0x14000b84f
mov ecx, ebx
cmp edi, 2
jl 0x14000b80c
movdqa xmm0, xmmword [str.7777777777777777]
mov rdx, rax
movdqa xmm5, xmmword [0x14005fe10]
movdqa xmm4, xmmword [0x1400600b0]
movdqa xmm6, xmmword [0x14005fe70]
movdqa xmmword [rsp + 0x50], xmm0
mov r8d, dword [rsp + 0x50]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14005fec0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005fec0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x18
jl 0x14000b700
cmp ecx, 0x1d
jge 0x14000b84f
movsxd r8, ecx
add r8, r9
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 0x1d
jl 0x14000b820
mov rdx, r9
mov rcx, r10
call fcn.140006d10
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.14000bc10
mov r9, rax
cmp byte [rax + 0x13], bl
je 0x14000b9ff
mov ecx, ebx
cmp edi, 2
jl 0x14000b9bc
movdqa xmm0, xmmword [str.7777777777777777]
mov rdx, rax
movdqa xmm5, xmmword [0x14005fe10]
movdqa xmm4, xmmword [0x1400600b0]
movdqa xmm6, xmmword [0x14005fe70]
movdqa xmmword [rsp + 0x50], xmm0
mov r8d, dword [rsp + 0x50]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14005fec0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005fec0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x10
jl 0x14000b8b0
cmp ecx, 0x14
jge 0x14000b9ff
movsxd r8, ecx
add r8, r9
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 0x14
jl 0x14000b9d0
mov rdx, r9
mov rcx, r10
call fcn.140006d10
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.14000bc30
mov r9, rax
cmp byte [rax + 0x1d], bl
je 0x14000bbaf
cmp edi, 2
jl 0x14000bb6c
movdqa xmm0, xmmword [str.7777777777777777]
mov rcx, rax
movdqa xmm5, xmmword [0x14005fe10]
movdqa xmm4, xmmword [0x1400600b0]
movdqa xmm6, xmmword [0x14005fe70]
movdqa xmmword [rsp + 0x50], xmm0
mov edx, dword [rsp + 0x50]
nop dword [rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
mov eax, ebx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14005fec0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005fec0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp ebx, 0x18
jl 0x14000ba60
cmp eax, 0x1e
jge 0x14000bbaf
movsxd r8, ebx
add r8, r9
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, bl
inc ebx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ebx, 0x1e
jl 0x14000bb80
mov rdx, r9
mov rcx, r10
call fcn.140006d10
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movaps xmm6, xmmword [rsp + 0x2b0]
int3