Function at 0x140031de0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor r12d, r12d
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140031e5b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140031e5b
lea rdx, [0x14007b0a8]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140031e58
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140031e30
jmp 0x140031e5b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140032198
lea rdx, [0x14007b0a8]
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2140688]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x70], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140031fe0
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003323a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140031f7f
xor eax, eax
jmp 0x140031fbc
cmp rbx, 0x1000
jb 0x140031fb4
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140033240
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140032073
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031fbc
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400320a2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003323a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140032042
xor eax, eax
jmp 0x140032082
cmp rbx, 0x1000
jb 0x14003207a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140033240
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140032073
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140032082
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140032154
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003214b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003214b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x140032198
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140032190
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032190
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400321fb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400321fb
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400321f8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400321d0
jmp 0x1400321fb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140032538
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2053218]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140032380
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140033246
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003231f
xor eax, eax
jmp 0x14003235c
cmp rbx, 0x1000
jb 0x140032354
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003324c
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140032413
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003235c
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140032442
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140033246
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400323e2
xor eax, eax
jmp 0x140032422
cmp rbx, 0x1000
jb 0x14003241a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003324c
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140032413
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140032422
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x1400324f4
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400324eb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400324eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x140032538
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140032530
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032530
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003259b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003259b
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140032598
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140032570
jmp 0x14003259b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400328d8
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2024890]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140032720
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140033252
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400326bf
xor eax, eax
jmp 0x1400326fc
cmp rbx, 0x1000
jb 0x1400326f4
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140033258
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x1400327b3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400326fc
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400327e2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140033252
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140032782
xor eax, eax
jmp 0x1400327c2
cmp rbx, 0x1000
jb 0x1400327ba
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140033258
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x1400327b3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400327c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140032894
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003288b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003288b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x1400328d8
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400328d0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400328d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003293b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003293b
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140032938
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140032910
jmp 0x14003293b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140032c78
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2051258]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140032ac0
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003325e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140032a5f
xor eax, eax
jmp 0x140032a9c
cmp rbx, 0x1000
jb 0x140032a94
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140033264
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140032b53
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140032a9c
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140032b82
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003325e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140032b22
xor eax, eax
jmp 0x140032b62
cmp rbx, 0x1000
jb 0x140032b5a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140033264
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140032b53
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140032b62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140032c34
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140032c2b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032c2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x140032c78
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140032c70
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032c70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140032cdb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140032cdb
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140032cd8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140032cb0
jmp 0x140032cdb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140033018
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x206a778]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140032e60
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003326a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140032dff
xor eax, eax
jmp 0x140032e3c
cmp rbx, 0x1000
jb 0x140032e34
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140033234
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140032ef3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140032e3c
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140032f22
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003326a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140032ec2
xor eax, eax
jmp 0x140032f02
cmp rbx, 0x1000
jb 0x140032efa
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140033234
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140032ef3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140032f02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140032fd4
sub r15, rdi
sar r15, 2
lea rdx, [r15*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140032fcb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032fcb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x140033018
sub r14, rsi
sar r14, 2
lea rdx, [r14*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140033010
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033010
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003307b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003307b
nop dword [rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140033078
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140033050
jmp 0x14003307b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140033220
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
lea r14, [rbp + 0x240]
lea rdi, [rbp + 0x248]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x248], 2
lea rdx, [rbp + 0x248]
call fcn.14003db90
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov r8, rax
mov rdx, rdi
mov rcx, r14
call fcn.14003db50
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x248], r12
lea rcx, [rbp + 0x248]
call fcn.14003dac0
nop
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
lea rax, [rbp + 0x248]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x250]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.14003d9d0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.14003d8e0
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140030850
mov rdi, rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.14003d8e0
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
lea rcx, [rsp + 0x50]
call fcn.14003d880
nop
lea rcx, [rsp + 0x30]
call fcn.14003d880
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3