joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e760
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003e7e1
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003e7e1
nop word [rax + rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003e7dd
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003e7b0
jmp 0x14003e7e1
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2c0]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x212b208]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a8d9c]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003e914
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003e909
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003e92c
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003e940
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003e9c1
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003e9c1
nop word [rax + rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003e9bd
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003e990
jmp 0x14003e9c1
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2c0]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x212b208]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a9128]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003eaf4
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003eae9
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003eb0c
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003eb20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003eba1
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003eba1
nop word [rax + rax]
lea rdx, str.FiveM_b2372_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003eb9d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003eb70
jmp 0x14003eba1
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2372_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2c0]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x205c2c8]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a8d9c]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003ecd4
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003ecc9
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003ecec
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003ed00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003ed81
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ed81
nop word [rax + rax]
lea rdx, str.FiveM_b2372_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003ed7d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ed50
jmp 0x14003ed81
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2372_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2c0]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x205c2c8]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a9128]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003eeb4
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003eea9
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003eecc
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003eee0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003ef61
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ef61
nop word [rax + rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003ef5d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ef30
jmp 0x14003ef61
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2c0]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2024890]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a8d9c]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003f094
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003f089
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003f0ac
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f0c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f141
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f141
nop word [rax + rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003f13d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f110
jmp 0x14003f141
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2c0]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2024890]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a9128]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003f274
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003f269
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003f28c
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f2a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f321
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f321
nop word [rax + rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003f31d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f2f0
jmp 0x14003f321
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2c0]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x206a778]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a8d9c]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003f454
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003f449
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003f46c
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f480
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f501
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f501
nop word [rax + rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003f4fd
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f4d0
jmp 0x14003f501
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2c0]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x206a778]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a9128]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003f634
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003f629
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003f64c
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f660
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
movss xmm1, dword [0x1400a97d0]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f6f1
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f6f1
nop word [rax + rax]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003f6ed
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f6c0
jmp 0x14003f6f1
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2d8], 0x40
mov dword [rsp + 0x2dc], 0x28c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x50], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x60], rbx
mov rax, qword [rsp + 0x2d8]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x38], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x48], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x38]
lea rdx, [rsi + 0x2140688]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003f822
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003f817
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003f83a
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f850
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
movss xmm1, dword [0x1400a97d0]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f8e1
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f8e1
nop word [rax + rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003f8dd
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f8b0
jmp 0x14003f8e1
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2d8], 0x40
mov dword [rsp + 0x2dc], 0x28c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x50], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x60], rbx
mov rax, qword [rsp + 0x2d8]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x38], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x48], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x38]
lea rdx, [rsi + 0x212b208]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003fa12
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003fa07
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003fa2a
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3