Function at 0x1400037d0
Capabilities:
Delete file
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rcx, str.pat1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.pat2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r9d, 0x40
lea r8, [0x140007720]
lea rdx, [0x140007730]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r14d, r14d
nop dword [rax + rax]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
lea rcx, [0x140007754]
test rax, rax
jne 0x140003883
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pat1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.fail_to_find_fivem
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
jmp 0x140003840
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.pless_end_for_inject
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
lea rcx, [0x140007754]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x69], 0x42960000
mov dword [rbp - 0x61], 0xffffffff
mov word [rbp - 0x5d], 0x9808
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
mov r12, r14
mov qword [rbp - 0x11], r14
lea rcx, [rbp - 0x59]
call fcn.140001d90
lea rcx, [rbp - 0x21]
cmp rcx, rax
je 0x140003903
mov rsi, qword [rax]
mov qword [rbp - 0x21], rsi
mov r15, qword [rax + 8]
mov qword [rbp - 0x19], r15
mov r12, qword [rax + 0x10]
mov qword [rbp - 0x11], r12
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x14000390b
mov r15, qword [rbp - 0x19]
mov rsi, qword [rbp - 0x21]
mov qword [rbp - 0x41], rsi
mov qword [rbp + 0xf], r15
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140003959
mov rax, qword [rbp - 0x49]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003954
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f35
call fcn.140005d8c
cmp rsi, r15
jne 0x140003ad7
call fcn.140001780
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0xe
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x59]
call fcn.140001500
mov rbx, rax
lea rax, [rbp - 0x21]
cmp rax, rbx
je 0x1400039fc
test rsi, rsi
je 0x1400039da
sub r12, rsi
sar r12, 3
lea rdx, [r12*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400039d2
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f3c
mov rcx, rsi
call fcn.140005d8c
mov rax, qword [rbx]
mov qword [rbp - 0x21], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x19], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x11], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140003a42
mov rax, qword [rbp - 0x49]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f3c
call fcn.140005d8c
lea rcx, [rbp - 0x21]
call fcn.140001a50
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov rcx, rax
lea rdx, [0x140005600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp - 0x21]
mov qword [rbp - 0x41], rsi
mov rdi, rsi
mov r15, qword [rbp - 0x19]
mov qword [rbp + 0xf], r15
cmp rsi, r15
je 0x140003ad1
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov rcx, rax
lea rdx, [0x1400014e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140005600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r15
jne 0x140003a86
mov r12, qword [rbp - 0x11]
jmp 0x140003b4b
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov rcx, rax
lea rdx, [0x140005600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, rsi
nop dword [rax]
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov rcx, rax
lea rdx, [0x1400014e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140005600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r15
jne 0x140003b00
mov r13, rsi
cmp rsi, r15
je 0x140003ef0
nop word [rax + rax]
mov rdi, qword [r13]
mov dword [rbp + 0x17], 0
call fcn.140001780
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140003ba3
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0x17]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x1b], 0x42960000
lea rdx, str.Change_value_successful_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 0x1b]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp - 0x59], 0x42960000
mov qword [rbp - 0x55], 0x42960000
mov dword [rbp - 0x4d], 0xffffffff
mov word [rbp - 0x49], 0x9808
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov rsi, r14
mov qword [rbp + 7], r14
lea rcx, [rbp - 0x39]
call fcn.140002420
lea rcx, [rbp - 9]
cmp rcx, rax
je 0x140003c46
mov rdi, qword [rax]
mov qword [rbp - 9], rdi
mov r14, qword [rax + 8]
mov qword [rbp - 1], r14
mov rsi, qword [rax + 0x10]
mov qword [rbp + 7], rsi
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
jmp 0x140003c4e
mov r14, qword [rbp - 1]
mov rdi, qword [rbp - 9]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140003c94
mov rax, qword [rbp - 0x29]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f43
call fcn.140005d8c
cmp rdi, r14
jne 0x140003e11
call fcn.140001780
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0x12
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x39]
call fcn.140001500
mov rbx, rax
lea rax, [rbp - 9]
cmp rax, rbx
je 0x140003d39
test rdi, rdi
je 0x140003d15
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003d0d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f4a
mov rcx, rdi
call fcn.140005d8c
mov rax, qword [rbx]
mov qword [rbp - 9], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 1], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp + 7], rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140003d7f
mov rax, qword [rbp - 0x29]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f4a
call fcn.140005d8c
lea rcx, [rbp - 9]
call fcn.1400021a0
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov rcx, rax
lea rdx, [0x140005600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, qword [rbp - 9]
mov rsi, rdi
mov r14, qword [rbp - 1]
cmp rdi, r14
je 0x140003e0b
nop dword [rax + rax]
mov rbx, qword [rsi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov rcx, rax
lea rdx, [0x1400014e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140005600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rsi, 8
cmp rsi, r14
jne 0x140003dc0
mov rsi, qword [rbp + 7]
jmp 0x140003e8f
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov rcx, rax
lea rdx, [0x140005600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r15, rdi
nop word [rax + rax]
mov rbx, qword [r15]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov rcx, rax
lea rdx, [0x1400014e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140005600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add r15, 8
cmp r15, r14
jne 0x140003e40
mov r15, qword [rbp + 0xf]
cmp rdi, r14
jne 0x140003f58
test rdi, rdi
je 0x140003ed9
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003ed1
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003f51
mov rcx, rdi
call fcn.140005d8c
add r13, 8
cmp r13, r15
mov r14d, 0
jne 0x140003b60
mov rsi, qword [rbp - 0x41]
test rsi, rsi
je 0x140003840
sub r12, rsi
and r12, 0xfffffffffffffff8
mov rax, rsi
cmp r12, 0x1000
jb 0x140003f25
add r12, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000410d
mov rdx, r12
mov rcx, rsi
call fcn.140005d8c
jmp 0x140003840
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r14, qword [rdi]
mov dword [rbp + 0x1f], 0
call fcn.140001780
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140003f9e
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x1f]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0xf], 0x42960000
lea rdx, str.Change_value_successful_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0xf]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [0x1400077a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14000404a
nop dword [rax]
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000402c
call fcn.140002b80
call fcn.1400033b0
jmp 0x140004036
call fcn.140002770
call fcn.140002f90
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140004010
lea rdx, str.Window_has_been_closed._Exiting_hotkey_loop._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005430
nop
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140004095
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004095
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140005d8c
nop
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x1400040de
sub r12, rcx
and r12, 0xfffffffffffffff8
mov rax, rcx
cmp r12, 0x1000
jb 0x1400040d6
add r12, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r12
call fcn.140005d8c
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140005af0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3