Function at 0x140009ed0
Capabilities:
Encode data using xor
Enumerate processes
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140068040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401522c8], rax
test rax, rax
jne 0x140009f2f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._nFivem_not_found__start_fivem_before_load_
call fcn.140005f00
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1401522c8]
lea rdx, [0x1401522b8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x1401522b8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x60], 0x238
mov qword [0x1401522b0], rax
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov r14d, 1
test eax, eax
je 0x140009fdc
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140009fdc
nop dword [rax + rax]
lea rdx, [0x1400588a0]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140009fb0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000a0dd
xor ebx, ebx
mov byte [0x1401522a8], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2545_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400062a0
lea rdx, [rsp + 0x30]
lea rcx, [0x1401522b0]
call fcn.14000b1f0
mov rcx, qword [0x1401522b0]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x1401522c0], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x25667e8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1f2e7a8
mov qword [0x140152260], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1fd6f70
mov qword [0x140152268], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140152270], rax
mov qword [0x1401522a0], 0x1fd7b48
jmp 0x14000a91d
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a14c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000a14c
nop dword [rax]
lea rdx, [0x1400588f8]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a120
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000a24d
xor ebx, ebx
mov byte [0x1401522a8], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400062a0
lea rdx, [rsp + 0x30]
lea rcx, [0x1401522b0]
call fcn.14000b1f0
mov rcx, qword [0x1401522b0]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x1401522c0], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x26684d8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x20304c8
mov qword [0x140152260], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x20d8c90
mov qword [0x140152268], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140152270], rax
mov qword [0x1401522a0], 0x20d9868
jmp 0x14000a91d
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a2bc
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000a2bc
nop dword [rax]
lea rdx, [0x140058950]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a290
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000a346
xor ebx, ebx
mov byte [0x1401522a8], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x14]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400062a0
lea rdx, [rsp + 0x30]
lea rcx, [0x1401522b0]
call fcn.14000b1f0
mov rcx, qword [0x1401522b0]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x1401522c0], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x247f840]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
add rdx, 0x1efd4c8
jmp 0x14000a437
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a3ae
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000a3ae
lea rdx, [0x140058998]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a382
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000a4be
xor ebx, ebx
mov byte [0x1401522a8], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2060_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400062a0
lea rdx, [rsp + 0x30]
lea rcx, [0x1401522b0]
call fcn.14000b1f0
mov rcx, qword [0x1401522b0]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x1401522c0], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x24c8858]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
add rdx, 0x1ec3828
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
mov r9d, 8
mov qword [0x140152260], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r8, [rsp + 0x50]
mov rax, qword [rsp + 0x50]
add rdx, 0x2087780
mov rcx, qword [0x1401522b0]
mov r9d, 8
mov qword [0x140152268], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140152270], rax
mov qword [0x1401522a0], 0x20d9868
mov qword [0x140152280], 0xd28
jmp 0x14000a928
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a52c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000a52c
nop word [rax + rax]
lea rdx, [0x1400589f0]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a500
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000a62d
xor ebx, ebx
mov byte [0x1401522a8], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2372_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400062a0
lea rdx, [rsp + 0x30]
lea rcx, [0x1401522b0]
call fcn.14000b1f0
mov rcx, qword [0x1401522b0]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x1401522c0], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x252dcd8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1f05208
mov qword [0x140152260], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1f9e9f0
mov qword [0x140152268], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140152270], rax
mov qword [0x1401522a0], 0x1fd8570
jmp 0x14000a91d
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a69c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000a69c
nop dword [rax]
lea rdx, [0x140058a48]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a670
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000a794
xor ebx, ebx
mov byte [0x1401522a8], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400062a0
lea rdx, [rsp + 0x30]
lea rcx, [0x1401522b0]
call fcn.14000b1f0
mov rcx, qword [0x1401522b0]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x1401522c0], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x2567db0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1f77ef0
mov qword [0x140152260], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1fd8570
mov qword [0x140152268], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
add rdx, 0x20d9868
jmp 0x14000a8e8
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a7fc
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000a7fc
lea rdx, [0x140058aa0]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a7d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000a97b
xor ebx, ebx
mov byte [0x1401522a8], 0
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2189_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400062a0
lea rdx, [rsp + 0x30]
lea rcx, [0x1401522b0]
call fcn.14000b1f0
mov rcx, qword [0x1401522b0]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x1401522c0], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x24e6d90]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1ee18a8
mov qword [0x140152260], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1f888c0
mov qword [0x140152268], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
mov r9d, 8
mov qword [0x140152270], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401522a0], rax
mov qword [0x140152280], 0xd30
mov rcx, qword [0x1401522b0]
lea r8, [rsp + 0x50]
mov qword [0x140152288], 0x908
mov r9d, 8
mov qword [0x140152290], 0x938
mov rdx, qword [rdi]
add rdx, 8
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140152278], rax
mov qword [rdi + 0x38], 0x10c8
jmp 0x14000ab62
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a9ec
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000a9ec
nop word [rax + rax]
lea rdx, [0x140058af8]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rsi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a9c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000ab9b
xor ebx, ebx
mov byte [0x1401522a8], r14b
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rbx + 0x1a]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400062a0
lea rdx, [rsp + 0x30]
lea rcx, [0x1401522b0]
call fcn.14000b1f0
mov rcx, qword [0x1401522b0]
lea r9d, [rbx + 8]
lea r8, [rsp + 0x50]
mov qword [0x1401522c0], rax
mov qword [rsp + 0x20], rbx
lea rdx, [rax + 0x254d448]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1f5b820
mov qword [0x140152260], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401522c0]
lea r9d, [rbx + 8]
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
add rdx, 0x1fbc100
mov qword [0x140152268], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
lea r9d, [rbx + 8]
mov rdx, qword [0x1401522c0]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401522b0]
mov qword [0x140152270], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
lea r9d, [rbx + 8]
mov rcx, qword [0x1401522b0]
lea r8, [rsp + 0x50]
mov qword [0x1401522a0], rax
mov qword [0x140152280], 0xd10
mov qword [0x140152290], 0x918
mov qword [0x140152288], 0x8e8
mov rdx, qword [rdi]
add rdx, 8
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140152278], rax
mov qword [rdi + 0x38], 0x10a8
call fcn.140009ae0
call fcn.14004dde0
mov rcx, rax
call fcn.140053470
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140054490
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
xor edx, edx
mov dword [rsp + 0x60], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x60]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000ac0c
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000ac0c
nop word [rax + rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
lea rdx, [rsp + 0x60]
test eax, eax
mov rcx, rdi
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000abe0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000ab74
lea rcx, [0x1400582d8]
movaps xmmword [rsp + 0x2b0], xmm6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.14000b170
mov edi, dword [0x140068088]
xor ebx, ebx
mov r9, rax
cmp byte [rax + 0x1c], bl
je 0x14000addf
mov ecx, ebx
cmp edi, 2
jl 0x14000ad9c
movdqa xmm0, xmmword [0x14005f360]
mov rdx, rax
movdqa xmm5, xmmword [0x14005f220]
movdqa xmm4, xmmword [0x14005f5a0]
movdqa xmm6, xmmword [0x14005f270]
movdqa xmmword [rsp + 0x50], xmm0
mov r8d, dword [rsp + 0x50]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14005f2d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005f2d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x18
jl 0x14000ac90
cmp ecx, 0x1d
jge 0x14000addf
movsxd r8, ecx
add r8, r9
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor byte [r8 - 1], al
cmp ecx, 0x1d
jl 0x14000adb0
mov rdx, r9
mov rcx, r10
call fcn.140005f00
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.14000b1a0
mov r9, rax
cmp byte [rax + 0x13], bl
je 0x14000af8f
mov ecx, ebx
cmp edi, 2
jl 0x14000af4c
movdqa xmm0, xmmword [0x14005f360]
mov rdx, rax
movdqa xmm5, xmmword [0x14005f220]
movdqa xmm4, xmmword [0x14005f5a0]
movdqa xmm6, xmmword [0x14005f270]
movdqa xmmword [rsp + 0x50], xmm0
mov r8d, dword [rsp + 0x50]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14005f2d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005f2d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x10
jl 0x14000ae40
cmp ecx, 0x14
jge 0x14000af8f
movsxd r8, ecx
add r8, r9
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor byte [r8 - 1], al
cmp ecx, 0x14
jl 0x14000af60
mov rdx, r9
mov rcx, r10
call fcn.140005f00
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.14000b1c0
mov r9, rax
cmp byte [rax + 0x1d], bl
je 0x14000b13f
cmp edi, 2
jl 0x14000b0fc
movdqa xmm0, xmmword [0x14005f360]
mov rcx, rax
movdqa xmm5, xmmword [0x14005f220]
movdqa xmm4, xmmword [0x14005f5a0]
movdqa xmm6, xmmword [0x14005f270]
movdqa xmmword [rsp + 0x50], xmm0
mov edx, dword [rsp + 0x50]
nop dword [rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
mov eax, ebx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14005f2d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005f2d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp ebx, 0x18
jl 0x14000aff0
cmp eax, 0x1e
jge 0x14000b13f
movsxd r8, ebx
add r8, r9
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, bl
inc ebx
sub al, dl
add al, 0x38
xor byte [r8 - 1], al
cmp ebx, 0x1e
jl 0x14000b110
mov rdx, r9
mov rcx, r10
call fcn.140005f00
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movaps xmm6, xmmword [rsp + 0x2b0]
int3