Function at 0x1400011f0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001281
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001281
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000127d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140001254
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov edx, edi
lea ecx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400012e4
mov dword [rsp + 0x60], 0x438
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400012e4
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400012df
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x1400012b6
mov rsi, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
add rsi, 0x212b208
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a8], xmm0
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x20
mov dword [rsp + 0x38], 0x70
mov ecx, 0xc
call fcn.140001780
mov rdi, rax
mov qword [rbp + 0x3a8], rax
lea rbx, [rax + 0xc]
mov qword [rbp + 0x3b8], rbx
mov r8d, 0xc
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x3b0], rbx
mov qword [rsp + 0x50], 0
mov ecx, 0xc
call fcn.140001780
mov r14, rax
lea rbx, [rax + 0xc]
mov r8d, 0xc
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x58], rsi
mov r13, rbx
sub r13, r14
sar r13, 2
xor edi, edi
mov r15d, edi
test r13, r13
je 0x1400013eb
nop word [rax + rax]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x58]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [r14 + rdi*4]
add rsi, qword [rsp + 0x58]
mov qword [rsp + 0x58], rsi
inc r15d
mov edi, r15d
cmp rdi, r13
jb 0x1400013b0
xor edi, edi
test r14, r14
je 0x14000142a
sub rbx, r14
and rbx, 0xfffffffffffffffc
mov rax, r14
cmp rbx, 0x1000
jb 0x14000141f
add rbx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000141f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rbx
mov rcx, r14
call fcn.1400017bc
lea rcx, str.___Memory_by_Snow__n
call fcn.140001010
mov dword [rbp + 0x3a0], 0
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x3a0]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm1, dword [rbp + 0x3a0]
cvtps2pd xmm1, xmm1
movq rdx, xmm1
lea rcx, str.___Now_Value_:___f___________________________n
call fcn.140001010
nop word [rax + rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001530
lea rdx, [rbp + 0x3a4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___float____ptr64____ptr64]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x3a4]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140001480