joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003fa40
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003fab1
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003fab1
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003faad
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003fa80
jmp 0x14003fab1
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2d8], 8
mov dword [rsp + 0x2dc], 0x189
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2d8]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x247f840]
mov rcx, rbp
call fcn.14003c860
mov dword [rsp + 0x2d0], 0x4001
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2d0]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003fbf0
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003fbe5
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003fbfe
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003fc10
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003fc81
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003fc81
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003fc7d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003fc50
jmp 0x14003fc81
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2d8], 8
mov dword [rsp + 0x2dc], 0x189
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2d8]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x247f840]
mov rcx, rbp
call fcn.14003c860
mov dword [rsp + 0x2d0], 0x4000
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2d0]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003fdc0
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003fdb5
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003fdce
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003fde0
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003fe51
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003fe51
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003fe4d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003fe20
jmp 0x14003fe51
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2d8], 8
mov dword [rsp + 0x2dc], 0x189
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2d8]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x26684d8]
mov rcx, rbp
call fcn.14003c860
mov dword [rsp + 0x2d0], 0x4001
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2d0]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003ff90
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003ff85
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003ff9e
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003ffb0
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140040021
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140040021
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004001d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003fff0
jmp 0x140040021
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2d8], 8
mov dword [rsp + 0x2dc], 0x189
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x2d8]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x30], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x40], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x26684d8]
mov rcx, rbp
call fcn.14003c860
mov dword [rsp + 0x2d0], 0x4000
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2d0]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x140040160
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x140040155
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14004016e
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140040180
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
movss xmm1, dword [0x1400a97d4]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140040211
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140040211
nop word [rax + rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004020d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400401e0
jmp 0x140040211
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2d8], 8
mov dword [rsp + 0x2dc], 0x280
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x50], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x60], rbx
mov rax, qword [rsp + 0x2d8]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x38], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x48], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x38]
lea rdx, [rsi + 0x247f840]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x140040342
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x140040337
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14004035a
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140040370
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
movss xmm1, dword [0x1400a97d4]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140040401
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140040401
nop word [rax + rax]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400403fd
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400403d0
jmp 0x140040401
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x2d8], 8
mov dword [rsp + 0x2dc], 0x280
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov ecx, 8
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x50], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x60], rbx
mov rax, qword [rsp + 0x2d8]
mov qword [r14], rax
lea rax, [r14 + 8]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov ecx, 8
call fcn.14004b2ec
mov qword [rsp + 0x38], rax
lea rdi, [rax + 8]
mov qword [rsp + 0x48], rdi
mov r8d, 8
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x38]
lea rdx, [rsi + 0x26684d8]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x140040532
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x140040527
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14004054a
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140040560
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x2c0
movss xmm1, dword [0x1400a97d8]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400405f7
mov dword [rsp + 0x80], 0x238
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400405f7
nop dword [rax + rax]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0xac]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400405f0
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400405c0
jmp 0x1400405f7
mov edi, dword [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x3c], 0x10c8
mov dword [rsp + 0x40], 0xcf0
lea rdi, [rsp + 0x38]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x60], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x70], rbx
mov r8d, 0xc
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + 0xc]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 0xc
call fcn.14004b2ec
mov qword [rsp + 0x48], rax
lea rdi, [rax + 0xc]
mov qword [rsp + 0x58], rdi
mov r8d, 0xc
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x48]
lea rdx, [rsi + 0x26684d8]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x140040735
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14004072a
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14004074d
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140040760
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x2c0
movss xmm1, dword [0x1400a97d8]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400407f7
mov dword [rsp + 0x80], 0x238
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400407f7
nop dword [rax + rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0xac]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400407f0
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400407c0
jmp 0x1400407f7
mov edi, dword [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x3c], 0x10b8
mov dword [rsp + 0x40], 0x14c
lea rdi, [rsp + 0x38]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x60], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x70], rbx
mov r8d, 0xc
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + 0xc]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, 0xc
call fcn.14004b2ec
mov qword [rsp + 0x48], rax
lea rdi, [rax + 0xc]
mov qword [rsp + 0x58], rdi
mov r8d, 0xc
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x48]
lea rdx, [rsi + 0x247f840]
mov rcx, rbp
call fcn.14003c860
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x140040935
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14004092a
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14004094d
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140042580
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140042601
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140042601
nop word [rax + rax]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400425fd
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400425d0
jmp 0x140042601
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x26684d8]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x34], 0x10c8
mov dword [rsp + 0x38], 0xcf4
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], 0
mov ecx, 0xc
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x58], rax
lea rbp, [rax + 0xc]
mov qword [rsp + 0x68], rbp
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + 0xc]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov ecx, 0xc
call fcn.14004b2ec
mov qword [rsp + 0x40], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x50], rbx
mov r8d, 0xc
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x48], rbx
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rsi
call fcn.14003c860
mov dword [rsp + 0x2d0], 0x447a0000
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2d0]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x140042750
sub rbp, r14
and rbp, 0xfffffffffffffffc
cmp rbp, 0x1000
jb 0x140042745
add rbp, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140042768
mov r14, rcx
mov rdx, rbp
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140042770
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400427f1
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400427f1
nop word [rax + rax]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400427ed
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400427c0
jmp 0x1400427f1
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003c7c0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x26684d8]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x34], 0x10c8
mov dword [rsp + 0x38], 0xcf4
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], 0
mov ecx, 0xc
call fcn.14004b2ec
mov r14, rax
mov qword [rsp + 0x58], rax
lea rbp, [rax + 0xc]
mov qword [rsp + 0x68], rbp
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + 0xc]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov ecx, 0xc
call fcn.14004b2ec
mov qword [rsp + 0x40], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x50], rbx
mov r8d, 0xc
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x48], rbx
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rsi
call fcn.14003c860
mov dword [rsp + 0x2d0], 0x42c80000
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2d0]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x140042940
sub rbp, r14
and rbp, 0xfffffffffffffffc
cmp rbp, 0x1000
jb 0x140042935
add rbp, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140042958
mov r14, rcx
mov rdx, rbp
mov rcx, r14
call fcn.14004b034
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3