joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f2e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f351
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f351
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003f34d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f320
jmp 0x14003f351
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x2024890]
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x2c0]
mov qword [rax], rdx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x30], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x38], r8
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a63a0]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003f466
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003f45b
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003f47a
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f490
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f501
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f501
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003f4fd
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f4d0
jmp 0x14003f501
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x206a778]
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x2c0]
mov qword [rax], rdx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x30], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x38], r8
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a6258]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003f616
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003f60b
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003f62a
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f640
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f6b1
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f6b1
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003f6ad
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f680
jmp 0x14003f6b1
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x206a778]
mov dword [rsp + 0x2c0], 0x30
mov dword [rsp + 0x2c4], 0x2b4
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x2c0]
mov qword [rax], rdx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x30], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x38], r8
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x1400a63a0]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003f7c6
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003f7bb
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003f7da
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f7f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x2b0
movss xmm1, dword [0x1400a6804]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f871
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003f871
nop
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003f86d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f840
jmp 0x14003f871
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x2140688]
mov dword [rsp + 0x2d8], 0x40
mov dword [rsp + 0x2dc], 0x28c
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x50], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x2d8]
mov qword [rax], rdx
mov qword [rsp + 0x58], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x38], rax
lea r8, [rax + 8]
mov qword [rsp + 0x48], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x40], r8
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003f984
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003f979
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003f998
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2b0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f9a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x2b0
movss xmm1, dword [0x1400a6804]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003fa21
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003fa21
nop
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003fa1d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f9f0
jmp 0x14003fa21
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x212b208]
mov dword [rsp + 0x2d8], 0x40
mov dword [rsp + 0x2dc], 0x28c
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x50], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x2d8]
mov qword [rax], rdx
mov qword [rsp + 0x58], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x38], rax
lea r8, [rax + 8]
mov qword [rsp + 0x48], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x40], r8
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003fb34
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003fb29
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003fb48
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2b0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003fb50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003fbc1
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003fbc1
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003fbbd
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003fb90
jmp 0x14003fbc1
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x247f840]
mov dword [rsp + 0x2c8], 8
mov dword [rsp + 0x2cc], 0x189
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x2c8]
mov qword [rax], rdx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x30], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x38], r8
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov dword [rsp + 0x2c0], 0x4001
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2c0]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003fce2
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003fcd7
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003fcf6
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003fd00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003fd71
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003fd71
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003fd6d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003fd40
jmp 0x14003fd71
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x247f840]
mov dword [rsp + 0x2c8], 8
mov dword [rsp + 0x2cc], 0x189
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x2c8]
mov qword [rax], rdx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x30], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x38], r8
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov dword [rsp + 0x2c0], 0x4000
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2c0]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x14003fe92
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x14003fe87
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x14003fea6
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003feb0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003ff21
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ff21
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003ff1d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003fef0
jmp 0x14003ff21
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x26684d8]
mov dword [rsp + 0x2c8], 8
mov dword [rsp + 0x2cc], 0x189
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x2c8]
mov qword [rax], rdx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x30], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x38], r8
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov dword [rsp + 0x2c0], 0x4001
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2c0]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x140040042
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x140040037
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140040056
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140040060
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x2a0
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400400d1
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400400d1
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400400cd
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400400a0
jmp 0x1400400d1
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x26684d8]
mov dword [rsp + 0x2c8], 8
mov dword [rsp + 0x2cc], 0x189
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x2c8]
mov qword [rax], rdx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x30], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x38], r8
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov dword [rsp + 0x2c0], 0x4000
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2c0]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x1400401f2
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x1400401e7
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140040206
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140040210
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x2b0
movss xmm1, dword [0x1400a6808]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140040291
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140040291
nop
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004028d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140040260
jmp 0x140040291
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x247f840]
mov dword [rsp + 0x2d8], 8
mov dword [rsp + 0x2dc], 0x280
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x50], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x2d8]
mov qword [rax], rdx
mov qword [rsp + 0x58], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x38], rax
lea r8, [rax + 8]
mov qword [rsp + 0x48], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x40], r8
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x1400403a4
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x140040399
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x1400403b8
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2b0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400403c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x2b0
movss xmm1, dword [0x1400a6808]
movss dword [rsp + 0x30], xmm1
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140040441
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140040441
nop
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rsp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004043d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140040410
jmp 0x140040441
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.14003cdd0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdi, [rbx + 0x26684d8]
mov dword [rsp + 0x2d8], 8
mov dword [rsp + 0x2dc], 0x280
mov ecx, 8
call fcn.140049b70
mov r14, rax
mov qword [rsp + 0x50], rax
lea rbx, [rax + 8]
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x2d8]
mov qword [rax], rdx
mov qword [rsp + 0x58], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov ecx, 8
call fcn.140049b70
mov qword [rsp + 0x38], rax
lea r8, [rax + 8]
mov qword [rsp + 0x48], r8
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rsp + 0x40], r8
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ce70
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r14, r14
je 0x140040554
sub rbx, r14
and rbx, 0xfffffffffffffffc
cmp rbx, 0x1000
jb 0x140040549
add rbx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140040568
mov r14, rcx
mov rdx, rbx
mov rcx, r14
call fcn.1400498b8
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2b0
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3