Function at 0x140038af0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140038b6b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140038b6b
nop dword [rax]
lea rdx, [0x1400f0d08]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140038b68
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140038b40
jmp 0x140038b6b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140038ed9
lea rdx, [0x1400f0d08]
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2f32010]
mov qword [rbp + 0x240], rax
mov dword [rbp - 0x70], 0x60
mov dword [rbp - 0x6c], Ordinal_41
mov dword [rbp - 0x68], reloc.WS2_32.dll_recv
lea rbx, [rbp - 0x70]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x78], rax
lea r14, [rax + 0xc]
mov qword [rbp - 0x78], r14
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rbp - 0x80], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x140038d1d
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e32
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140038cbc
xor eax, eax
jmp 0x140038cf9
cmp rbx, 0x1000
jb 0x140038cf1
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e38
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140038db2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140038cf9
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140038de1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e32
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140038d81
xor eax, eax
jmp 0x140038dc1
cmp rbx, 0x1000
jb 0x140038db9
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e38
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140038db2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140038dc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140038e95
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140038e8c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038e8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x140038ed9
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140038ed1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038ed1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140038f3b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140038f3b
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140038f38
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140038f10
jmp 0x140038f3b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400392ad
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ea03c0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_recv
lea rbx, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x1400390f1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e3e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039090
xor eax, eax
jmp 0x1400390cd
cmp rbx, 0x1000
jb 0x1400390c5
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e44
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140039186
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400390cd
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400391b5
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e3e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039155
xor eax, eax
jmp 0x140039195
cmp rbx, 0x1000
jb 0x14003918d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e44
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140039186
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039195
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140039269
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140039260
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039260
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x1400392ad
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400392a5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400392a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003930b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003930b
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140039308
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400392e0
jmp 0x14003930b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003967d
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2e18bb0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x1400394c1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e4a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039460
xor eax, eax
jmp 0x14003949d
cmp rbx, 0x1000
jb 0x140039495
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e50
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140039556
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003949d
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140039585
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e4a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039525
xor eax, eax
jmp 0x140039565
cmp rbx, 0x1000
jb 0x14003955d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e50
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140039556
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039565
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140039639
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140039630
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039630
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x14003967d
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140039675
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039675
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400396db
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400396db
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400396d8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400396b0
jmp 0x1400396db
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140039a4d
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2db1190]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x140039891
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e56
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039830
xor eax, eax
jmp 0x14003986d
cmp rbx, 0x1000
jb 0x140039865
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e5c
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140039926
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003986d
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140039955
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e56
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400398f5
xor eax, eax
jmp 0x140039935
cmp rbx, 0x1000
jb 0x14003992d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e5c
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140039926
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039935
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140039a09
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140039a00
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039a00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x140039a4d
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140039a45
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039a45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140039aab
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140039aab
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140039aa8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140039a80
jmp 0x140039aab
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140039e18
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ef5850]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov r14, rax
mov qword [rsp + 0x78], rax
lea rdi, [rax + 0xc]
mov qword [rbp - 0x78], rdi
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r14 + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rsi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, r14
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x140039c61
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e62
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039c00
xor eax, eax
jmp 0x140039c3d
cmp rbx, 0x1000
jb 0x140039c35
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e2c
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140039cf6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039c3d
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rsi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140039d25
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140039e62
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039cc5
xor eax, eax
jmp 0x140039d05
cmp rbx, 0x1000
jb 0x140039cfd
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140039e2c
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x140039cf6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039d05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x140039dd9
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140039dd0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039dd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
nop
test r14, r14
je 0x140039e18
sub rdi, r14
and rdi, 0xfffffffffffffffc
mov rax, r14
cmp rdi, 0x1000
jb 0x140039e0d
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039e0d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, r14
call fcn.1400a38ac
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3