Function at 0x140039e70
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140039eeb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140039eeb
nop dword [rax]
lea rdx, [0x1400f0d08]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140039ee8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140039ec0
jmp 0x140039eeb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003a259
lea rdx, [0x1400f0d08]
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2f32010]
mov qword [rbp + 0x240], rax
mov dword [rbp - 0x70], 0x60
mov dword [rbp - 0x6c], Ordinal_41
mov dword [rbp - 0x68], reloc.WS2_32.dll_recv
lea rbx, [rbp - 0x70]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x78], rax
lea r14, [rax + 0xc]
mov qword [rbp - 0x78], r14
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rbp - 0x80], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003a09d
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1b2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a03c
xor eax, eax
jmp 0x14003a079
cmp rbx, 0x1000
jb 0x14003a071
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1b8
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003a132
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a079
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003a161
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1b2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a101
xor eax, eax
jmp 0x14003a141
cmp rbx, 0x1000
jb 0x14003a139
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1b8
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003a132
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a141
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14003a215
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003a20c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a20c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x14003a259
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003a251
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a251
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003a2bb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003a2bb
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003a2b8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003a290
jmp 0x14003a2bb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003a62d
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ea03c0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_recv
lea rbx, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003a471
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1be
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a410
xor eax, eax
jmp 0x14003a44d
cmp rbx, 0x1000
jb 0x14003a445
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1c4
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003a506
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a44d
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003a535
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1be
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a4d5
xor eax, eax
jmp 0x14003a515
cmp rbx, 0x1000
jb 0x14003a50d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1c4
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003a506
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a515
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14003a5e9
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003a5e0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a5e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x14003a62d
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003a625
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a625
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003a68b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003a68b
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003a688
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003a660
jmp 0x14003a68b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003a9fd
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2e18bb0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003a841
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1ca
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a7e0
xor eax, eax
jmp 0x14003a81d
cmp rbx, 0x1000
jb 0x14003a815
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1d0
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003a8d6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a81d
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003a905
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1ca
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a8a5
xor eax, eax
jmp 0x14003a8e5
cmp rbx, 0x1000
jb 0x14003a8dd
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1d0
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003a8d6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a8e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14003a9b9
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003a9b0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a9b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x14003a9fd
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003a9f5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a9f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003aa5b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003aa5b
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003aa58
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003aa30
jmp 0x14003aa5b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003adcd
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2db1190]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003ac11
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1d6
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003abb0
xor eax, eax
jmp 0x14003abed
cmp rbx, 0x1000
jb 0x14003abe5
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1dc
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003aca6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003abed
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003acd5
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1d6
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003ac75
xor eax, eax
jmp 0x14003acb5
cmp rbx, 0x1000
jb 0x14003acad
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1dc
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003aca6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003acb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14003ad89
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003ad80
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ad80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400a38ac
nop
test rsi, rsi
je 0x14003adcd
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003adc5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003adc5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003ae2b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ae2b
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003ae28
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ae00
jmp 0x14003ae2b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003b198
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.140034b10
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ef5850]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, recv
call fcn.1400a3b64
mov r14, rax
mov qword [rsp + 0x78], rax
lea rdi, [rax + 0xc]
mov qword [rbp - 0x78], rdi
mov r8d, recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r14 + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, recv
call fcn.1400a3b64
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rsi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, r14
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003afe1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1e2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003af80
xor eax, eax
jmp 0x14003afbd
cmp rbx, 0x1000
jb 0x14003afb5
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1ac
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003b076
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003afbd
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rsi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003b0a5
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b1e2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003b045
xor eax, eax
jmp 0x14003b085
cmp rbx, 0x1000
jb 0x14003b07d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b1ac
call fcn.1400a3b64
mov rcx, rax
test rax, rax
je 0x14003b076
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b085
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a3b64
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140034bb0
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x14003b159
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003b150
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b150
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400a38ac
nop
test r14, r14
je 0x14003b198
sub rdi, r14
and rdi, 0xfffffffffffffffc
mov rax, r14
cmp rdi, 0x1000
jb 0x14003b18d
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b18d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, r14
call fcn.1400a38ac
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3
call fcn.14002a960
nop
call fcn.140041770
int3