Function at 0x14003ad60
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003addb
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003addb
nop dword [rax]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003add8
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003adb0
jmp 0x14003addb
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003b030
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.140036bc0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_recv
mov ecx, recv
call fcn.1400a4d14
mov r15, rax
mov qword [rsp + 0x60], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x70], rbx
mov r8d, recv
lea rdx, [rsp + 0x48]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_sendto
mov ecx, recv
call fcn.1400a4d14
mov r13, rax
mov qword [rsp + 0x78], rax
lea r12, [rax + 0xc]
mov qword [rbp - 0x78], r12
mov r8d, recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x80], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x48], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x58], rbx
mov r8d, recv
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
lea rdx, [rsi + 0x2f32010]
mov rcx, r14
call fcn.140036c60
mov rdi, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x48], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x58], rbx
mov r8d, recv
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
lea rdx, [rsi + 0x2f32010]
mov rcx, r14
call fcn.140036c60
mov rbx, rax
mov dword [rbp + 0x210], 0x42960000
mov dword [rbp + 0x218], 0x42960000
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x210]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x218]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r13, r13
je 0x14003afdf
sub r12, r13
sar r12, 2
lea rdx, [r12*4]
cmp rdx, 0x1000
jb 0x14003afd6
add rdx, 0x27
mov rcx, qword [r13 - 8]
sub r13, rcx
lea rax, [r13 - 8]
cmp rax, 0x1f
ja 0x14003b022
mov r13, rcx
mov rcx, r13
call fcn.1400a4a5c
nop
test r15, r15
je 0x14003b032
lea rax, [r15 + 0xc]
sub rax, r15
sar rax, 2
lea rdx, [rax*4]
cmp rdx, 0x1000
jb 0x14003b018
add rdx, 0x27
mov rcx, qword [r15 - 8]
sub r15, rcx
lea rax, [r15 - 8]
cmp rax, 0x1f
ja 0x14003b029
mov r15, rcx
mov rcx, r15
call fcn.1400a4a5c
jmp 0x14003b032
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor esi, esi
mov edi, esi
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b08b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003b08b
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003b088
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003b060
jmp 0x14003b08b
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003b2d4
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.140036bc0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov ecx, recv
call fcn.1400a4d14
mov r15, rax
mov qword [rsp + 0x78], rax
lea rbx, [rax + 0xc]
mov qword [rbp - 0x78], rbx
mov r8d, recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
mov ecx, recv
call fcn.1400a4d14
mov r13, rax
mov qword [rsp + 0x60], rax
lea r12, [rax + 0xc]
mov qword [rsp + 0x70], r12
mov r8d, recv
lea rdx, [rsp + 0x48]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x30], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x40], rbx
mov r8d, recv
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2ea03c0]
mov rcx, r14
call fcn.140036c60
mov rdi, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x30], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x40], rbx
mov r8d, recv
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2ea03c0]
mov rcx, r14
call fcn.140036c60
mov rbx, rax
mov dword [rbp + 0x210], 0x42960000
mov dword [rbp + 0x218], 0x42960000
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x210]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x218]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r13, r13
je 0x14003b293
sub r12, r13
sar r12, 2
lea rdx, [r12*4]
cmp rdx, 0x1000
jb 0x14003b28a
add rdx, 0x27
mov rcx, qword [r13 - 8]
sub r13, rcx
lea rax, [r13 - 8]
cmp rax, 0x1f
ja 0x14003b32a
mov r13, rcx
mov rcx, r13
call fcn.1400a4a5c
nop
test r15, r15
je 0x14003b2d4
lea rax, [r15 + 0xc]
sub rax, r15
sar rax, 2
lea rdx, [rax*4]
cmp rdx, 0x1000
jb 0x14003b2cc
add rdx, 0x27
mov rcx, qword [r15 - 8]
sub r15, rcx
lea rax, [r15 - 8]
cmp rax, 0x1f
ja 0x14003b331
mov r15, rcx
mov rcx, r15
call fcn.1400a4a5c
mov edi, esi
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b33b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003b33b
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003b338
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003b302
jmp 0x14003b33b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003b584
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.140036bc0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov ecx, recv
call fcn.1400a4d14
mov r15, rax
mov qword [rsp + 0x78], rax
lea rbx, [rax + 0xc]
mov qword [rbp - 0x78], rbx
mov r8d, recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
mov ecx, recv
call fcn.1400a4d14
mov r13, rax
mov qword [rsp + 0x60], rax
lea r12, [rax + 0xc]
mov qword [rsp + 0x70], r12
mov r8d, recv
lea rdx, [rsp + 0x48]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x30], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x40], rbx
mov r8d, recv
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2e18bb0]
mov rcx, r14
call fcn.140036c60
mov rdi, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x30], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x40], rbx
mov r8d, recv
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2e18bb0]
mov rcx, r14
call fcn.140036c60
mov rbx, rax
mov dword [rbp + 0x210], 0x42960000
mov dword [rbp + 0x218], 0x42960000
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x210]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x218]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r13, r13
je 0x14003b543
sub r12, r13
sar r12, 2
lea rdx, [r12*4]
cmp rdx, 0x1000
jb 0x14003b53a
add rdx, 0x27
mov rcx, qword [r13 - 8]
sub r13, rcx
lea rax, [r13 - 8]
cmp rax, 0x1f
ja 0x14003b5da
mov r13, rcx
mov rcx, r13
call fcn.1400a4a5c
nop
test r15, r15
je 0x14003b584
lea rax, [r15 + 0xc]
sub rax, r15
sar rax, 2
lea rdx, [rax*4]
cmp rdx, 0x1000
jb 0x14003b57c
add rdx, 0x27
mov rcx, qword [r15 - 8]
sub r15, rcx
lea rax, [r15 - 8]
cmp rax, 0x1f
ja 0x14003b5e1
mov r15, rcx
mov rcx, r15
call fcn.1400a4a5c
mov edi, esi
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b5eb
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003b5eb
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003b5e8
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003b5b2
jmp 0x14003b5eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003b838
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.140036bc0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov ecx, recv
call fcn.1400a4d14
mov r15, rax
mov qword [rsp + 0x78], rax
lea rbx, [rax + 0xc]
mov qword [rbp - 0x78], rbx
mov r8d, recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
mov ecx, recv
call fcn.1400a4d14
mov r13, rax
mov qword [rsp + 0x60], rax
lea r12, [rax + 0xc]
mov qword [rsp + 0x70], r12
mov r8d, recv
lea rdx, [rsp + 0x48]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x30], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x40], rbx
mov r8d, recv
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2db1190]
mov rcx, r14
call fcn.140036c60
mov rdi, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x30], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x40], rbx
mov r8d, recv
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2db1190]
mov rcx, r14
call fcn.140036c60
mov rbx, rax
mov dword [rbp + 0x210], 0x42960000
mov dword [rbp + 0x218], 0x42960000
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x210]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x218]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r13, r13
je 0x14003b7f3
sub r12, r13
sar r12, 2
lea rdx, [r12*4]
cmp rdx, 0x1000
jb 0x14003b7ea
add rdx, 0x27
mov rcx, qword [r13 - 8]
sub r13, rcx
lea rax, [r13 - 8]
cmp rax, 0x1f
ja 0x14003b898
mov r13, rcx
mov rcx, r13
call fcn.1400a4a5c
nop
test r15, r15
je 0x14003b838
lea rax, [r15 + 0xc]
sub rax, r15
sar rax, 2
lea rdx, [rax*4]
cmp rdx, 0x1000
jb 0x14003b830
add rdx, 0x27
mov rcx, qword [r15 - 8]
sub r15, rcx
lea rax, [r15 - 8]
cmp rax, 0x1f
ja 0x14003b89f
mov r15, rcx
mov rcx, r15
call fcn.1400a4a5c
mov edi, esi
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b8a9
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003b8a9
nop word [rax + rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003b8a6
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003b870
jmp 0x14003b8a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003baec
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.140036bc0
mov rsi, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], Ordinal_41
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov ecx, recv
call fcn.1400a4d14
mov r13, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x80], r15
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], Ordinal_41
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
mov ecx, recv
call fcn.1400a4d14
mov r12, rax
mov qword [rsp + 0x60], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x70], rbx
mov r8d, recv
lea rdx, [rsp + 0x48]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x68], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x30], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x40], rbx
mov r8d, recv
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2ef5850]
mov rcx, r14
call fcn.140036c60
mov rdi, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov ecx, recv
call fcn.1400a4d14
mov qword [rsp + 0x30], rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0x40], rbx
mov r8d, recv
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
lea rdx, [rsi + 0x2ef5850]
mov rcx, r14
call fcn.140036c60
mov rbx, rax
mov dword [rbp + 0x210], 0x42960000
mov dword [rbp + 0x218], 0x42960000
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x210]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x218]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r12, r12
je 0x14003bab4
lea rax, [r12 + 0xc]
sub rax, r12
sar rax, 2
lea rdx, [rax*4]
cmp rdx, 0x1000
jb 0x14003baab
add rdx, 0x27
mov rcx, qword [r12 - 8]
sub r12, rcx
lea rax, [r12 - 8]
cmp rax, 0x1f
ja 0x14003bb07
mov r12, rcx
mov rcx, r12
call fcn.1400a4a5c
nop
test r13, r13
je 0x14003baec
sub r15, r13
and r15, 0xfffffffffffffffc
cmp r15, 0x1000
jb 0x14003bae1
add r15, 0x27
mov rcx, qword [r13 - 8]
sub r13, rcx
lea rax, [r13 - 8]
cmp rax, 0x1f
ja 0x14003bb0e
mov r13, rcx
mov rdx, r15
mov rcx, r13
call fcn.1400a4a5c
mov rbx, qword [rsp + 0x328]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3