Function at 0x140001390
Capabilities:
Encode data using xor
Enumerate processes
Execute command
Get session user name
Log keystrokes via polling
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x488]
sub rsp, 0x560
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x440], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor r14b, r14b
mov dword [rbp - 0x3c], 0x101
lea rdx, [rbp - 0x3c]
lea rcx, [rbp + 0x230]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rbp - 0x2c]
mov r9d, dword [rbp - 0x34]
sub edx, r9d
mov ecx, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x38]
sub ecx, r8d
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, [0x1400054e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_________________________________________________________________________________________________________n_________________________________________________________________________________________________________n_________________________________________________________________________________________________________n_________________________________________________________________________________________________________n_________________________________________________________________________________________________________n_________________________________________________________________________________________________________n
call fcn.140003590
mov rcx, rax
call fcn.140003770
lea rdx, [0x140003940]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t_t_t_t_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14000578c]
call fcn.140003590
lea rdx, [0x140003940]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._t_Waiting_for__FiveM__Start...
call fcn.140003590
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140001510
lea rcx, [0x1400054e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x12c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400054e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r15d, r15d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400015bc
mov dword [rbp - 0x10], 0x238
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400015bc
nop word [rax + rax]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400015b8
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001590
jmp 0x1400015bc
mov r15d, dword [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
jne 0x140002d7f
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000162c
mov dword [rbp - 0x10], 0x238
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000162c
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001628
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001600
jmp 0x14000162c
mov r15d, dword [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
jne 0x14000260f
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000169c
mov dword [rbp - 0x10], 0x238
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000169c
nop dword [rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001698
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001670
jmp 0x14000169c
mov r15d, dword [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
jne 0x140001ea4
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000170c
mov dword [rbp - 0x10], 0x238
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000170c
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001708
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400016e0
jmp 0x14000170c
mov r15d, dword [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x140001510
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005804]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tProgram_:_HanWai
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005838]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tGame_Build_:_FiveM_b3095_GTAProcess
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005850]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tSethotkey_:
call fcn.140003590
lea rdx, [0x1400011a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
lea rcx, [0x1400054e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm0, xmmword [0x140005978]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x140005988]
movups xmmword [rbp - 0x80], xmm1
movzx eax, word [0x140005998]
mov word [rbp - 0x70], ax
xor ecx, ecx
cmp dword [0x140008098], 2
jl 0x140001a3c
movdqa xmm4, xmmword [0x1400059a0]
movdqa xmm3, xmmword [0x1400059e0]
movdqa xmm5, xmmword [str.9999]
movdqa xmm0, xmmword [0x1400059d0]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x74]
movdqa xmm6, xmmword [0x1400059c0]
mov r8d, dword [rsp + 0x60]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x140001950
cmp ecx, 0x22
jge 0x140001a7e
movsxd rax, ecx
lea r8, [rsp + 0x70]
add r8, rax
nop word [rax + rax]
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
sub al, dl
add al, 0x36
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x22
jl 0x140001a50
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003590
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movabs r12, 0x3fffffffffffffff
nop word [rax + rax]
movzx ebx, r14b
mov ecx, dword [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001e4a
test r14b, r14b
sete r14b
mov edx, 0x12c
test bl, bl
jne 0x140001c9e
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, r15d
call fcn.1400011c0
mov rbx, rax
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
lea rax, [rbx + 0x2053218]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x54], 0x2b4
movdqu xmmword [rbp - 0x68], xmm0
mov ecx, 8
call fcn.140003d80
mov rsi, rax
mov qword [rbp - 0x68], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x58], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsi], rax
mov qword [rbp - 0x60], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 0
mov r13, rdi
sub r13, rsi
mov rbx, r13
sar rbx, 2
test rbx, rbx
je 0x140001bfd
cmp rbx, r12
ja 0x140001e84
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140001ba1
xor eax, eax
jmp 0x140001bde
cmp rbx, 0x1000
jb 0x140001bd6
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140001e7e
call fcn.140003d80
mov rcx, rax
test rax, rax
je 0x140001e77
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001bde
mov rcx, rbx
call fcn.140003d80
mov qword [rsp + 0x70], rax
add rbx, rax
mov qword [rbp - 0x80], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x78], rbx
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rcx, r13
call fcn.140001280
mov rbx, rax
xor eax, eax
mov dword [rbp - 0x4c], eax
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x4c]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x48], 0x41400006
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x48]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x140001e4a
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x140001e3f
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, r15d
call fcn.1400011c0
mov rbx, rax
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0x2053218]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rsp + 0x58], 0x30
mov dword [rsp + 0x5c], 0x2b4
movdqu xmmword [rsp + 0x70], xmm0
mov ecx, 8
call fcn.140003d80
mov rsi, rax
mov qword [rsp + 0x70], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x80], rdi
mov rax, qword [rsp + 0x58]
mov qword [rsi], rax
mov qword [rsp + 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 0
mov r13, rdi
sub r13, rsi
mov rbx, r13
sar rbx, 2
test rbx, rbx
je 0x140001db2
cmp rbx, r12
ja 0x140001e97
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140001d58
xor eax, eax
jmp 0x140001d95
cmp rbx, 0x1000
jb 0x140001d8d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140001e91
call fcn.140003d80
mov rcx, rax
test rax, rax
je 0x140001e8a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001d95
mov rcx, rbx
call fcn.140003d80
mov qword [rbp - 0x68], rax
add rbx, rax
mov qword [rbp - 0x58], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x60], rbx
lea r8, [rbp - 0x68]
mov rdx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rcx, r13
call fcn.140001280
mov rbx, rax
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x44]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x40], 0xe
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x140001e4a
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x140001e3f
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e9d
mov rdx, rdi
mov rcx, rsi
call fcn.140003dbc
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001ac0
mov edx, 0x1f4
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001100
int3
call fcn.140003a10
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001100
int3
call fcn.140003a10
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005804]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tProgram_:_HanWai
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005838]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tGame_Build_:_FiveM_GTAProcess
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005850]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tSethotkey_:
call fcn.140003590
lea rdx, [0x1400011a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
lea rcx, [0x1400054e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm0, xmmword [0x140005978]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x140005988]
movups xmmword [rbp - 0x80], xmm1
movzx eax, word [0x140005998]
mov word [rbp - 0x70], ax
xor ecx, ecx
cmp dword [0x140008098], 2
jl 0x1400021bc
movdqa xmm4, xmmword [0x1400059a0]
movdqa xmm3, xmmword [0x1400059e0]
movdqa xmm5, xmmword [str.9999]
movdqa xmm0, xmmword [0x1400059d0]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x74]
movdqa xmm6, xmmword [0x1400059c0]
mov r8d, dword [rsp + 0x60]
nop dword [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x1400020d0
cmp ecx, 0x22
jge 0x1400021fe
movsxd rax, ecx
lea r8, [rsp + 0x70]
add r8, rax
nop word [rax + rax]
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
sub al, dl
add al, 0x36
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x22
jl 0x1400021d0
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003590
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movabs r12, 0x3fffffffffffffff
nop word [rax + rax]
movzx ebx, r14b
mov ecx, dword [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400025c9
test r14b, r14b
sete r14b
mov edx, 0x12c
test bl, bl
jne 0x14000241d
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, r15d
call fcn.1400011c0
mov rbx, rax
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0x212b208]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rsp + 0x58], 0x30
mov dword [rsp + 0x5c], 0x2b4
movdqu xmmword [rsp + 0x70], xmm0
mov ecx, 8
call fcn.140003d80
mov rsi, rax
mov qword [rsp + 0x70], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x80], rdi
mov rax, qword [rsp + 0x58]
mov qword [rsi], rax
mov qword [rsp + 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 0
mov r13, rdi
sub r13, rsi
mov rbx, r13
sar rbx, 2
test rbx, rbx
je 0x14000237d
cmp rbx, r12
ja 0x1400025ef
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140002323
xor eax, eax
jmp 0x140002360
cmp rbx, 0x1000
jb 0x140002358
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400025e9
call fcn.140003d80
mov rcx, rax
test rax, rax
je 0x1400025e2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002360
mov rcx, rbx
call fcn.140003d80
mov qword [rbp - 0x68], rax
add rbx, rax
mov qword [rbp - 0x58], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x60], rbx
lea r8, [rbp - 0x68]
mov rdx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rcx, r13
call fcn.140001280
mov rbx, rax
xor eax, eax
mov dword [rbp - 0x40], eax
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x44], 0x41400006
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x44]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x1400025c9
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x1400025be
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, r15d
call fcn.1400011c0
mov rbx, rax
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0x212b208]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x54], 0x2b4
movdqu xmmword [rsp + 0x70], xmm0
mov ecx, 8
call fcn.140003d80
mov rsi, rax
mov qword [rsp + 0x70], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x80], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsi], rax
mov qword [rsp + 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 0
mov r13, rdi
sub r13, rsi
mov rbx, r13
sar rbx, 2
test rbx, rbx
je 0x140002531
cmp rbx, r12
ja 0x140002602
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400024d7
xor eax, eax
jmp 0x140002514
cmp rbx, 0x1000
jb 0x14000250c
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400025fc
call fcn.140003d80
mov rcx, rax
test rax, rax
je 0x1400025f5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002514
mov rcx, rbx
call fcn.140003d80
mov qword [rbp - 0x68], rax
add rbx, rax
mov qword [rbp - 0x58], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x60], rbx
lea r8, [rbp - 0x68]
mov rdx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rcx, r13
call fcn.140001280
mov rbx, rax
xor eax, eax
mov dword [rbp - 0x48], eax
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x48]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x4c], 0xe
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x4c]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x1400025c9
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x1400025be
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002608
mov rdx, rdi
mov rcx, rsi
call fcn.140003dbc
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140002240
jmp 0x140001e5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001100
int3
call fcn.140003a10
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001100
int3
call fcn.140003a10
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005804]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tProgram_:_HanWai
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005838]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tGame_Build_:_FiveM_b2944_GTAProcess
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005850]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tSethotkey_:
call fcn.140003590
lea rdx, [0x1400011a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
lea rcx, [0x1400054e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm0, xmmword [0x140005978]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x140005988]
movups xmmword [rbp - 0x80], xmm1
movzx eax, word [0x140005998]
mov word [rbp - 0x70], ax
xor ecx, ecx
cmp dword [0x140008098], 2
jl 0x14000292c
movdqa xmm4, xmmword [0x1400059a0]
movdqa xmm3, xmmword [0x1400059e0]
movdqa xmm5, xmmword [str.9999]
movdqa xmm0, xmmword [0x1400059d0]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x74]
movdqa xmm6, xmmword [0x1400059c0]
mov r8d, dword [rsp + 0x60]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x140002840
cmp ecx, 0x22
jge 0x14000296e
movsxd rax, ecx
lea r8, [rsp + 0x70]
add r8, rax
nop word [rax + rax]
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
sub al, dl
add al, 0x36
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x22
jl 0x140002940
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003590
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movabs r12, 0x3fffffffffffffff
nop word [rax + rax]
movzx ebx, r14b
mov ecx, dword [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140002d39
test r14b, r14b
sete r14b
mov edx, 0x12c
test bl, bl
jne 0x140002b8d
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, r15d
call fcn.1400011c0
mov rbx, rax
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0x2053218]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rsp + 0x58], 0x30
mov dword [rsp + 0x5c], 0x2b4
movdqu xmmword [rsp + 0x70], xmm0
mov ecx, 8
call fcn.140003d80
mov rsi, rax
mov qword [rsp + 0x70], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x80], rdi
mov rax, qword [rsp + 0x58]
mov qword [rsi], rax
mov qword [rsp + 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 0
mov r13, rdi
sub r13, rsi
mov rbx, r13
sar rbx, 2
test rbx, rbx
je 0x140002aed
cmp rbx, r12
ja 0x140002d5f
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140002a93
xor eax, eax
jmp 0x140002ad0
cmp rbx, 0x1000
jb 0x140002ac8
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140002d59
call fcn.140003d80
mov rcx, rax
test rax, rax
je 0x140002d52
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002ad0
mov rcx, rbx
call fcn.140003d80
mov qword [rbp - 0x68], rax
add rbx, rax
mov qword [rbp - 0x58], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x60], rbx
lea r8, [rbp - 0x68]
mov rdx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rcx, r13
call fcn.140001280
mov rbx, rax
xor eax, eax
mov dword [rbp - 0x40], eax
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x44], 0x41400006
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x44]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x140002d39
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x140002d2e
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, r15d
call fcn.1400011c0
mov rbx, rax
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0x2053218]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x54], 0x2b4
movdqu xmmword [rsp + 0x70], xmm0
mov ecx, 8
call fcn.140003d80
mov rsi, rax
mov qword [rsp + 0x70], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x80], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsi], rax
mov qword [rsp + 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 0
mov r13, rdi
sub r13, rsi
mov rbx, r13
sar rbx, 2
test rbx, rbx
je 0x140002ca1
cmp rbx, r12
ja 0x140002d72
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140002c47
xor eax, eax
jmp 0x140002c84
cmp rbx, 0x1000
jb 0x140002c7c
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140002d6c
call fcn.140003d80
mov rcx, rax
test rax, rax
je 0x140002d65
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002c84
mov rcx, rbx
call fcn.140003d80
mov qword [rbp - 0x68], rax
add rbx, rax
mov qword [rbp - 0x58], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x60], rbx
lea r8, [rbp - 0x68]
mov rdx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rcx, r13
call fcn.140001280
mov rbx, rax
xor eax, eax
mov dword [rbp - 0x48], eax
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x48]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x4c], 0xe
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x4c]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x140002d39
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x140002d2e
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d78
mov rdx, rdi
mov rcx, rsi
call fcn.140003dbc
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400029b0
jmp 0x140001e5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001100
int3
call fcn.140003a10
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001100
int3
call fcn.140003a10
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005804]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tProgram_:_HanWai
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005838]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tGame_Build_:_FiveM_b2699_GTAProcess
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005850]
call fcn.140003590
lea rdx, [0x140003560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140005788]
call fcn.140003590
lea rdx, [0x140003970]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tSethotkey_:
call fcn.140003590
lea rdx, [0x1400011a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
lea rcx, [0x1400054e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Beep]
movups xmm0, xmmword [0x140005978]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x140005988]
movups xmmword [rbp - 0x80], xmm1
movzx eax, word [0x140005998]
mov word [rbp - 0x70], ax
xor ecx, ecx
cmp dword [0x140008098], 2
jl 0x14000309c
movdqa xmm4, xmmword [0x1400059a0]
movdqa xmm3, xmmword [0x1400059e0]
movdqa xmm5, xmmword [str.9999]
movdqa xmm0, xmmword [0x1400059d0]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x74]
movdqa xmm6, xmmword [0x1400059c0]
mov r8d, dword [rsp + 0x60]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x140002fb0
cmp ecx, 0x22
jge 0x1400030de
movsxd rax, ecx
lea r8, [rsp + 0x70]
add r8, rax
nop word [rax + rax]
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
sub al, dl
add al, 0x36
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x22
jl 0x1400030b0
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003590
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movabs r12, 0x3fffffffffffffff
nop word [rax + rax]
movzx ebx, r14b
mov ecx, dword [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400034a9
test r14b, r14b
sete r14b
mov edx, 0x12c
test bl, bl
jne 0x1400032fd
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, r15d
call fcn.1400011c0
mov rbx, rax
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0x2140688]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rsp + 0x58], 0x30
mov dword [rsp + 0x5c], 0x2b4
movdqu xmmword [rsp + 0x70], xmm0
mov ecx, 8
call fcn.140003d80
mov rsi, rax
mov qword [rsp + 0x70], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x80], rdi
mov rax, qword [rsp + 0x58]
mov qword [rsi], rax
mov qword [rsp + 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 0
mov r13, rdi
sub r13, rsi
mov rbx, r13
sar rbx, 2
test rbx, rbx
je 0x14000325d
cmp rbx, r12
ja 0x1400034cf
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140003203
xor eax, eax
jmp 0x140003240
cmp rbx, 0x1000
jb 0x140003238
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400034c9
call fcn.140003d80
mov rcx, rax
test rax, rax
je 0x1400034c2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140003240
mov rcx, rbx
call fcn.140003d80
mov qword [rbp - 0x68], rax
add rbx, rax
mov qword [rbp - 0x58], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x60], rbx
lea r8, [rbp - 0x68]
mov rdx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rcx, r13
call fcn.140001280
mov rbx, rax
xor eax, eax
mov dword [rbp - 0x40], eax
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x44], 0x41400006
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x44]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x1400034a9
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x14000349e
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000349e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, r15d
call fcn.1400011c0
mov rbx, rax
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0x2140688]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x54], 0x2b4
movdqu xmmword [rsp + 0x70], xmm0
mov ecx, 8
call fcn.140003d80
mov rsi, rax
mov qword [rsp + 0x70], rax
lea rdi, [rax + 8]
mov qword [rbp - 0x80], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsi], rax
mov qword [rsp + 0x78], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 0
mov r13, rdi
sub r13, rsi
mov rbx, r13
sar rbx, 2
test rbx, rbx
je 0x140003411
cmp rbx, r12
ja 0x1400034e2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400033b7
xor eax, eax
jmp 0x1400033f4
cmp rbx, 0x1000
jb 0x1400033ec
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400034dc
call fcn.140003d80
mov rcx, rax
test rax, rax
je 0x1400034d5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400033f4
mov rcx, rbx
call fcn.140003d80
mov qword [rbp - 0x68], rax
add rbx, rax
mov qword [rbp - 0x58], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x60], rbx
lea r8, [rbp - 0x68]
mov rdx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rcx, r13
call fcn.140001280
mov rbx, rax
xor eax, eax
mov dword [rbp - 0x48], eax
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x48]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x4c], 0xe
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x4c]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x1400034a9
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x14000349e
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034e8
mov rdx, rdi
mov rcx, rsi
call fcn.140003dbc
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140003120
jmp 0x140001e5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001100
int3
call fcn.140003a10
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001100
int3
call fcn.140003a10
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3