Function at 0x140003630
Capabilities:
Delete file
Execute command
Hide graphical window
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rcx, [0x14000871c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pat1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop dword [rax]
xor edx, edx
lea rcx, [0x140008720]
call qword [sym.imp.USER32.dll_FindWindowW]
lea rcx, [0x14000871c]
test rax, rax
jne 0x1400036c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pat1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.fail_to_find_fivem
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
jmp 0x140003680
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.pless_end_for_inject
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003680
lea rcx, [0x14000871c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x69], 0x3deb851f
mov word [rbp - 0x65], 0x6e5c
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
xor r12d, r12d
mov qword [rbp - 0x11], r12
lea rcx, [rbp - 9]
call fcn.1400027c0
lea rcx, [rbp - 0x21]
cmp rcx, rax
je 0x140003757
mov rsi, qword [rax]
mov qword [rbp - 0x21], rsi
mov r14, qword [rax + 8]
mov qword [rbp - 0x19], r14
mov r12, qword [rax + 0x10]
mov qword [rbp - 0x11], r12
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
jmp 0x14000375f
mov r14, qword [rbp - 0x19]
mov rsi, qword [rbp - 0x21]
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x49], r14
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400037ad
mov rax, qword [rbp + 7]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003da8
call fcn.1400060ec
cmp rsi, r14
jne 0x140003931
call fcn.140002270
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 9]
call fcn.140002000
mov rbx, rax
lea rax, [rbp - 0x21]
cmp rax, rbx
je 0x140003856
test rsi, rsi
je 0x140003828
sub r12, rsi
sar r12, 3
lea rdx, [r12*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003820
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003daf
mov rcx, rsi
call fcn.1400060ec
mov rax, qword [rbx]
mov qword [rbp - 0x21], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x19], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x11], rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x14000389c
mov rax, qword [rbp + 7]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003897
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003daf
call fcn.1400060ec
lea rcx, [rbp - 0x21]
call fcn.140002540
lea rdx, str.Found_addresses:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
mov rcx, rax
lea rdx, [0x140005960]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp - 0x21]
mov qword [rbp - 0x41], rsi
mov rdi, rsi
mov r14, qword [rbp - 0x19]
mov qword [rbp - 0x49], r14
cmp rsi, r14
je 0x14000392b
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
mov rcx, rax
lea rdx, [0x140001630]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140005960]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r14
jne 0x1400038e0
mov r12, qword [rbp - 0x11]
jmp 0x1400039ab
lea rdx, str.Found_addresses_from_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
mov rcx, rax
lea rdx, [0x140005960]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, rsi
nop word [rax + rax]
mov rbx, qword [rdi]
lea rdx, str.Address:_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
mov rcx, rax
lea rdx, [0x140001630]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140005960]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rdi, 8
cmp rdi, r14
jne 0x140003960
mov r13, rsi
cmp rsi, r14
je 0x140003d67
nop word [rax + rax]
mov rdi, qword [r13]
mov dword [rbp + 0xf], 0
call fcn.140002270
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140003a07
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0xf]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x13], 0x3deb851f
lea rdx, str.Change_value_successful_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x13]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0x40
lea r8, str.info
lea rdx, str.Eiei
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
lea rcx, [0x140008720]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140003d43
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003bd2
call fcn.140002f20
call fcn.140003580
mov ebx, eax
mov ecx, eax
call fcn.140001e40
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov dword [rbp - 0x39], 0x30
mov dword [rbp - 0x35], 0x2b4
mov ecx, 8
call fcn.140005e70
mov r15, rax
mov qword [rbp - 9], rax
lea rdi, [rax + 8]
mov qword [rbp + 7], rdi
mov rax, qword [rbp - 0x39]
mov qword [r15], rax
mov qword [rbp - 1], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], 0
mov ecx, 8
call fcn.140005e70
mov rbx, rax
mov qword [rbp - 0x61], rax
lea rcx, [rax + 8]
mov qword [rbp - 0x51], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rbp - 0x59], rax
lea r8, [rbp - 0x61]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.140001ef0
mov rbx, rax
mov dword [rbp + 0x17], 0
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp + 0x17]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x1b], 6
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp + 0x1b]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r15, r15
je 0x140003bb1
lea edx, [rdi + 8]
mov rcx, r15
call fcn.1400060ec
mov edx, 0x50
lea ecx, [rdx + 0x14]
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, [0x1400087c8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
mov ecx, 0x30
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003d13
call fcn.140002b20
call fcn.140003580
mov ebx, eax
mov ecx, eax
call fcn.140001e40
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov dword [rbp - 0x31], 0x30
mov dword [rbp - 0x2d], 0x2b4
mov ecx, 8
call fcn.140005e70
mov r15, rax
mov qword [rbp - 9], rax
lea rdi, [rax + 8]
mov qword [rbp + 7], rdi
mov rax, qword [rbp - 0x31]
mov qword [r15], rax
mov qword [rbp - 1], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], 0
mov ecx, 8
call fcn.140005e70
mov rbx, rax
mov qword [rbp - 0x61], rax
lea rcx, [rax + 8]
mov qword [rbp - 0x51], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rbp - 0x59], rax
lea r8, [rbp - 0x61]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.140001ef0
mov rbx, rax
mov dword [rbp + 0x1f], 0
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp + 0x1f]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x23], 0xe
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp + 0x23]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r15, r15
je 0x140003cf3
lea edx, [rdi + 8]
mov rcx, r15
call fcn.1400060ec
mov edx, 0x64
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.0.1150000021
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140003db6
xor edx, edx
lea rcx, [0x140008720]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140003a90
mov r14, qword [rbp - 0x49]
lea rdx, str.Window_has_been_closed._Exiting_hotkey_loop._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005790
add r13, 8
cmp r13, r14
jne 0x1400039c0
mov rsi, qword [rbp - 0x41]
test rsi, rsi
je 0x140003680
sub r12, rsi
and r12, 0xfffffffffffffff8
mov rax, rsi
cmp r12, 0x1000
jb 0x140003d98
add r12, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003dcd
mov rdx, r12
mov rcx, rsi
call fcn.1400060ec
jmp 0x140003680
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, 0x78
lea ecx, [rdx - 0x14]
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3