Function at 0x140005a90
Capabilities:
Enumerate process modules
Enumerate processes
Execute command
Get session user name
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rax, qword [0x1400a20c0]
xor rax, rsp
mov qword [rbp + 0x610], rax
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
btr eax, 0x13
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rbp + 0x3c8], 0x101
lea rdx, [rbp + 0x3c8]
lea rcx, [rbp + 0x400]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp + 0x3e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov r9d, 2
mov r8b, 0xe4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea rdx, [rbp + 0x3d0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rbp + 0x3dc]
mov r9d, dword [rbp + 0x3d4]
sub ecx, r9d
mov eax, dword [rbp + 0x3d8]
mov r8d, dword [rbp + 0x3d0]
sub eax, r8d
mov dword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r13d, r13d
nop
xor edx, edx
lea rcx, [0x140091970]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140005bd0
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005c5e
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005c5e
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005c5a
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005c31
jmp 0x140005c5e
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000797e
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005ccf
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005ccf
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005ccb
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005ca2
jmp 0x140005ccf
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000764e
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005d40
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005d40
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005d3c
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005d13
jmp 0x140005d40
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000731e
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005db1
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005db1
lea rdx, str.FiveM_b2189_GTAProcess.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005dad
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005d84
jmp 0x140005db1
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140006fee
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005e22
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005e22
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005e1e
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005df5
jmp 0x140005e22
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140006cbe
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005e9d
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005e9d
nop word [rax + rax]
lea rdx, str.FiveM_b2372_GTAProcess.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005e99
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005e70
jmp 0x140005e9d
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000698e
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005f0e
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005f0e
lea rdx, str.FiveM_b2060_GTAProcess.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005f0a
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005ee1
jmp 0x140005f0e
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000665e
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005f7f
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005f7f
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005f7b
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005f52
jmp 0x140005f7f
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000632e
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005ff0
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005ff0
lea rdx, str.FiveM_b2545_GTAProcess.exe
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005fec
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005fc3
jmp 0x140005ff0
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140005bd0
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor sil, sil
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000613a
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140006131
lea rdx, str.FiveM_b2545_GTAProcess.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000612d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140006104
jmp 0x140006131
mov r14, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r12, [r14 + 0x25667e8]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0x189
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r13
mov ecx, 8
call fcn.14007eda0
mov qword [rbp + 0x3b0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3c0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea r14, [rax + 8]
mov qword [rbp + 0x3b8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov r15, r14
mov rdx, qword [rbp + 0x3b0]
sub r15, rdx
sar r15, 2
test r15, r15
je 0x140006272
movabs rax, 0x3fffffffffffffff
cmp r15, rax
jbe 0x1400061e2
call fcn.14000c540
int3
lea r15, [r15*4]
test r15, r15
jne 0x1400061f4
mov rdi, r13
jmp 0x140006244
cmp r15, 0x1000
jb 0x14000622b
lea rcx, [r15 + 0x27]
cmp rcx, r15
ja 0x14000620c
call fcn.1400019f0
int3
call fcn.14007eda0
test rax, rax
je 0x140006224
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140006236
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14007eda0
mov rdi, rax
mov rdx, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
lea rcx, [r15 + rdi]
mov qword [rsp + 0x58], rcx
sub r14, rdx
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar r14, 2
lea rax, [rdi + r14*4]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
call fcn.140005980
mov rdi, rax
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400062e0
test sil, sil
jne 0x140006301
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006301
mov sil, 1
nop dword [rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a2150]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400062b0
jmp 0x140006301
xor sil, sil
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a3570]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140006285
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor sil, sil
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006467
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000645e
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000645a
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140006431
jmp 0x14000645e
mov r14, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r12, [r14 + 0x26684d8]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0x189
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r13
mov ecx, 8
call fcn.14007eda0
mov qword [rbp + 0x3b0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3c0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea r14, [rax + 8]
mov qword [rbp + 0x3b8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov r15, r14
mov rdx, qword [rbp + 0x3b0]
sub r15, rdx
sar r15, 2
test r15, r15
je 0x14000659f
movabs rax, 0x3fffffffffffffff
cmp r15, rax
jbe 0x14000650f
call fcn.14000c540
int3
lea r15, [r15*4]
test r15, r15
jne 0x140006521
mov rdi, r13
jmp 0x140006571
cmp r15, 0x1000
jb 0x140006558
lea rcx, [r15 + 0x27]
cmp rcx, r15
ja 0x140006539
call fcn.1400019f0
int3
call fcn.14007eda0
test rax, rax
je 0x140006551
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140006563
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14007eda0
mov rdi, rax
mov rdx, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
lea rcx, [rdi + r15]
mov qword [rsp + 0x58], rcx
sub r14, rdx
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar r14, 2
lea rax, [rdi + r14*4]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
call fcn.140005980
mov rdi, rax
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006610
test sil, sil
jne 0x140006631
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006631
mov sil, 1
nop word [rax + rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a2150]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400065e0
jmp 0x140006631
xor sil, sil
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a3570]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400065b2
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor sil, sil
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006797
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000678e
lea rdx, str.FiveM_b2060_GTAProcess.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000678a
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140006761
jmp 0x14000678e
mov r14, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r12, [r14 + 0x24c8858]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0x189
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r13
mov ecx, 8
call fcn.14007eda0
mov qword [rbp + 0x3b0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3c0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea r14, [rax + 8]
mov qword [rbp + 0x3b8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov r15, r14
mov rdx, qword [rbp + 0x3b0]
sub r15, rdx
sar r15, 2
test r15, r15
je 0x1400068cf
movabs rax, 0x3fffffffffffffff
cmp r15, rax
jbe 0x14000683f
call fcn.14000c540
int3
lea r15, [r15*4]
test r15, r15
jne 0x140006851
mov rdi, r13
jmp 0x1400068a1
cmp r15, 0x1000
jb 0x140006888
lea rcx, [r15 + 0x27]
cmp rcx, r15
ja 0x140006869
call fcn.1400019f0
int3
call fcn.14007eda0
test rax, rax
je 0x140006881
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140006893
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14007eda0
mov rdi, rax
mov rdx, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
lea rcx, [rdi + r15]
mov qword [rsp + 0x58], rcx
sub r14, rdx
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar r14, 2
lea rax, [rdi + r14*4]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
call fcn.140005980
mov rdi, rax
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006940
test sil, sil
jne 0x140006961
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006961
mov sil, 1
nop word [rax + rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a2150]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140006910
jmp 0x140006961
xor sil, sil
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a3570]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400068e2
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor sil, sil
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006ac7
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140006abe
lea rdx, str.FiveM_b2372_GTAProcess.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140006aba
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140006a91
jmp 0x140006abe
mov r14, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r12, [r14 + 0x252dcd8]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0x189
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r13
mov ecx, 8
call fcn.14007eda0
mov qword [rbp + 0x3b0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3c0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea r14, [rax + 8]
mov qword [rbp + 0x3b8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov r15, r14
mov rdx, qword [rbp + 0x3b0]
sub r15, rdx
sar r15, 2
test r15, r15
je 0x140006bff
movabs rax, 0x3fffffffffffffff
cmp r15, rax
jbe 0x140006b6f
call fcn.14000c540
int3
lea r15, [r15*4]
test r15, r15
jne 0x140006b81
mov rdi, r13
jmp 0x140006bd1
cmp r15, 0x1000
jb 0x140006bb8
lea rcx, [r15 + 0x27]
cmp rcx, r15
ja 0x140006b99
call fcn.1400019f0
int3
call fcn.14007eda0
test rax, rax
je 0x140006bb1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140006bc3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14007eda0
mov rdi, rax
mov rdx, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
lea rcx, [rdi + r15]
mov qword [rsp + 0x58], rcx
sub r14, rdx
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar r14, 2
lea rax, [rdi + r14*4]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
call fcn.140005980
mov rdi, rax
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006c70
test sil, sil
jne 0x140006c91
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006c91
mov sil, 1
nop word [rax + rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a2150]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140006c40
jmp 0x140006c91
xor sil, sil
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a3570]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140006c12
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor sil, sil
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006df7
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140006dee
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140006dea
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140006dc1
jmp 0x140006dee
mov r14, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r12, [r14 + 0x2567db0]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0x189
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r13
mov ecx, 8
call fcn.14007eda0
mov qword [rbp + 0x3b0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3c0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea r14, [rax + 8]
mov qword [rbp + 0x3b8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov r15, r14
mov rdx, qword [rbp + 0x3b0]
sub r15, rdx
sar r15, 2
test r15, r15
je 0x140006f2f
movabs rax, 0x3fffffffffffffff
cmp r15, rax
jbe 0x140006e9f
call fcn.14000c540
int3
lea r15, [r15*4]
test r15, r15
jne 0x140006eb1
mov rdi, r13
jmp 0x140006f01
cmp r15, 0x1000
jb 0x140006ee8
lea rcx, [r15 + 0x27]
cmp rcx, r15
ja 0x140006ec9
call fcn.1400019f0
int3
call fcn.14007eda0
test rax, rax
je 0x140006ee1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140006ef3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14007eda0
mov rdi, rax
mov rdx, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
lea rcx, [r15 + rdi]
mov qword [rsp + 0x58], rcx
sub r14, rdx
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar r14, 2
lea rax, [rdi + r14*4]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
call fcn.140005980
mov rdi, rax
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006fa0
test sil, sil
jne 0x140006fc1
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140006fc1
mov sil, 1
nop word [rax + rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a2150]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140006f70
jmp 0x140006fc1
xor sil, sil
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a3570]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140006f42
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor sil, sil
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140007127
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000711e
lea rdx, str.FiveM_b2189_GTAProcess.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000711a
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400070f1
jmp 0x14000711e
mov r14, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r12, [r14 + 0x24e6d90]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0x189
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r13
mov ecx, 8
call fcn.14007eda0
mov qword [rbp + 0x3b0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3c0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea r14, [rax + 8]
mov qword [rbp + 0x3b8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov r15, r14
mov rdx, qword [rbp + 0x3b0]
sub r15, rdx
sar r15, 2
test r15, r15
je 0x14000725f
movabs rax, 0x3fffffffffffffff
cmp r15, rax
jbe 0x1400071cf
call fcn.14000c540
int3
lea r15, [r15*4]
test r15, r15
jne 0x1400071e1
mov rdi, r13
jmp 0x140007231
cmp r15, 0x1000
jb 0x140007218
lea rcx, [r15 + 0x27]
cmp rcx, r15
ja 0x1400071f9
call fcn.1400019f0
int3
call fcn.14007eda0
test rax, rax
je 0x140007211
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140007223
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14007eda0
mov rdi, rax
mov rdx, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
lea rcx, [rdi + r15]
mov qword [rsp + 0x58], rcx
sub r14, rdx
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar r14, 2
lea rax, [rdi + r14*4]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
call fcn.140005980
mov rdi, rax
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400072d0
test sil, sil
jne 0x1400072f1
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400072f1
mov sil, 1
nop word [rax + rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a2150]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400072a0
jmp 0x1400072f1
xor sil, sil
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a3570]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140007272
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor sil, sil
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140007457
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000744e
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000744a
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140007421
jmp 0x14000744e
mov r14, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r12, [r14 + 0x254d448]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0x189
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r13
mov ecx, 8
call fcn.14007eda0
mov qword [rbp + 0x3b0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3c0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea r14, [rax + 8]
mov qword [rbp + 0x3b8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov r15, r14
mov rdx, qword [rbp + 0x3b0]
sub r15, rdx
sar r15, 2
test r15, r15
je 0x14000758f
movabs rax, 0x3fffffffffffffff
cmp r15, rax
jbe 0x1400074ff
call fcn.14000c540
int3
lea r15, [r15*4]
test r15, r15
jne 0x140007511
mov rdi, r13
jmp 0x140007561
cmp r15, 0x1000
jb 0x140007548
lea rcx, [r15 + 0x27]
cmp rcx, r15
ja 0x140007529
call fcn.1400019f0
int3
call fcn.14007eda0
test rax, rax
je 0x140007541
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140007553
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14007eda0
mov rdi, rax
mov rdx, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
lea rcx, [r15 + rdi]
mov qword [rsp + 0x58], rcx
sub r14, rdx
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar r14, 2
lea rax, [rdi + r14*4]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
call fcn.140005980
mov rdi, rax
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140007600
test sil, sil
jne 0x140007621
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140007621
mov sil, 1
nop word [rax + rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a2150]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400075d0
jmp 0x140007621
xor sil, sil
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a3570]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400075a2
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor sil, sil
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140007787
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000777e
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000777a
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140007751
jmp 0x14000777e
mov r14, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r12, [r14 + 0x257bea0]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0x189
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r13
mov ecx, 8
call fcn.14007eda0
mov qword [rbp + 0x3b0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3c0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea r14, [rax + 8]
mov qword [rbp + 0x3b8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov r15, r14
mov rdx, qword [rbp + 0x3b0]
sub r15, rdx
sar r15, 2
test r15, r15
je 0x1400078bf
movabs rax, 0x3fffffffffffffff
cmp r15, rax
jbe 0x14000782f
call fcn.14000c540
int3
lea r15, [r15*4]
test r15, r15
jne 0x140007841
mov rdi, r13
jmp 0x140007891
cmp r15, 0x1000
jb 0x140007878
lea rcx, [r15 + 0x27]
cmp rcx, r15
ja 0x140007859
call fcn.1400019f0
int3
call fcn.14007eda0
test rax, rax
je 0x140007871
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140007883
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14007eda0
mov rdi, rax
mov rdx, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
lea rcx, [r15 + rdi]
mov qword [rsp + 0x58], rcx
sub r14, rdx
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar r14, 2
lea rax, [rdi + r14*4]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
call fcn.140005980
mov rdi, rax
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140007930
test sil, sil
jne 0x140007951
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140007951
mov sil, 1
nop word [rax + rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a2150]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140007900
jmp 0x140007951
xor sil, sil
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a3570]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400078d2
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor sil, sil
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140007ab7
mov dword [rsp + 0x70], 0x438
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140007aae
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140007aaa
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140007a81
jmp 0x140007aae
mov r14, qword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r12, [r14 + 0x247f840]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0x189
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3c0], r13
mov ecx, 8
call fcn.14007eda0
mov qword [rbp + 0x3b0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3c0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
lea r14, [rax + 8]
mov qword [rbp + 0x3b8], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov r15, r14
mov rdx, qword [rbp + 0x3b0]
sub r15, rdx
sar r15, 2
test r15, r15
je 0x140007bef
movabs rax, 0x3fffffffffffffff
cmp r15, rax
jbe 0x140007b5f
call fcn.14000c540
int3
lea r15, [r15*4]
test r15, r15
jne 0x140007b71
mov rdi, r13
jmp 0x140007bc1
cmp r15, 0x1000
jb 0x140007ba8
lea rcx, [r15 + 0x27]
cmp rcx, r15
ja 0x140007b89
call fcn.1400019f0
int3
call fcn.14007eda0
test rax, rax
je 0x140007ba1
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140007bb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14007eda0
mov rdi, rax
mov rdx, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
lea rcx, [rdi + r15]
mov qword [rsp + 0x58], rcx
sub r14, rdx
mov r8, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar r14, 2
lea rax, [rdi + r14*4]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
call fcn.140005980
mov rdi, rax
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140007c60
test sil, sil
jne 0x140007c81
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140007c81
mov sil, 1
nop word [rax + rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a2150]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140007c30
jmp 0x140007c81
xor sil, sil
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x1400a3570]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140007c02
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3