Function at 0x1401392a1
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
jmp 0x1401623e0
push rbp
push rdi
sub rsp, 0x9a8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x196
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1405d0a00]
xor rax, rbp
mov qword [rbp + 0x948], rax
mov dword [rbp + 0x914], 0
lea rcx, [0x1405fe162]
call fcn.14013994a
nop
movzx eax, byte [0x1405d21d0]
test eax, eax
jne 0x140162475
lea rdx, str.FiveM.exe
lea rcx, [rbp + 0x518]
call fcn.1401347bf
nop
mov eax, dword [rbp + 0x914]
or eax, 1
mov dword [rbp + 0x914], eax
lea rcx, [rbp + 0x518]
call fcn.140139751
movzx eax, al
test eax, eax
jne 0x140162475
mov dword [rbp + 0x924], 1
jmp 0x14016247f
mov dword [rbp + 0x924], 0
movzx eax, byte [rbp + 0x924]
mov byte [rbp + 0x4f4], al
mov eax, dword [rbp + 0x914]
and eax, 1
test eax, eax
je 0x1401624ad
and dword [rbp + 0x914], 0xfffffffe
lea rcx, [rbp + 0x518]
call fcn.140138702
nop
movzx eax, byte [rbp + 0x4f4]
test eax, eax
je 0x14016264f
lea rdx, str.C:Program_Files__x86_Steam_steam.exe
lea rcx, [rbp + 8]
call fcn.140135688
nop
lea rcx, [rbp + 8]
call fcn.140132ad2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp + 0x44], eax
movsxd rax, dword [rbp + 0x44]
mov qword [rbp + 0x928], rax
mov eax, 2
mov rcx, qword [rbp + 0x928]
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.140135476
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 8]
call fcn.140132ad2
mov ecx, dword [rbp + 0x44]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
mov dword [rbp + 0x90], 0x68
lea rax, [rbp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [rbp + 0x118]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0
je 0x140162604
mov byte [0x1405d21d0], 1
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x578], rax
mov rcx, qword [rbp + 0x578]
call fcn.14013597b
cmp qword [rbp + 0x578], 0
jne 0x140162632
mov qword [rbp + 0x928], 0
jmp 0x140162645
mov qword [rbp + 0x68], 0x8123
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x928], rax
lea rcx, [rbp + 8]
call fcn.14013361c
nop
movzx eax, byte [0x1405d21d0]
test eax, eax
je 0x140162663
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [0x1405d1b80]
call fcn.14013540d
movzx eax, al
test eax, eax
jne 0x1401626cb
lea rcx, [0x1405d1b80]
call fcn.140137807
nop
lea rcx, [0x1405d1b80]
call fcn.140137807
nop
lea rcx, [0x1405d1b80]
call fcn.14013540d
movzx eax, al
test eax, eax
jne 0x1401626c9
mov dword [rbp + 0x5b4], 1
lea rdx, [rbp + 0x5b4]
lea rcx, [rbp + 0x598]
call fcn.140133b17
mov rcx, rax
call fcn.14013369e
nop
jmp 0x140162663
lea rcx, [0x1405d1b80]
call fcn.14013379d
mov ecx, eax
call fcn.140137712
nop
call fcn.1401376e0
nop
lea rax, [rbp + 0x604]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x604]
lea rcx, [rbp + 0x5d8]
call fcn.14014eee0
mov qword [rbp + 0x928], rax
mov rax, qword [rbp + 0x928]
mov qword [rbp + 0x930], rax
mov rcx, qword [rbp + 0x930]
call fcn.14013a089
nop
lea rcx, [rbp + 0x5d8]
call fcn.14013563d
nop
lea rax, [rbp + 0x654]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x654]
lea rcx, [rbp + 0x628]
call fcn.14014f090
mov qword [rbp + 0x928], rax
mov rax, qword [rbp + 0x928]
mov qword [rbp + 0x930], rax
mov rcx, qword [rbp + 0x930]
call fcn.14013a089
nop
lea rcx, [rbp + 0x628]
call fcn.14013563d
nop
lea rax, [rbp + 0x6a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x6a4]
lea rcx, [rbp + 0x678]
call fcn.14014f240
mov qword [rbp + 0x928], rax
mov rax, qword [rbp + 0x928]
mov qword [rbp + 0x930], rax
mov rcx, qword [rbp + 0x930]
call fcn.14013a089
nop
lea rcx, [rbp + 0x678]
call fcn.14013563d
nop
lea rax, [rbp + 0x6f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x6f4]
lea rcx, [rbp + 0x6c8]
call fcn.14014f360
mov qword [rbp + 0x928], rax
mov rax, qword [rbp + 0x928]
mov qword [rbp + 0x930], rax
mov rcx, qword [rbp + 0x930]
call fcn.14013a089
nop
lea rcx, [rbp + 0x6c8]
call fcn.14013563d
nop
lea rax, [rbp + 0x744]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x744]
lea rcx, [rbp + 0x718]
call fcn.14014f480
mov qword [rbp + 0x928], rax
mov rax, qword [rbp + 0x928]
mov qword [rbp + 0x930], rax
mov rcx, qword [rbp + 0x930]
call fcn.14013a089
nop
lea rcx, [rbp + 0x718]
call fcn.14013563d
nop
call fcn.140133ef0
movzx eax, al
test eax, eax
je 0x140162d77
mov edx, 0x28
lea rcx, [rbp + 0x168]
call fcn.14013697a
call fcn.1401380f9
mov qword [rbp + 0x928], rax
call fcn.14013a034
mov qword [rbp + 0x930], rax
call fcn.140137de8
mov qword [rbp + 0x938], rax
call fcn.1401366f0
mov qword [rbp + 0x940], rax
mov rax, qword [rbp + 0x928]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x930]
mov r8, qword [rbp + 0x938]
mov rdx, qword [rbp + 0x940]
lea rcx, [rbp + 0x168]
call fcn.140134661
nop
lea rcx, [rbp + 0x168]
call fcn.140137d16
nop
lea rax, [rbp + 0x768]
mov qword [rbp + 0x7c8], rax
lea rax, [rbp + 0x168]
mov qword [rbp + 0x7e8], rax
lea rax, [0x140134616]
mov qword [rbp + 0x808], rax
lea rax, [0x1403b76c8]
mov qword [rsp + 0x30], rax
lea rax, [0x1403b76c7]
mov qword [rsp + 0x28], rax
lea rax, [0x1403b76c6]
mov qword [rsp + 0x20], rax
lea r9, [0x1403b76c5]
lea r8, [rbp + 0x7e8]
lea rdx, [rbp + 0x808]
lea rcx, [rbp + 0x828]
call fcn.140134c3d
mov rdx, rax
mov rcx, qword [rbp + 0x7c8]
call fcn.14013a3d1
mov qword [rbp + 0x928], rax
mov rcx, qword [rbp + 0x928]
call fcn.140139283
nop
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x1a8]
call fcn.140137aa5
nop
cmp dword [rbp + 0x1b0], 0x12
je 0x140162d6a
call fcn.1401366f0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140162a11
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.USER32.dll_TranslateMessage]
nop
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop
lea rcx, [rbp + 0x168]
call fcn.14013938c
mov byte [rbp + 0x924], al
call fcn.140137bfe
movzx ecx, byte [rbp + 0x924]
mov byte [rax + 0x50], cl
lea rcx, [0x1405d1b80]
call fcn.140139ada
nop
lea rcx, [0x1405d1b80]
call fcn.14013340a
nop
cmp dword [rbp + 0x188], 0
jne 0x140162a5e
cmp dword [rbp + 0x184], 0
je 0x140162acf
call fcn.140135b4c
nop
call fcn.140136b5a
mov qword [rbp + 0x928], rax
mov rax, qword [rbp + 0x928]
mov rax, qword [rax]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x930], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, dword [rbp + 0x188]
mov r8d, dword [rbp + 0x184]
xor edx, edx
mov rcx, qword [rbp + 0x928]
call qword [rbp + 0x930]
nop
mov dword [rbp + 0x184], 0
mov eax, dword [rbp + 0x184]
mov dword [rbp + 0x188], eax
call fcn.14013536d
nop
lea rcx, [rbp + 0x168]
call fcn.140138130
nop
call fcn.140138e78
nop
call fcn.140134c42
nop
call fcn.140136e0c
nop
call fcn.140137866
nop
movzx eax, byte [0x1405d20b8]
test eax, eax
je 0x140162bd0
call fcn.14013688a
mov qword [rbp + 0x928], rax
lea rdx, [0x1405d20bc]
lea rcx, [rbp + 0x854]
call fcn.140137249
mov rcx, rax
call fcn.140136885
mov dword [rbp + 0x930], eax
cvtsi2ss xmm0, dword [0x1405d1fd4]
movss dword [rbp + 0x934], xmm0
call fcn.140137bfe
movss xmm0, dword [rax + 0xc]
divss xmm0, dword [0x1403b826c]
movss dword [rbp + 0x938], xmm0
call fcn.140137bfe
movss xmm0, dword [rax + 8]
divss xmm0, dword [0x1403b826c]
movss dword [rbp + 0x93c], xmm0
movss xmm2, dword [rbp + 0x938]
movss xmm1, dword [rbp + 0x93c]
lea rcx, [rbp + 0x884]
call fcn.140136c4f
mov qword [rbp + 0x940], rax
movss xmm0, dword [0x1403b8268]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0x168
mov r9d, dword [rbp + 0x930]
movss xmm2, dword [rbp + 0x934]
mov rdx, qword [rbp + 0x940]
mov rcx, qword [rbp + 0x928]
call fcn.140134f94
nop
movzx eax, byte [0x1405d20cc]
test eax, eax
je 0x140162cac
call fcn.14013688a
mov qword [rbp + 0x928], rax
lea rdx, [0x1405d20d0]
lea rcx, [rbp + 0x8a4]
call fcn.140137249
mov rcx, rax
call fcn.140136885
mov dword [rbp + 0x930], eax
cvtsi2ss xmm0, dword [0x1405d1ff8]
movss dword [rbp + 0x934], xmm0
call fcn.140137bfe
movss xmm0, dword [rax + 0xc]
divss xmm0, dword [0x1403b826c]
movss dword [rbp + 0x938], xmm0
call fcn.140137bfe
movss xmm0, dword [rax + 8]
divss xmm0, dword [0x1403b826c]
movss dword [rbp + 0x93c], xmm0
movss xmm2, dword [rbp + 0x938]
movss xmm1, dword [rbp + 0x93c]
lea rcx, [rbp + 0x8d4]
call fcn.140136c4f
mov qword [rbp + 0x940], rax
movss xmm0, dword [0x1403b8268]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0x168
mov r9d, dword [rbp + 0x930]
movss xmm2, dword [rbp + 0x934]
mov rdx, qword [rbp + 0x940]
mov rcx, qword [rbp + 0x928]
call fcn.140134f94
nop
movzx eax, byte [0x1405d2090]
test eax, eax
je 0x140162cbd
call fcn.140139f53
nop
movzx eax, byte [0x1405d2010]
test eax, eax
je 0x140162cce
call fcn.140139346
nop
lea rcx, [rbp + 0x168]
call fcn.140137654
nop
call fcn.140133f68
nop
call fcn.1401394c7
nop
call fcn.140134a58
nop
call fcn.140138d88
mov rcx, rax
call fcn.140132438
nop
call fcn.140136b5a
mov qword [rbp + 0x928], rax
mov rax, qword [rbp + 0x928]
mov rax, qword [rax]
mov rax, qword [rax + 0x40]
mov qword [rbp + 0x930], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x928]
call qword [rbp + 0x930]
nop
movzx eax, byte [0x1405d2104]
test eax, eax
je 0x140162d49
lea rcx, [rbp + 0x168]
call fcn.140139b57
nop
jmp 0x140162d77
lea rdx, [0x1405d2110]
lea rcx, [rbp + 0x8f8]
call fcn.140137893
mov rcx, rax
call fcn.14013833d
nop
jmp 0x1401629c1
lea rcx, [rbp + 0x168]
call fcn.140139b57
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x1403b57a0]
call fcn.140138428
mov rcx, qword [rbp + 0x948]
xor rcx, rbp
call fcn.1401359e9
lea rsp, [rbp + 0x958]
pop rdi
pop rbp
ret