Function at 0x140005ab0
Capabilities:
Enumerate process modules
Enumerate processes
Execute command
Get session user name
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x640]
sub rsp, 0x740
mov rax, qword [0x1400a20c0]
xor rax, rsp
mov qword [rbp + 0x630], rax
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
btr eax, 0x13
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rbp + 0x3e8], 0x101
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0x420]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp + 0x400]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov r9d, 2
mov r8b, 0xe4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea rdx, [rbp + 0x3f0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rbp + 0x3fc]
mov r9d, dword [rbp + 0x3f4]
sub ecx, r9d
mov eax, dword [rbp + 0x3f8]
mov r8d, dword [rbp + 0x3f0]
sub eax, r8d
mov dword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r13d, r13d
nop dword [rax]
xor edx, edx
lea rcx, [0x140091970]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140005be0
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005c6b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005c6b
nop
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005c68
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005c40
jmp 0x140005c6b
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140007fbb
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005cdb
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005cdb
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005cd8
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005cb0
jmp 0x140005cdb
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140007cb2
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005d4b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005d4b
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005d48
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005d20
jmp 0x140005d4b
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1400079b0
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005dbb
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005dbb
nop dword [rax]
lea rdx, str.FiveM_b2189_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005db8
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005d90
jmp 0x140005dbb
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1400076a1
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005e2b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005e2b
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005e28
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005e00
jmp 0x140005e2b
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000739f
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005e9b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005e9b
nop dword [rax]
lea rdx, str.FiveM_b2372_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005e98
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005e70
jmp 0x140005e9b
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140007093
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005f0b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005f0b
nop dword [rax]
lea rdx, str.FiveM_b2060_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005f08
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005ee0
jmp 0x140005f0b
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140006d91
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005f7b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005f7b
nop dword [rax]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005f78
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005f50
jmp 0x140005f7b
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140006a8f
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005feb
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005feb
nop dword [rax]
lea rdx, str.FiveM_b2545_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140005fe8
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005fc0
jmp 0x140005feb
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000678b
mov edi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000605b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000605b
nop dword [rax]
lea rdx, str.FiveM_b2372_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140006058
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006030
jmp 0x14000605b
mov edi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000651b
mov esi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400060cb
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400060cb
nop dword [rax]
lea rdx, str.FiveM_b3258_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400060c8
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400060a0
jmp 0x1400060cb
mov esi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x140006330
mov esi, r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000613b
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000613b
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140006138
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006110
jmp 0x14000613b
mov esi, dword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140005be0
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
movsx edi, al
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, esi
call fcn.1400058e0
mov rbx, rax
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rcx, [rbp + 0x3d0]
call fcn.1400082c0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x3d0]
call fcn.14000aa30
nop
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x70]
call fcn.14000a950
mov r8, rax
lea rdx, [rbx + 0x2593320]
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140006301
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400062d5
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
movsx edi, al
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.FiveM_b3258_GTAProcess.exe
mov ecx, esi
call fcn.1400058e0
mov rbx, rax
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rcx, [rbp + 0x3d0]
call fcn.1400082c0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x3d0]
call fcn.14000aa30
nop
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x70]
call fcn.14000a950
mov r8, rax
lea rdx, [rbx + 0x25b14b0]
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
nop dword [rax]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x1400064ec
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400064c0
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rsi, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006675
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000666c
nop
lea rdx, str.FiveM_b2372_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140006668
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140006640
jmp 0x14000666c
mov rsi, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rbx, [rsi + 0x252dcd8]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
lea r15, [rsp + 0x48]
lea rsi, [rsp + 0x50]
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x3d8], rax
lea r8, [rax + 8]
mov qword [rbp + 0x3e0], r8
mov r8, rax
mov rdx, rsi
mov rcx, r15
call fcn.140012ec0
mov qword [rbp + 0x3d8], rax
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x50]
call fcn.14000f870
nop
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x70]
call fcn.14000a950
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call fcn.1400059a0
mov rbx, rax
movsx esi, r14b
nop dword [rax]
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rdi
test ax, ax
lea r8, [0x1400a2150]
js 0x14000675c
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140006730
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400068e5
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400068dc
nop
lea rdx, str.FiveM_b2545_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400068d8
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400068b0
jmp 0x1400068dc
mov r14, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r15, [r14 + 0x25667e8]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3e0], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
lea rdi, [rax + 8]
mov qword [rbp + 0x3d8], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r14, rdi
mov rdx, qword [rbp + 0x3d0]
sub r14, rdx
sar r14, 2
test r14, r14
je 0x140006a1d
movabs rax, 0x3fffffffffffffff
cmp r14, rax
jbe 0x14000698d
call fcn.14000cfe0
int3
lea r14, [r14*4]
test r14, r14
jne 0x14000699f
mov rbx, r13
jmp 0x1400069ef
cmp r14, 0x1000
jb 0x1400069d6
lea rcx, [r14 + 0x27]
cmp rcx, r14
ja 0x1400069b7
call fcn.1400018e0
int3
call fcn.14007f9d0
test rax, rax
je 0x1400069cf
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400069e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14007f9d0
mov rbx, rax
mov rdx, qword [rbp + 0x3d0]
mov rdi, qword [rbp + 0x3d8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rcx, [r14 + rbx]
mov qword [rsp + 0x60], rcx
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sar rdi, 2
lea rax, [rbx + rdi*4]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
movsx edi, r12b
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140006a60
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140006a34
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006be7
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140006bde
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140006bda
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140006bb2
jmp 0x140006bde
mov r14, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r15, [r14 + 0x26684d8]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3e0], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
lea rdi, [rax + 8]
mov qword [rbp + 0x3d8], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r14, rdi
mov rdx, qword [rbp + 0x3d0]
sub r14, rdx
sar r14, 2
test r14, r14
je 0x140006d1f
movabs rax, 0x3fffffffffffffff
cmp r14, rax
jbe 0x140006c8f
call fcn.14000cfe0
int3
lea r14, [r14*4]
test r14, r14
jne 0x140006ca1
mov rbx, r13
jmp 0x140006cf1
cmp r14, 0x1000
jb 0x140006cd8
lea rcx, [r14 + 0x27]
cmp rcx, r14
ja 0x140006cb9
call fcn.1400018e0
int3
call fcn.14007f9d0
test rax, rax
je 0x140006cd1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140006ce3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14007f9d0
mov rbx, rax
mov rdx, qword [rbp + 0x3d0]
mov rdi, qword [rbp + 0x3d8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rcx, [r14 + rbx]
mov qword [rsp + 0x60], rcx
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sar rdi, 2
lea rax, [rbx + rdi*4]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
movsx edi, r12b
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140006d62
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140006d36
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006ee9
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140006ee0
lea rdx, str.FiveM_b2060_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140006edc
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140006eb4
jmp 0x140006ee0
mov r14, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r15, [r14 + 0x24c8858]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3e0], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
lea rdi, [rax + 8]
mov qword [rbp + 0x3d8], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r14, rdi
mov rdx, qword [rbp + 0x3d0]
sub r14, rdx
sar r14, 2
test r14, r14
je 0x140007021
movabs rax, 0x3fffffffffffffff
cmp r14, rax
jbe 0x140006f91
call fcn.14000cfe0
int3
lea r14, [r14*4]
test r14, r14
jne 0x140006fa3
mov rbx, r13
jmp 0x140006ff3
cmp r14, 0x1000
jb 0x140006fda
lea rcx, [r14 + 0x27]
cmp rcx, r14
ja 0x140006fbb
call fcn.1400018e0
int3
call fcn.14007f9d0
test rax, rax
je 0x140006fd3
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140006fe5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14007f9d0
mov rbx, rax
mov rdx, qword [rbp + 0x3d0]
mov rdi, qword [rbp + 0x3d8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rcx, [rbx + r14]
mov qword [rsp + 0x60], rcx
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sar rdi, 2
lea rax, [rbx + rdi*4]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
movsx edi, r12b
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140007064
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140007038
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400071f5
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400071ec
nop word [rax + rax]
lea rdx, str.FiveM_b2372_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400071e8
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400071c0
jmp 0x1400071ec
mov r14, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r15, [r14 + 0x252dcd8]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3e0], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
lea rdi, [rax + 8]
mov qword [rbp + 0x3d8], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r14, rdi
mov rdx, qword [rbp + 0x3d0]
sub r14, rdx
sar r14, 2
test r14, r14
je 0x14000732d
movabs rax, 0x3fffffffffffffff
cmp r14, rax
jbe 0x14000729d
call fcn.14000cfe0
int3
lea r14, [r14*4]
test r14, r14
jne 0x1400072af
mov rbx, r13
jmp 0x1400072ff
cmp r14, 0x1000
jb 0x1400072e6
lea rcx, [r14 + 0x27]
cmp rcx, r14
ja 0x1400072c7
call fcn.1400018e0
int3
call fcn.14007f9d0
test rax, rax
je 0x1400072df
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400072f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14007f9d0
mov rbx, rax
mov rdx, qword [rbp + 0x3d0]
mov rdi, qword [rbp + 0x3d8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rcx, [r14 + rbx]
mov qword [rsp + 0x60], rcx
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sar rdi, 2
lea rax, [rbx + rdi*4]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
movsx edi, r12b
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140007370
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140007344
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400074f7
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400074ee
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400074ea
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400074c2
jmp 0x1400074ee
mov r14, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r15, [r14 + 0x2567db0]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3e0], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
lea rdi, [rax + 8]
mov qword [rbp + 0x3d8], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r14, rdi
mov rdx, qword [rbp + 0x3d0]
sub r14, rdx
sar r14, 2
test r14, r14
je 0x14000762f
movabs rax, 0x3fffffffffffffff
cmp r14, rax
jbe 0x14000759f
call fcn.14000cfe0
int3
lea r14, [r14*4]
test r14, r14
jne 0x1400075b1
mov rbx, r13
jmp 0x140007601
cmp r14, 0x1000
jb 0x1400075e8
lea rcx, [r14 + 0x27]
cmp rcx, r14
ja 0x1400075c9
call fcn.1400018e0
int3
call fcn.14007f9d0
test rax, rax
je 0x1400075e1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400075f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14007f9d0
mov rbx, rax
mov rdx, qword [rbp + 0x3d0]
mov rdi, qword [rbp + 0x3d8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rcx, [r14 + rbx]
mov qword [rsp + 0x60], rcx
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sar rdi, 2
lea rax, [rbx + rdi*4]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
movsx edi, r12b
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140007672
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140007646
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140007806
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400077fd
lea rdx, str.FiveM_b2189_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400077f9
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400077d1
jmp 0x1400077fd
mov r14, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r15, [r14 + 0x24e6d90]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3e0], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
lea rdi, [rax + 8]
mov qword [rbp + 0x3d8], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r14, rdi
mov rdx, qword [rbp + 0x3d0]
sub r14, rdx
sar r14, 2
test r14, r14
je 0x14000793e
movabs rax, 0x3fffffffffffffff
cmp r14, rax
jbe 0x1400078ae
call fcn.14000cfe0
int3
lea r14, [r14*4]
test r14, r14
jne 0x1400078c0
mov rbx, r13
jmp 0x140007910
cmp r14, 0x1000
jb 0x1400078f7
lea rcx, [r14 + 0x27]
cmp rcx, r14
ja 0x1400078d8
call fcn.1400018e0
int3
call fcn.14007f9d0
test rax, rax
je 0x1400078f0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140007902
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14007f9d0
mov rbx, rax
mov rdx, qword [rbp + 0x3d0]
mov rdi, qword [rbp + 0x3d8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rcx, [rbx + r14]
mov qword [rsp + 0x60], rcx
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sar rdi, 2
lea rax, [rbx + rdi*4]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
movsx edi, r12b
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140007981
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140007955
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140007b08
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140007aff
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140007afb
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140007ad3
jmp 0x140007aff
mov r14, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r15, [r14 + 0x254d448]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3e0], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
lea rdi, [rax + 8]
mov qword [rbp + 0x3d8], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r14, rdi
mov rdx, qword [rbp + 0x3d0]
sub r14, rdx
sar r14, 2
test r14, r14
je 0x140007c40
movabs rax, 0x3fffffffffffffff
cmp r14, rax
jbe 0x140007bb0
call fcn.14000cfe0
int3
lea r14, [r14*4]
test r14, r14
jne 0x140007bc2
mov rbx, r13
jmp 0x140007c12
cmp r14, 0x1000
jb 0x140007bf9
lea rcx, [r14 + 0x27]
cmp rcx, r14
ja 0x140007bda
call fcn.1400018e0
int3
call fcn.14007f9d0
test rax, rax
je 0x140007bf2
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140007c04
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14007f9d0
mov rbx, rax
mov rdx, qword [rbp + 0x3d0]
mov rdi, qword [rbp + 0x3d8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rcx, [rbx + r14]
mov qword [rsp + 0x60], rcx
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sar rdi, 2
lea rax, [rbx + rdi*4]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
movsx edi, r12b
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140007c83
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140007c57
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140007e0a
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140007e01
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140007dfd
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140007dd5
jmp 0x140007e01
mov r14, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r15, [r14 + 0x257bea0]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3e0], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
lea rdi, [rax + 8]
mov qword [rbp + 0x3d8], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r14, rdi
mov rdx, qword [rbp + 0x3d0]
sub r14, rdx
sar r14, 2
test r14, r14
je 0x140007f42
movabs rax, 0x3fffffffffffffff
cmp r14, rax
jbe 0x140007eb2
call fcn.14000cfe0
int3
lea r14, [r14*4]
test r14, r14
jne 0x140007ec4
mov rbx, r13
jmp 0x140007f14
cmp r14, 0x1000
jb 0x140007efb
lea rcx, [r14 + 0x27]
cmp rcx, r14
ja 0x140007edc
call fcn.1400018e0
int3
call fcn.14007f9d0
test rax, rax
je 0x140007ef4
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140007f06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14007f9d0
mov rbx, rax
mov rdx, qword [rbp + 0x3d0]
mov rdi, qword [rbp + 0x3d8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rcx, [r14 + rbx]
mov qword [rsp + 0x60], rcx
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sar rdi, 2
lea rax, [rbx + rdi*4]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
movsx edi, r12b
nop dword [rax]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140007f8c
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140007f60
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [0x14009196c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x14a
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov ecx, 0x188
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Enter_hotkey_do_you_want__A_Z___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d5c0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d790
movsx ecx, byte [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r14, r13
mov edx, edi
mov ecx, Ordinal_26
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140008115
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000810c
nop
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140008108
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400080e0
jmp 0x14000810c
mov r14, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea r15, [r14 + 0x247f840]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x189
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r13
mov ecx, 8
call fcn.14007f9d0
mov qword [rbp + 0x3d0], rax
lea rcx, [rax + 8]
mov qword [rbp + 0x3e0], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
lea rdi, [rax + 8]
mov qword [rbp + 0x3d8], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov r14, rdi
mov rdx, qword [rbp + 0x3d0]
sub r14, rdx
sar r14, 2
test r14, r14
je 0x14000824d
movabs rax, 0x3fffffffffffffff
cmp r14, rax
jbe 0x1400081bd
call fcn.14000cfe0
int3
lea r14, [r14*4]
test r14, r14
jne 0x1400081cf
mov rbx, r13
jmp 0x14000821f
cmp r14, 0x1000
jb 0x140008206
lea rcx, [r14 + 0x27]
cmp rcx, r14
ja 0x1400081e7
call fcn.1400018e0
int3
call fcn.14007f9d0
test rax, rax
je 0x1400081ff
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140008211
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14007f9d0
mov rbx, rax
mov rdx, qword [rbp + 0x3d0]
mov rdi, qword [rbp + 0x3d8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rcx, [r14 + rbx]
mov qword [rsp + 0x60], rcx
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sar rdi, 2
lea rax, [rbx + rdi*4]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rsi
call fcn.1400059a0
mov rbx, rax
movsx edi, r12b
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], r13
mov r9d, 4
mov rdx, rbx
mov rcx, rsi
test ax, ax
lea r8, [0x1400a2150]
js 0x140008290
lea r8, [0x1400a3570]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008264
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3