Function at 0x140048d40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x3a0
mov rax, qword [0x1401340e8]
xor rax, rsp
mov qword [rsp + 0x390], rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
mov esi, recv
mov qword [rsp + 0xe8], rsi
mov byte [rsp + 0xd0], 0
mov byte [0x1401527a2], 1
cmp byte [0x1401527a0], 0
jne 0x14004921f
mov byte [0x1401527a0], 1
xor edi, edi
xor r14b, r14b
mov dword [rsp + 0xf0], 0x238
xor edx, edx
lea ecx, [rsi - 0xd]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rsp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
movabs r12, 0xb89a4c785c72e34b
movabs r13, 0xf6ded18574c16bb8
cmp eax, 1
jne 0x140048fc3
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140048fc3
movabs rsi, 0xb8ff4c0e5c1be30d
movabs r15, 0xf6ded185749e6bf5
nop word [rax + rax]
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x350], rax
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x358], rax
vmovdqu xmm0, xmmword [rsp + 0x70]
vpxor xmm1, xmm0, xmmword [rsp + 0x350]
vmovdqu xmmword [rsp + 0x70], xmm1
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x11c]
call fcn.1400c1344
test rax, rax
je 0x140048fa1
movabs rax, 0xb8ca4c395c26e30c
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
movabs rax, 0xf6bbd1e674ae6bca
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
movabs rax, 0xb62de146c492e476
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
movabs rcx, 0x556a713bef064f12
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x338], rax
movabs rax, 0xb62de146c4e1e405
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x348], rax
vmovdqu ymm0, ymmword [rsp + 0x50]
vpxor ymm1, ymm0, ymmword [rsp + 0x330]
vmovdqu ymmword [rsp + 0x50], ymm1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x11c]
vzeroupper
call fcn.1400c1344
test rax, rax
je 0x140048fa1
mov edi, dword [rsp + 0xf8]
mov r14b, 1
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140048e40
mov rsi, qword [rsp + 0xe8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15d, r15d
test r14b, r14b
cmovne r15d, edi
call fcn.1400be078
mov rbx, rax
call fcn.1400be05c
cmp rbx, 0x989680
jne 0x140048ff2
imul rax, rax, 0x64
jmp 0x14004900d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x14004902b
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rsp + 0x28], rcx
jmp 0x14004903a
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.140050ae0
test r15d, r15d
jne 0x14004909d
xor r9d, r9d
lea r8, str.OV_Projects
lea rdx, str.You_need_to_have_FiveM_Open_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x140049076
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov byte [0x1401527a2], 0
mov byte [0x1401527a0], 0
dec dword [0x140153c84]
mov byte [0x140152804], 0
mov byte [0x140153c80], 0
jmp 0x14004921f
mov rdi, qword [rsp + 0xd0]
xor r14d, r14d
nop dword [rax + rax]
lea rdx, [0x14014c020]
lea rcx, [rsp + 0x30]
call fcn.1400260c0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140024c90
mov rbx, rax
lea rax, [rsp + 0xd0]
cmp rax, rbx
je 0x140049134
cmp rsi, 0x10
jb 0x140049118
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140049110
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004925e
mov rcx, rdi
call fcn.1400bf46c
vmovups ymm0, ymmword [rbx]
vmovups ymmword [rsp + 0xd0], ymm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], recv
mov byte [rbx], r14b
lea rcx, [rsp + 0x90]
vzeroupper
call fcn.140027510
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x378], rax
vmovdqu xmm0, xmmword [rsp + 0x30]
vpxor xmm1, xmm0, xmmword [rsp + 0x370]
vmovdqu xmmword [rsp + 0x30], xmm1
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r14b
jne 0x1400491a7
lea rcx, [rsp + 0xd0]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xe8]
cmp rsi, 0x10
cmovae rcx, rdi
mov r8, qword [rsp + 0xe0]
cmp r8, rax
jne 0x1400491ef
lea rdx, [rsp + 0x30]
call fcn.1400c2520
test eax, eax
je 0x1400490b0
mov byte [0x140153c90], 1
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xb0]
call fcn.1400260c0
mov edx, r15d
mov rcx, rax
call fcn.140044490
test eax, eax
setne byte [0x1401527d9]
lea rcx, [rsp + 0xd0]
call fcn.140027510
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.1400bf1c0
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.1400d5cf0
nop
int3