Function at 0x140035b10
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140035b8b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140035b8b
nop dword [rax]
lea rdx, [0x14007b0a8]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035b88
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140035b60
jmp 0x140035b8b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140035ef9
lea rdx, [0x14007b0a8]
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2f32010]
mov qword [rbp + 0x240], rax
mov dword [rbp - 0x70], 0x60
mov dword [rbp - 0x6c], 0x28
mov dword [rbp - 0x68], 0x10
lea rbx, [rbp - 0x70]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x78], rax
lea r14, [rax + 0xc]
mov qword [rbp - 0x78], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rbp - 0x80], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x140035d3d
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e52
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140035cdc
xor eax, eax
jmp 0x140035d19
cmp rbx, 0x1000
jb 0x140035d11
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e58
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140035dd2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140035d19
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140035e01
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e52
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140035da1
xor eax, eax
jmp 0x140035de1
cmp rbx, 0x1000
jb 0x140035dd9
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e58
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140035dd2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140035de1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140035eb5
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140035eac
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035eac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x140035ef9
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140035ef1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035ef1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140035f5b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140035f5b
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035f58
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140035f30
jmp 0x140035f5b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400362cd
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ea03c0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x10
lea rbx, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x14
lea r12, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x140036111
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e5e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400360b0
xor eax, eax
jmp 0x1400360ed
cmp rbx, 0x1000
jb 0x1400360e5
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e64
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x1400361a6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400360ed
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400361d5
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e5e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036175
xor eax, eax
jmp 0x1400361b5
cmp rbx, 0x1000
jb 0x1400361ad
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e64
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x1400361a6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400361b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140036289
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140036280
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036280
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x1400362cd
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400362c5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400362c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003632b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003632b
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140036328
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140036300
jmp 0x14003632b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003669d
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2e18bb0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x10
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x1400364e1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e6a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036480
xor eax, eax
jmp 0x1400364bd
cmp rbx, 0x1000
jb 0x1400364b5
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e70
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140036576
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400364bd
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400365a5
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e6a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036545
xor eax, eax
jmp 0x140036585
cmp rbx, 0x1000
jb 0x14003657d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e70
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140036576
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140036585
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140036659
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140036650
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036650
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x14003669d
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140036695
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036695
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400366fb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400366fb
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400366f8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400366d0
jmp 0x1400366fb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140036a6d
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2db1190]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x10
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x1400368b1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e76
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036850
xor eax, eax
jmp 0x14003688d
cmp rbx, 0x1000
jb 0x140036885
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e7c
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140036946
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003688d
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140036975
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e76
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036915
xor eax, eax
jmp 0x140036955
cmp rbx, 0x1000
jb 0x14003694d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e7c
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140036946
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140036955
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140036a29
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140036a20
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036a20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x140036a6d
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140036a65
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036a65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140036acb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140036acb
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140036ac8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140036aa0
jmp 0x140036acb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140036e38
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ef5850]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x10
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.14003e0ac
mov r14, rax
mov qword [rsp + 0x78], rax
lea rdi, [rax + 0xc]
mov qword [rbp - 0x78], rdi
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r14 + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rsi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, r14
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x140036c81
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e82
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036c20
xor eax, eax
jmp 0x140036c5d
cmp rbx, 0x1000
jb 0x140036c55
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e4c
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140036d16
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140036c5d
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rsi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140036d45
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140036e82
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036ce5
xor eax, eax
jmp 0x140036d25
cmp rbx, 0x1000
jb 0x140036d1d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036e4c
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140036d16
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140036d25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x140036df9
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140036df0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036df0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
nop
test r14, r14
je 0x140036e38
sub rdi, r14
and rdi, 0xfffffffffffffffc
mov rax, r14
cmp rdi, 0x1000
jb 0x140036e2d
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036e2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, r14
call fcn.14003ddf4
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3