Function at 0x14003a540
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003a5bb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003a5bb
nop dword [rax]
lea rdx, [0x1400802a0]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003a5b8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003a590
jmp 0x14003a5bb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003a929
lea rdx, [0x1400802a0]
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2f32010]
mov qword [rbp + 0x240], rax
mov dword [rbp - 0x70], 0x60
mov dword [rbp - 0x6c], 0x28
mov dword [rbp - 0x68], 0x10
lea rbx, [rbp - 0x70]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x78], rax
lea r14, [rax + 0xc]
mov qword [rbp - 0x78], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rbp - 0x80], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003a76d
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b882
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a70c
xor eax, eax
jmp 0x14003a749
cmp rbx, 0x1000
jb 0x14003a741
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b888
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003a802
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a749
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003a831
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b882
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a7d1
xor eax, eax
jmp 0x14003a811
cmp rbx, 0x1000
jb 0x14003a809
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b888
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003a802
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a811
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14003a8e5
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003a8dc
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a8dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x14003a929
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003a921
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a921
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003a98b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003a98b
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003a988
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003a960
jmp 0x14003a98b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003acfd
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ea03c0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x10
lea rbx, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x14
lea r12, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003ab41
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b88e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003aae0
xor eax, eax
jmp 0x14003ab1d
cmp rbx, 0x1000
jb 0x14003ab15
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b894
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003abd6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003ab1d
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003ac05
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b88e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003aba5
xor eax, eax
jmp 0x14003abe5
cmp rbx, 0x1000
jb 0x14003abdd
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b894
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003abd6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003abe5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14003acb9
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003acb0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003acb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x14003acfd
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003acf5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003acf5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003ad5b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003ad5b
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003ad58
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003ad30
jmp 0x14003ad5b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003b0cd
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2e18bb0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x10
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003af11
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b89a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003aeb0
xor eax, eax
jmp 0x14003aeed
cmp rbx, 0x1000
jb 0x14003aee5
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b8a0
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003afa6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003aeed
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003afd5
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b89a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003af75
xor eax, eax
jmp 0x14003afb5
cmp rbx, 0x1000
jb 0x14003afad
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b8a0
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003afa6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003afb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14003b089
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003b080
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b080
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x14003b0cd
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003b0c5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b0c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b12b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003b12b
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003b128
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003b100
jmp 0x14003b12b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003b49d
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2db1190]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x10
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003b2e1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b8a6
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003b280
xor eax, eax
jmp 0x14003b2bd
cmp rbx, 0x1000
jb 0x14003b2b5
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b8ac
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003b376
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b2bd
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003b3a5
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b8a6
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003b345
xor eax, eax
jmp 0x14003b385
cmp rbx, 0x1000
jb 0x14003b37d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b8ac
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003b376
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b385
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14003b459
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003b450
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b450
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x14003b49d
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003b495
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b495
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b4fb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003b4fb
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003b4f8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003b4d0
jmp 0x14003b4fb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003b868
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ef5850]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x10
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov r14, rax
mov qword [rsp + 0x78], rax
lea rdi, [rax + 0xc]
mov qword [rbp - 0x78], rdi
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r14 + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rsi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, r14
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003b6b1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b8b2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003b650
xor eax, eax
jmp 0x14003b68d
cmp rbx, 0x1000
jb 0x14003b685
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b87c
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003b746
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b68d
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rsi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003b775
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003b8b2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003b715
xor eax, eax
jmp 0x14003b755
cmp rbx, 0x1000
jb 0x14003b74d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003b87c
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003b746
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b755
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x42960000
mov dword [rbp + 0x238], 0x42960000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x14003b829
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003b820
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b820
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
nop
test r14, r14
je 0x14003b868
sub rdi, r14
and rdi, 0xfffffffffffffffc
mov rax, r14
cmp rdi, 0x1000
jb 0x14003b85d
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b85d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, r14
call fcn.140042a54
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3