Function at 0x140004840
Capabilities:
Enumerate processes
Execute command
Get session user name
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x140078180]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor r14b, r14b
mov dword [rbp + 0x70], 0x101
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
lea rdx, [rbp + 0x78]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rbp + 0x84]
mov r9d, dword [rbp + 0x7c]
sub edx, r9d
mov ecx, dword [rbp + 0x80]
mov r8d, dword [rbp + 0x78]
sub ecx, r8d
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, [0x140065310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400016e0
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r15d, r15d
nop
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140004920
lea rcx, [0x140065310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x12c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140065310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edi, r15d
mov dword [rsp + 0x78], r15d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400049e8
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400049e8
nop word [rax + rax]
lea rdx, str.FiveM_b2699_GTAProcess.exe
lea rcx, [rbp + 0xcc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400049de
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400049b0
jmp 0x1400049e8
mov edi, dword [rbp + 0xa8]
mov dword [rsp + 0x78], edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140006031
mov r12d, r15d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140004a65
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140004a65
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp + 0xcc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140004a5e
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004a30
jmp 0x140004a65
mov r12d, dword [rbp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
jne 0x140005924
mov esi, r15d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140004ae4
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140004ae4
nop
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp + 0xcc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140004ade
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004ab0
jmp 0x140004ae4
mov esi, dword [rbp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x140005471
mov esi, r15d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140004b64
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140004b64
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp + 0xcc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140004b5e
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004b30
jmp 0x140004b64
mov esi, dword [rbp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x140004fec
mov esi, r15d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140004be4
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140004be4
nop dword [rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp + 0xcc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140004bde
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004bb0
jmp 0x140004be4
mov esi, dword [rbp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140004920
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065358]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tProgram_:_Cmd_of_God
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14006539c]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tGame_Build_:_Only_Gamebuild_b2699
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400653b8]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tSethotkey_:
call fcn.140007650
lea rdx, [0x1400015e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rbp - 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
lea rcx, [0x140065310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140001ae0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
nop dword [rax]
nop dword [rax + rax]
movzx ebx, r14b
mov ecx, dword [rbp - 0x68]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140004fbf
test r14b, r14b
sete r14b
mov edx, 0x12c
test bl, bl
jne 0x140004ee3
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, esi
call fcn.140002520
mov rbx, rax
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rcx, [rbp - 0x30]
call fcn.140002970
mov dword [rbp - 0x10], 0x30
mov dword [rbp - 0xc], 0x2b4
lea rax, [rbp - 0x10]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 8]
mov qword [rbp - 0x48], rax
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.140007090
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.140007020
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rdi
call fcn.1400025e0
mov rbx, rax
mov dword [rsp + 0x78], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rsp + 0x78]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x64], 0x41400000
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x64]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
jmp 0x140004fb6
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, esi
call fcn.140002520
mov rbx, rax
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rcx, [rbp - 0x30]
call fcn.140002970
mov dword [rbp - 0x18], 0x30
mov dword [rbp - 0x14], 0x2b4
lea rax, [rbp - 0x18]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x18], rax
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.140007090
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.140007020
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rdi
call fcn.1400025e0
mov rbx, rax
mov dword [rbp - 0x60], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x60]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x5c], recv
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x5c]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
lea rcx, [rbp - 0x30]
call fcn.140006fc0
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140004de0
mov edx, 0x1f4
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065358]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tProgram_:_Cmd_of_God
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14006539c]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tGame_Build_:_Only_Gamebuild_b3095
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400653b8]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tSethotkey_:
call fcn.140007650
lea rdx, [0x1400015e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rbp - 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
lea rcx, [0x140065310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140001ae0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
nop dword [rax + rax]
movzx ebx, r14b
mov ecx, dword [rbp - 0x68]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000544a
test r14b, r14b
sete r14b
mov edx, 0x12c
test bl, bl
jne 0x140005340
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, esi
call fcn.140002520
mov r13, rax
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
xorps xmm0, xmm0
mov dword [rbp - 0x10], 0x68
mov dword [rbp - 0xc], 0x30
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140008200
mov rdi, qword [rbp - 0x50]
mov rax, qword [rbp - 0x10]
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rbp - 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
sub rbx, rdi
mov r15, rbx
sar r15, 2
test r15, r15
je 0x1400052a4
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140008200
mov r8, rbx
mov rdx, rdi
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r15*4]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x80]
lea rdx, [r13 + 0x2ef5850]
mov rcx, r12
call fcn.1400025e0
mov rbx, rax
xor r15d, r15d
mov dword [rbp - 0x5c], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x5c]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x60], 0x39d91a1b
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x60]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14000544a
mov rdx, qword [rbp - 0x40]
sub rdx, rdi
and rdx, 0xfffffffffffffffc
mov rax, rdi
cmp rdx, 0x1000
jb 0x140005338
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005463
mov rcx, rdi
jmp 0x140005445
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, esi
call fcn.140002520
mov rbx, rax
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
xorps xmm0, xmm0
mov dword [rbp - 0x18], 0x68
mov dword [rbp - 0x14], 0x30
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140008200
mov rcx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x18]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140007020
mov r8, rax
lea rdx, [rbx + 0x2ef5850]
mov rcx, rdi
call fcn.1400025e0
mov rbx, rax
mov dword [rbp - 0x64], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x64]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x78], 0x1474607a
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rsp + 0x78]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14000544a
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005445
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000546a
call fcn.140057b6c
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400051d0
jmp 0x140004fd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065358]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tProgram_:_Cmd_of_God
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14006539c]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tGame_Build_:_Only_Gamebuild_b2802
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400653b8]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tSethotkey_:
call fcn.140007650
lea rdx, [0x1400015e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rbp - 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
lea rcx, [0x140065310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140001ae0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movzx ebx, r14b
mov ecx, dword [rbp - 0x68]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140005904
test r14b, r14b
sete r14b
mov edx, 0x12c
test bl, bl
jne 0x1400057c3
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, esi
call fcn.140002520
mov r13, rax
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
xorps xmm0, xmm0
mov dword [rbp - 0x10], 0x68
mov dword [rbp - 0xc], 0x30
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140008200
mov rdi, qword [rbp - 0x50]
mov rax, qword [rbp - 0x10]
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rbp - 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
sub rbx, rdi
mov r15, rbx
sar r15, 2
test r15, r15
je 0x140005724
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140008200
mov r8, rbx
mov rdx, rdi
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r15*4]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x80]
lea rdx, [r13 + 0x2e18bb0]
mov rcx, r12
call fcn.1400025e0
mov rbx, rax
xor r15d, r15d
mov dword [rbp - 0x5c], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x5c]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x60], 0x39d91a1b
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x60]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140005904
mov rdx, qword [rbp - 0x40]
sub rdx, rdi
and rdx, 0xfffffffffffffffc
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400058fc
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400058fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, esi
call fcn.140002520
mov r13, rax
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
xorps xmm0, xmm0
mov dword [rbp - 0x18], 0x68
mov dword [rbp - 0x14], 0x30
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140008200
mov rdi, qword [rbp - 0x50]
mov rax, qword [rbp - 0x18]
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rbp - 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
sub rbx, rdi
mov r15, rbx
sar r15, 2
test r15, r15
je 0x14000586e
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140008200
mov r8, rbx
mov rdx, rdi
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r15*4]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x80]
lea rdx, [r13 + 0x2e18bb0]
mov rcx, r12
call fcn.1400025e0
mov rbx, rax
xor r15d, r15d
mov dword [rbp - 0x64], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x64]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x78], 0x1474607a
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rsp + 0x78]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140005904
mov rdx, qword [rbp - 0x40]
sub rdx, rdi
and rdx, 0xfffffffffffffffc
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400058fc
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000591d
mov rcx, rdi
call fcn.140057b6c
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140005650
jmp 0x140004fd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065358]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tProgram_:_Cmd_of_God
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14006539c]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tGame_Build_:_Only_Gamebuild_b2699
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400653b8]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tSethotkey_:
call fcn.140007650
lea rdx, [0x1400015e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rbp - 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
lea rcx, [0x140065310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140001ae0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movzx ebx, r14b
mov ecx, dword [rbp - 0x68]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140006003
test r14b, r14b
sete r14b
mov edx, 0x12c
test bl, bl
jne 0x140005d9d
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, r12d
call fcn.140002520
mov r13, rax
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
add r13, 0x2053218
mov qword [rsp + 0x48], r13
xorps xmm0, xmm0
mov dword [rbp - 0x10], 0x30
mov dword [rbp - 0xc], 0x2b4
movdqu xmmword [rbp + 0x10], xmm0
xor esi, esi
mov qword [rbp + 0x20], rsi
mov edx, 2
lea rcx, [rbp + 0x10]
call fcn.140008200
mov rdi, qword [rbp + 0x10]
mov rax, qword [rbp - 0x10]
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rbp + 0x18], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
sub rbx, rdi
mov rsi, rbx
sar rsi, 2
test rsi, rsi
je 0x140005be6
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140008200
mov r8, rbx
mov rdx, rdi
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rsi*4]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x80]
mov rdx, r13
mov rcx, r15
call fcn.1400025e0
mov rbx, rax
xor r13d, r13d
mov dword [rbp - 0x5c], r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x5c]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x60], 0x41400000
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x60]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm0, xmm0
mov dword [rbp - 0x18], 0x68
mov dword [rbp - 0x14], 0x30
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140008200
mov rsi, qword [rbp - 0x50]
mov rax, qword [rbp - 0x18]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rbp - 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
sub rbx, rsi
mov r13, rbx
sar r13, 2
test r13, r13
je 0x140005cb8
mov rdx, r13
lea rcx, [rbp - 0x80]
call fcn.140008200
mov r8, rbx
mov rdx, rsi
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r13*4]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x80]
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call fcn.1400025e0
mov rbx, rax
xor r13d, r13d
mov dword [rbp - 0x64], r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x64]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x78], 0x39d91a1b
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rsp + 0x78]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x140005d59
mov rax, qword [rbp - 0x40]
sub rax, rsi
sar rax, 2
lea rdx, [rax*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140005d50
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000601c
mov rcx, rsi
call fcn.140057b6c
nop
test rdi, rdi
je 0x140006003
mov rdx, qword [rbp + 0x20]
sub rdx, rdi
and rdx, 0xfffffffffffffffc
mov rax, rdi
cmp rdx, 0x1000
jb 0x140005ffb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ffb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, r12d
call fcn.140002520
mov r13, rax
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
xorps xmm0, xmm0
mov dword [rbp + 0x68], 0x30
mov dword [rbp + 0x6c], 0x2b4
movdqu xmmword [rbp + 0x10], xmm0
xor esi, esi
mov qword [rbp + 0x20], rsi
mov edx, 2
lea rcx, [rbp + 0x10]
call fcn.140008200
mov rdi, qword [rbp + 0x10]
mov rax, qword [rbp + 0x68]
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rbp + 0x18], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
sub rbx, rdi
mov rsi, rbx
sar rsi, 2
test rsi, rsi
je 0x140005e4b
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140008200
mov r8, rbx
mov rdx, rdi
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rsi*4]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x80]
lea rdx, [r13 + 0x2053218]
mov rcx, r15
call fcn.1400025e0
mov rbx, rax
xor esi, esi
mov dword [rbp - 8], esi
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp - 8]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 4], recv
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp - 4]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [r13 + 0x2ea03c0]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rbp + 0x60], 0x68
mov dword [rbp + 0x64], 0x30
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rsi
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140008200
mov rsi, qword [rbp - 0x50]
mov rax, qword [rbp + 0x60]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rbp - 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 0
sub rbx, rsi
mov r13, rbx
sar r13, 2
test r13, r13
je 0x140005f2f
mov rdx, r13
lea rcx, [rbp - 0x80]
call fcn.140008200
mov r8, rbx
mov rdx, rsi
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r13*4]
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x80]
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call fcn.1400025e0
mov rbx, rax
xor r13d, r13d
mov dword [rbp], r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 4], 0x1474607a
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 4]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x140005fca
mov rax, qword [rbp - 0x40]
sub rax, rsi
sar rax, 2
lea rdx, [rax*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140005fc1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006023
mov rcx, rsi
call fcn.140057b6c
nop
test rdi, rdi
je 0x140006003
mov rdx, qword [rbp + 0x20]
sub rdx, rdi
and rdx, 0xfffffffffffffffc
mov rax, rdi
cmp rdx, 0x1000
jb 0x140005ffb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000602a
mov rcx, rdi
call fcn.140057b6c
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140005b03
jmp 0x140004fd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065358]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tProgram_:_Cmd_Fuckbitch_Weapons
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x14006539c]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tGame_Build_:_Only_Gamebuild_b2699___GTAProcess.exe
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_t__
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400653b8]
call fcn.140007650
lea rdx, [0x140007b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140065354]
call fcn.140007650
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._tSethotkey_:
call fcn.140007650
lea rdx, [0x1400015e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [rbp - 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64____ptr64]
lea rcx, [0x140065310]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0xc8
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140001ae0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movzx ebx, r14b
mov ecx, dword [rbp - 0x68]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140006a05
test r14b, r14b
sete r14b
mov edx, 0x12c
test bl, bl
jne 0x140006622
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.140002520
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
lea r13, [rbx + 0x2140688]
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x64], 0x2b4
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov edx, 2
lea rcx, [rbp - 0x80]
call fcn.140008200
mov r15, qword [rbp - 0x80]
mov rax, qword [rsp + 0x60]
mov qword [r15], rax
lea rbx, [r15 + 8]
mov qword [rbp - 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
sub rbx, r15
mov rdi, rbx
sar rdi, 2
test rdi, rdi
je 0x1400062f7
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140008200
mov r8, rbx
mov rdx, r15
mov rbx, qword [rbp - 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rdi*4]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x30]
mov rdx, r13
mov rcx, r12
call fcn.1400025e0
mov rbx, rax
xor edi, edi
mov dword [rbp + 4], edi
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 4]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp], 0x41400000
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0x30
mov dword [rsp + 0x6c], 0x364
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rdi
mov edx, 2
lea rcx, [rbp + 0x48]
call fcn.140008200
mov rsi, qword [rbp + 0x48]
mov rax, qword [rsp + 0x68]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rbp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
sub rbx, rsi
mov rdi, rbx
sar rdi, 2
test rdi, rdi
je 0x1400063ca
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140008200
mov r8, rbx
mov rdx, rsi
mov rbx, qword [rbp - 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rdi*4]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x30]
mov rdx, r13
mov rcx, r12
call fcn.1400025e0
mov rbx, rax
xor r13d, r13d
mov dword [rbp - 4], r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 4]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 8], recv
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm0, xmm0
mov dword [rbp + 0x10], 0x60
mov dword [rbp + 0x14], 0x38
mov dword [rbp + 0x18], WSAStartup
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov edx, 3
lea rcx, [rbp + 0x30]
call fcn.140008200
mov r8d, recv
lea rdx, [rbp + 0x10]
mov rdi, qword [rbp + 0x30]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rdi + 0xc]
mov qword [rbp + 0x38], rbx
mov dword [rbp - 0x5c], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
sub rbx, rdi
mov r13, rbx
sar r13, 2
test r13, r13
je 0x1400064b5
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.140008200
mov r8, rbx
mov rdx, rdi
mov rbx, qword [rbp - 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r13*4]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x30]
mov rbx, qword [rsp + 0x40]
lea rdx, [rbx + 0x2140688]
mov rcx, r12
call fcn.1400025e0
xor r13d, r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x5c]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rbx + 0x294eeb0]
mov dword [rbp - 0x60], 0x2b8
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140002980
call fcn.140002b40
call fcn.140002d10
call fcn.140002ee0
call fcn.1400030a0
call fcn.140003270
call fcn.140003440
call fcn.1400027a0
call fcn.1400027a0
call fcn.1400027a0
call fcn.140004650
nop
test rdi, rdi
je 0x140006598
mov rax, qword [rbp + 0x40]
sub rax, rdi
sar rax, 2
lea rdx, [rax*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000658f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a1e
mov rcx, rdi
call fcn.140057b6c
nop
test rsi, rsi
je 0x1400065de
mov rax, qword [rbp + 0x58]
sub rax, rsi
sar rax, 2
lea rdx, [rax*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400065d5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a25
mov rcx, rsi
call fcn.140057b6c
nop
test r15, r15
je 0x1400069fe
mov rdx, qword [rbp - 0x70]
sub rdx, r15
and rdx, 0xfffffffffffffffc
mov rax, r15
cmp rdx, 0x1000
jb 0x1400069f6
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.FiveM_b2699_GTAProcess.exe
mov ecx, edi
call fcn.140002520
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
lea r13, [rbx + 0x2140688]
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x30
mov dword [rsp + 0x74], 0x2b4
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
mov edx, 2
lea rcx, [rbp + 0x30]
call fcn.140008200
mov r15, qword [rbp + 0x30]
mov rax, qword [rsp + 0x70]
mov qword [r15], rax
lea rbx, [r15 + 8]
mov qword [rbp + 0x38], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
sub rbx, r15
mov rdi, rbx
sar rdi, 2
test rdi, rdi
je 0x1400066e0
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140008200
mov r8, rbx
mov rdx, r15
mov rbx, qword [rbp - 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rdi*4]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x30]
mov rdx, r13
mov rcx, r12
call fcn.1400025e0
mov rbx, rax
xor edi, edi
mov dword [rbp - 0x64], edi
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp - 0x64]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x74], recv
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x74]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm0, xmm0
mov dword [rsp + 0x48], 0x30
mov dword [rsp + 0x4c], 0x364
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rdi
mov edx, 2
lea rcx, [rbp + 0x48]
call fcn.140008200
mov rsi, qword [rbp + 0x48]
mov rax, qword [rsp + 0x48]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rbp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
sub rbx, rsi
mov rdi, rbx
sar rdi, 2
test rdi, rdi
je 0x1400067b3
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140008200
mov r8, rbx
mov rdx, rsi
mov rbx, qword [rbp - 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rdi*4]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x30]
mov rdx, r13
mov rcx, r12
call fcn.1400025e0
mov rbx, rax
xor r13d, r13d
mov dword [rbp + 0x60], r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x60]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x68]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0x60
mov dword [rbp - 0x4c], 0x38
mov dword [rbp - 0x48], WSAStartup
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov edx, 3
lea rcx, [rbp - 0x80]
call fcn.140008200
mov r8d, recv
lea rdx, [rbp - 0x50]
mov rdi, qword [rbp - 0x80]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rdi + 0xc]
mov qword [rbp - 0x78], rbx
mov dword [rbp - 0x18], r13d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
sub rbx, rdi
mov r13, rbx
sar r13, 2
test r13, r13
je 0x14000689b
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.140008200
mov r8, rbx
mov rdx, rdi
mov rbx, qword [rbp - 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + r13*4]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x30]
mov rbx, qword [rsp + 0x40]
lea rdx, [rbx + 0x2140688]
mov rcx, r12
call fcn.1400025e0
xor r13d, r13d
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x18]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rbx + 0x294eeb0]
mov dword [rbp - 0x10], 0xffffffff
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x10]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140003800
call fcn.140003800
call fcn.140003610
call fcn.140003800
call fcn.140004480
call fcn.1400042b0
call fcn.1400040e0
call fcn.140002ee0
call fcn.140003f10
call fcn.140003d40
call fcn.140003b80
call fcn.1400039d0
nop
test rdi, rdi
je 0x140006983
mov rax, qword [rbp - 0x70]
sub rax, rdi
sar rax, 2
lea rdx, [rax*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000697a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a2c
mov rcx, rdi
call fcn.140057b6c
nop
test rsi, rsi
je 0x1400069c5
mov rax, qword [rbp + 0x58]
sub rax, rsi
sar rax, 2
lea rdx, [rax*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400069bc
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a33
mov rcx, rsi
call fcn.140057b6c
nop
test r15, r15
je 0x1400069fe
mov rdx, qword [rbp + 0x40]
sub rdx, r15
and rdx, 0xfffffffffffffffc
mov rax, r15
cmp rdx, 0x1000
jb 0x1400069f6
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006a3a
mov rcx, r15
call fcn.140057b6c
xor r15d, r15d
mov edi, dword [rsp + 0x78]
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140006210
jmp 0x140004fd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3