Function at 0x140004950
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x14008a080]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140004b76
movabs r12, 0x7ffffffffffffffe
lea r15, str.GTAProcess
mov r13d, 0xa
xorps xmm0, xmm0
lea rax, [rsp + 0x6c]
movups xmmword [rsp + 0x20], xmm0
movabs rdx, 0x7fffffffffffffff
xor esi, esi
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400049e4
cmp rdi, r12
ja 0x140004c14
cmp rdi, 7
ja 0x140004a3a
lea rbx, [rdi + rdi]
mov qword [rsp + 0x30], rdi
mov r8, rbx
mov qword [rsp + 0x38], 7
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x20], si
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x20]
jmp 0x140004ad1
mov rbp, rdi
or rbp, 7
cmp rbp, r12
jbe 0x140004a4f
mov rbp, r12
lea rcx, [rdx + rdx]
jmp 0x140004a6f
cmp rbp, r13
cmovb rbp, r13
lea rcx, [rbp + 1]
cmp rcx, rdx
ja 0x140004c0e
add rcx, rcx
cmp rcx, 0x1000
jb 0x140004a9b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004c0e
mov rcx, rax
call fcn.14006b7d0
test rax, rax
je 0x140004bf8
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004aa8
test rcx, rcx
je 0x140004aa8
call fcn.14006b7d0
mov rsi, rax
lea rbx, [rdi + rdi]
mov qword [rsp + 0x20], rsi
mov r8, rbx
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x6c]
mov qword [rsp + 0x38], rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov word [rbx + rsi], ax
cmp rbp, 7
lea r9, [rsp + 0x20]
cmova r9, rsi
cmp rdi, r13
jb 0x140004b14
lea r10, [rdi - 9]
mov rbx, r9
lea r10, [r9 + r10*2]
nop
mov rax, r10
sub rax, rbx
sar rax, 1
je 0x140004b14
nop dword [rax + rax]
cmp word [rbx], 0x47
je 0x140004bb2
add rbx, 2
sub rax, 1
jne 0x140004b00
mov rbx, 0xffffffffffffffff
cmp rbp, 7
jbe 0x140004b56
lea rdx, [rbp*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140004b4e
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bf8
mov rcx, rsi
call fcn.14006b80c
mov rcx, r14
cmp rbx, 0xffffffffffffffff
jne 0x140004bff
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400049c4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14006b7b0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test rbx, rbx
je 0x140004b14
mov r8, rbx
mov rdx, r13
sub r8, r15
mov rcx, r15
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140004bef
add rcx, 2
sub rdx, 1
jne 0x140004bd0
sub rbx, r9
sar rbx, 1
jmp 0x140004b1b
add rbx, 2
jmp 0x140004af0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
jmp 0x140004b81
call fcn.140001b60
int3
call fcn.140001c00
int3