Function at 0x14003e270
Capabilities:
Enumerate process modules
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x968]
sub rsp, 0xa30
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x190]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rbp + 0x140], 0x50
mov dword [rbp + 0x144], 0x40
lea rax, [0x14003cf60]
mov qword [rbp + 0x148], rax
xor r13d, r13d
mov qword [rbp + 0x150], r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x158], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x170], xmm1
lea rax, str.Login_Panel
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], r13
lea rcx, [rbp + 0x140]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov eax, dword [rbp + 0x19c]
cdq
sub eax, edx
sar eax, 1
lea r8d, [rax - 0x90]
mov eax, dword [rbp + 0x198]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x96
mov qword [rsp + 0x58], r13
mov rcx, qword [rbp + 0x158]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 0x121
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, str.dasdasdasdasd
mov rdx, qword [rbp + 0x180]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r12, rax
mov qword [rbp + 0x120], rax
lea r9d, [r13 + 1]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea ecx, [r13 + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rcx, rax
mov qword [0x14009b368], rax
test rax, rax
je 0x140040181
mov qword [0x14009b380], r13
mov qword [0x14009b38c], r13
mov dword [0x14009b394], r13d
mov qword [0x14009b39c], r13
mov dword [0x14009b3a4], r13d
mov qword [0x14009b3b4], r13
mov dword [0x14009b3a8], 1
mov dword [0x14009b398], 1
mov dword [0x14009b388], r13d
mov dword [0x14009b3ac], 1
mov dword [0x14009b3b0], 0x50
mov dword [0x14009b3bc], 0x80000000
mov rax, qword [rax]
lea rdx, [0x14009b370]
mov qword [rsp + 0x30], rdx
lea rdx, [0x14009b380]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
mov r9, r12
xor edx, edx
lea r8d, [r13 + 1]
call qword [rax + 0x80]
test eax, eax
js 0x14004017a
lea edx, [r13 + 0xa]
mov rcx, r12
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r12
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [r13 - 1]
mov rcx, r12
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x14009b110]
test rax, rax
je 0x14003e4ee
inc dword [rax + 0x3b4]
mov ecx, 0x3db8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp + 0x980], rax
lea rcx, [rbp + 0x978]
mov qword [rbp + 0x988], rcx
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x14003e526
xor edx, edx
mov rcx, rax
call fcn.140001860
jmp 0x14003e529
mov rax, r13
cmp qword [0x14009b110], 0
jne 0x14003e53a
mov qword [0x14009b110], rax
mov rcx, rax
call fcn.140008890
mov rbx, qword [0x14009b110]
test rbx, rbx
jne 0x14003e56f
mov r8d, 0xd3d
lea rdx, [0x140043850]
lea rcx, [0x1400438f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x14009b110]
lea rax, [0x14007d8c8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
movss xmm3, dword [0x14007f2cc]
mov r8d, 0x10
lea rdx, [0x140086090]
mov rcx, qword [rbx + 0xa8]
call fcn.140025c20
cmp qword [0x14009b110], 0
jne 0x14003e5c5
mov r8d, 0xd3d
lea rdx, [0x140043850]
lea rcx, [0x1400438f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
or dword [rbx + 8], 1
xor ecx, ecx
call fcn.140021290
lea rcx, [0x14009b360]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14003e783
lea rcx, [0x14009b358]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003e783
mov qword [0x14009b350], r12
mov rax, qword [0x14009b110]
test rax, rax
jne 0x14003e62e
mov r8d, 0xd3d
lea rdx, [0x140043850]
lea rcx, [0x1400438f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x14009b110]
or dword [rax + 0xc], 6
lea rcx, str.imgui_impl_win32
mov qword [rax + 0xd8], rcx
mov qword [rax + 0x120], r12
mov dword [rax + 0x3c], 9
mov dword [rax + 0x40], 0x25
mov dword [rax + 0x44], 0x27
mov dword [rax + 0x48], 0x26
mov dword [rax + 0x4c], 0x28
mov dword [rax + 0x50], 0x21
mov dword [rax + 0x54], 0x22
mov dword [rax + 0x58], 0x24
mov dword [rax + 0x5c], 0x23
mov dword [rax + 0x60], 0x2d
mov dword [rax + 0x64], 0x2e
mov dword [rax + 0x68], 8
mov dword [rax + 0x6c], 0x20
mov dword [rax + 0x70], 0xd
mov dword [rax + 0x74], 0x1b
mov dword [rax + 0x78], 0xd
mov dword [rax + 0x7c], 0x41
mov dword [rax + 0x80], 0x43
mov dword [rax + 0x84], 0x56
mov dword [rax + 0x88], 0x58
mov dword [rax + 0x8c], 0x59
mov dword [rax + 0x90], 0x5a
lea rax, str.xinput1_4.dll
mov qword [rbp - 0x60], rax
lea rax, str.xinput1_3.dll
mov qword [rbp - 0x58], rax
lea rax, str.xinput9_1_0.dll
mov qword [rbp - 0x50], rax
lea rax, str.xinput1_2.dll
mov qword [rbp - 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rbp - 0x40], rax
mov rbx, r13
nop word [rax + rax]
mov rcx, qword [rbp + rbx*8 - 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14003e74e
inc rbx
cmp rbx, 5
jl 0x14003e730
jmp 0x14003e783
mov qword [0x14009b338], rdi
lea rdx, str.XInputGetCapabilities
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14009b340], rax
lea rdx, str.XInputGetState
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14009b348], rax
mov rbx, qword [0x14009b370]
mov rax, qword [0x14009b110]
test rax, rax
jne 0x14003e7b7
mov r8d, 0xd3d
lea rdx, [0x140043850]
lea rcx, [0x1400438f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x14009b110]
lea r8, str.imgui_impl_dx9
mov qword [rax + 0xe0], r8
or dword [rax + 0xc], 8
mov qword [0x14009b320], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [0x14009b110]
test rax, rax
jne 0x14003e806
mov r8d, 0x952
lea rdx, [0x140043850]
lea rcx, [0x1400438f0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x14009b110]
mov dword [rax + 0x1598], 0x40a00000
mov dword [rax + 0x159c], 0x40400000
mov dword [rax + 0x15a0], 0x40a00000
mov qword [rax + 0x156c], 0x40800000
mov dword [rax + 0x1594], r13d
mov qword [rax + 0x1564], r13
mov dword [rax + 0x158c], 0x41200000
mov dword [rax + 0x15a8], r13d
mov dword [rax + 0x15ac], 0x40a00000
call fcn.14003d890
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
lea rbx, [0x14007efd0]
lea rdi, [0x14007f048]
lea rsi, [0x14007f058]
lea r14, [0x14007f05c]
lea r15, [0x14007f060]
xorps xmm8, xmm8
movss xmm7, dword [0x14007f328]
movss xmm10, dword [0x14007f2e4]
movss xmm11, dword [0x14007f244]
movss xmm9, dword [0x14007f278]
nop
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14003e900
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140040004
cmp byte [0x14009afa0], 0
je 0x140040171
cmp qword [0x14009b310], 0
jne 0x14003e91c
call fcn.14003c020
call fcn.14003c710
call fcn.1400075a0
mov rax, qword [0x14009b110]
mov dword [rax + 0x1ba8], 0x43960000
mov dword [rax + 0x1bac], 0x43908000
mov dword [rax + 0x1b90], 2
or dword [rax + 0x1b88], 3
movaps xmm0, xmm8
unpcklps xmm0, xmm8
movsd qword [rax + 0x1b98], xmm0
movaps xmm1, xmm8
unpcklps xmm1, xmm8
movsd qword [rax + 0x1ba0], xmm1
mov dword [rax + 0x1b8c], 2
movabs rax, 0xdf197095ae779485
mov qword [rbp + 0x10], rax
movabs rax, 0xf3e9d084308f85ae
mov qword [rbp + 0x18], rax
movabs rax, 0xc567b80bc892f1e7
mov qword [rbp + 0x20], rax
movabs rax, 0xb3f4e42a03a9be60
mov qword [rbp + 0x28], rax
movabs rax, 0xbf7ddfa104c66119
mov qword [rbp + 0x30], rax
movabs rax, 0xe9bb6240b6923ee2
mov qword [rbp + 0x38], rax
movabs rcx, 0x66f9e92d4edc2c65
mov qword [rbp - 0x60], rcx
movabs rcx, 0x1369696482376527
mov qword [rbp - 0x58], rcx
movabs rcx, 0x7cdf58927072505f
mov qword [rbp - 0x50], rcx
movabs rcx, 0xb144192e3020680
mov qword [rbp - 0x48], rcx
movabs rcx, 0xbf7ddfa1857e81a8
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
movdqu xmm1, xmmword [rbp - 0x60]
movups xmm2, xmmword [rbp - 0x50]
movups xmm3, xmmword [rbp - 0x40]
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x40], xmm0
xorps xmm2, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x50], xmm2
xorps xmm3, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x60], xmm3
mov r8d, 0x13e
lea rdx, [0x14009afa0]
lea rcx, [rbp + 0x40]
call fcn.14000d3a0
mov rcx, qword [0x14009b110]
mov rax, qword [rcx + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1ae0]
cmp byte [rax + 0x93], 0
jne 0x14003eaa2
mov qword [rbp + 0xe0], 0
movaps xmm1, xmm7
lea rcx, [rbp + 0xe0]
call fcn.140010f50
mov rcx, qword [0x14009b110]
mov rax, qword [rcx + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1ae0]
cmp byte [rax + 0x93], 0
jne 0x14003eada
mov qword [rbp + 0xf0], 0
movaps xmm1, xmm7
lea rcx, [rbp + 0xf0]
call fcn.140010f50
call fcn.140037770
test al, al
je 0x14003feb9
mov rcx, qword [0x14009b110]
mov rax, qword [rcx + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1ae0]
cmp byte [rax + 0x93], 0
jne 0x14003eb27
mov qword [rbp + 0x70], 0
movaps xmm1, xmm7
lea rcx, [rbp + 0x70]
call fcn.140010f50
mov rcx, qword [0x14009b110]
mov rax, qword [rcx + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1ae0]
cmp byte [rax + 0x93], 0
jne 0x14003eb59
mov qword [rbp + 0x78], 0
movaps xmm1, xmm7
lea rcx, [rbp + 0x78]
call fcn.140010f50
lea rcx, [0x14007ef98]
call fcn.1400393d0
test al, al
je 0x14003f9b0
mov qword [rbp + 0x200], rbx
lea rax, str.0.30
mov qword [rbp + 0x208], rax
lea rax, str.0.35
mov qword [rbp + 0x210], rax
lea rax, [0x14007efec]
mov qword [rbp + 0x218], rax
lea rax, str.0.45
mov qword [rbp + 0x220], rax
lea rax, [0x14007eff8]
mov qword [rbp + 0x228], rax
lea rax, [0x14007effc]
mov qword [rbp + 0x230], rax
lea rax, [0x14007ef70]
mov qword [rbp + 0x238], rax
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x200]
lea rdx, [0x14009b3d0]
lea rcx, [0x14007f000]
call fcn.1400309d0
mov rcx, qword [0x14009b110]
mov rax, qword [rcx + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1ae0]
cmp byte [rax + 0x93], 0
jne 0x14003ec3e
mov qword [rbp + 0x80], 0
movaps xmm1, xmm7
lea rcx, [rbp + 0x80]
call fcn.140010f50
mov rcx, qword [0x14009b110]
mov rax, qword [rcx + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1ae0]
cmp byte [rax + 0x93], 0
jne 0x14003ec76
mov qword [rbp + 0x88], 0
movaps xmm1, xmm7
lea rcx, [rbp + 0x88]
call fcn.140010f50
mov dword [rbp - 0x30], 0x42c80000
mov dword [rbp - 0x78], 0x41a00000
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x68]
call fcn.140030cf0
mov rcx, qword [0x14009b110]
mov rax, qword [rcx + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1ae0]
cmp byte [rax + 0x93], 0
jne 0x14003ecd9
mov qword [rbp + 0x90], 0
movaps xmm1, xmm7
lea rcx, [rbp + 0x90]
call fcn.140010f50
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r15
lea rax, [0x14007f064]
mov qword [rbp - 0x40], rax
lea rax, [0x14007f068]
mov qword [rbp - 0x38], rax
mov dword [rsp + 0x20], 6
lea r9, [rbp - 0x60]
lea rdx, [0x14009b3d4]
lea rcx, [0x14007f070]
call fcn.1400309d0
mov rcx, qword [0x14009b110]
mov rax, qword [rcx + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1ae0]
cmp byte [rax + 0x93], 0
jne 0x14003ed5d
mov qword [rbp + 0x98], 0
movaps xmm1, xmm7
lea rcx, [rbp + 0x98]
call fcn.140010f50
mov qword [rbp + 0x1a0], rbx
lea rax, [0x14007f098]
mov qword [rbp + 0x1a8], rax
mov dword [rsp + 0x20], 2
lea r9, [rbp + 0x1a0]
lea rdx, [0x14009b3c8]
lea rcx, [0x14007f0a8]
call fcn.1400309d0
mov rcx, qword [0x14009b110]
mov rax, qword [rcx + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [rcx + 0x1ae0]
cmp byte [rax + 0x93], 0
jne 0x14003edd3
mov qword [rbp + 0xa0], 0
movaps xmm1, xmm7
lea rcx, [rbp + 0xa0]
call fcn.140010f50
lea rdx, [0x14009b3cc]
lea rcx, [0x14007f0c8]
call fcn.14002f370
test al, al
je 0x14003ee0c
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
cmp byte [0x14009b3cc], 0
je 0x14003ee0c
mov edx, 0x11
mov rcx, r12
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
lea rdx, [0x14009b10c]
lea rcx, [0x14007f0e8]
call fcn.14002f370
test al, al
je 0x14003f04a
call fcn.14003df80
mov ebx, eax
mov ecx, eax
call fcn.14003ddf0
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rbp + 0xa8], 0x30
mov dword [rbp + 0xac], 0x2b4
mov ecx, 8
call fcn.140040d3c
mov r15, rax
mov qword [rbp + 0x40], rax
lea rdi, [rax + 8]
mov qword [rbp + 0x50], rdi
mov rcx, qword [rbp + 0xa8]
mov qword [rax], rcx
mov qword [rbp + 0x48], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov ecx, 8
call fcn.140040d3c
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x70], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.14003de80
mov rbx, rax
mov dword [rbp - 0x28], 0
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x28]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x24], 0xe
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x24]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14009b10c], 0
je 0x14003f038
call fcn.14003df80
mov ebx, eax
mov ecx, eax
call fcn.14003ddf0
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rbp + 0xb0], 0x30
mov dword [rbp + 0xb4], 0x2b4
mov ecx, 8
call fcn.140040d3c
mov r12, rax
mov qword [rbp + 0x10], rax
lea rdi, [rax + 8]
mov qword [rbp + 0x20], rdi
mov rcx, qword [rbp + 0xb0]
mov qword [rax], rcx
mov qword [rbp + 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov ecx, 8
call fcn.140040d3c
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x70], rcx
sub rdi, r12
mov r8, rdi
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.14003de80
mov rbx, rax
mov dword [rbp - 0x20], 0
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x20]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x1c], 6
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x1c]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r12, r12
je 0x14003f038
mov edx, 8
mov rcx, r12
call fcn.140040a84
nop
test r15, r15
je 0x14003f04a
mov edx, 8
mov rcx, r15
call fcn.140040a84
mov rax, qword [0x14009b110]
mov rcx, qword [rax + 0x1ae0]
movss xmm6, dword [rcx + 0x18]
subss xmm6, xmm10
mulss xmm6, xmm11
mov dword [rbp + 0xb8], 0
mov dword [rbp + 0xbc], 0x40600000
lea rcx, [rbp + 0xb8]
call fcn.14002f9f0
mov r11, qword [0x14009b110]
mov rax, qword [r11 + 0x1ae0]
mov byte [rax + 0x90], 1
mov rax, qword [r11 + 0x1ae0]
movss xmm1, dword [rax + 0x10]
subss xmm1, dword [rax + 0x5c]
addss xmm1, xmm6
movss dword [rax + 0xd8], xmm1
movss xmm0, dword [rax + 0xf0]
maxss xmm0, xmm1
movss dword [rax + 0xf0], xmm0
mov qword [rbp + 0xc0], 0x42c80000
lea rdx, [rbp + 0xc0]
call fcn.14002deb0
movzx r12d, al
test al, al
je 0x14003f274
call fcn.14003db60
mov ebx, eax
mov ecx, eax
call fcn.14003ddf0
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rbp + 0xf8], 0x60
mov qword [rbp + 0xfc], 0x38
mov dword [rbp + 0x104], 0x50
mov ecx, 0x10
call fcn.140040d3c
mov r15, rax
mov qword [rbp + 0x10], rax
lea rdi, [rax + 0x10]
mov qword [rbp + 0x20], rdi
mov r8d, 0x10
lea rdx, [rbp + 0xf8]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov ecx, 0x10
call fcn.140040d3c
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 0x70], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x10]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.14003de80
movsxd rcx, dword [0x14009b3d0]
cmp ecx, 7
ja case.default.0x14003f1d5
lea r8, [0x140000000]
mov edx, dword [r8 + rcx*4 + 0x40208]
add rdx, r8
jmp rdx
mov dword [rbp + 0x978], 0x3deb851f
jmp case.default.0x14003f1d5
mov dword [rbp + 0x978], 0x3e99999a
jmp case.default.0x14003f1d5
mov dword [rbp + 0x978], 0x3eb33333
jmp case.default.0x14003f1d5
mov dword [rbp + 0x978], 0x3ecccccd
jmp case.default.0x14003f1d5
mov dword [rbp + 0x978], 0x3ee66666
jmp case.default.0x14003f1d5
mov dword [rbp + 0x978], 0x3f000000
jmp case.default.0x14003f1d5
mov dword [rbp + 0x978], 0x3f4ccccd
jmp case.default.0x14003f1d5
mov dword [rbp + 0x978], 0x3f800000
test r14, r14
je 0x14003f258
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x978]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r15, r15
je 0x14003f274
mov edx, 0x10
mov rcx, r15
call fcn.140040a84
movss xmm0, dword [rbp - 0x68]
ucomiss xmm0, xmm8
jp 0x14003f285
je 0x14003f372
call fcn.14003db60
mov ebx, eax
mov ecx, eax
call fcn.14003ddf0
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov dword [rbp + 0xc8], 0x40
mov dword [rbp + 0xcc], 0x28c
mov ecx, 8
call fcn.140040d3c
mov r14, rax
mov qword [rbp + 0x10], rax
lea rdi, [rax + 8]
mov qword [rbp + 0x20], rdi
mov rcx, qword [rbp + 0xc8]
mov qword [rax], rcx
mov qword [rbp + 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov ecx, 8
call fcn.140040d3c
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x70], rcx
sub rdi, r14
mov r8, rdi
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [rsi + 0x212b208]
mov rcx, r15
call fcn.14003de80
test r15, r15
je 0x14003f356
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x68]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x14003f372
mov edx, 8
mov rcx, r14
call fcn.140040a84
test r12b, r12b
je 0x14003f9a4
call fcn.14003db60
mov ebx, eax
mov ecx, eax
call fcn.14003ddf0
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rbp + 0xd0], 0x40
mov dword [rbp + 0xd4], 0x1cc
mov ecx, 8
call fcn.140040d3c
mov r15, rax
mov qword [rbp + 0x10], rax
lea rdi, [rax + 8]
mov qword [rbp + 0x20], rdi
mov rcx, qword [rbp + 0xd0]
mov qword [rax], rcx
mov qword [rbp + 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov ecx, 8
call fcn.140040d3c
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x70], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 8]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [rsi + 0x212b208]
mov rcx, r14
call fcn.14003de80
movsxd rcx, dword [0x14009b3d4]
cmp ecx, 5
ja case.default.0x14003f44a
lea r8, [0x140000000]
mov edx, dword [r8 + rcx*4 + 0x40228]
add rdx, r8
jmp rdx
mov dword [rbp + 0x980], 0x41200000
jmp case.default.0x14003f44a
mov dword [rbp + 0x980], 0x41700000
jmp case.default.0x14003f44a
mov dword [rbp + 0x980], 0x41a00000
jmp case.default.0x14003f44a
mov dword [rbp + 0x980], 0x41c80000
jmp case.default.0x14003f44a
mov dword [rbp + 0x980], 0x42480000
jmp case.default.0x14003f44a
mov dword [rbp + 0x980], 0x42c80000
test r14, r14
je 0x14003f4b5
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x980]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r15, r15
je 0x14003f4d1
mov edx, 8
mov rcx, r15
call fcn.140040a84
lea rdx, str.FiveM.exe
lea rcx, [rbp + 0x1b0]
call fcn.1400403f0
mov dword [rbp + 0x250], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov r15, qword [rbp + 0x1c8]
mov rsi, qword [rbp + 0x1b0]
cmp rax, 0xffffffffffffffff
je 0x14003f650
lea rdx, [rbp + 0x250]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rax, [rbp + 0x27c]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14003f532
mov rbx, qword [rbp + 0x1c0]
lea r9, [rbp + 0x1b0]
cmp r15, 7
seta r14b
cmova r9, rsi
mov r8, rbx
cmp rdx, rbx
cmovb r8, rdx
lea rcx, [rbp + 0x27c]
test r8, r8
je 0x14003f58a
lea rax, [rbp + 0x27c]
sub r9, rax
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14003f5a5
add rcx, 2
sub r8, 1
jne 0x14003f576
cmp rbx, rdx
jb 0x14003f5a5
ja 0x14003f5a5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x258]
jmp 0x14003f653
lea rdx, [rbp + 0x250]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003f647
nop dword [rax]
lea rax, [rbp + 0x27c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14003f5d0
lea r9, [rbp + 0x1b0]
test r14b, r14b
cmovne r9, rsi
mov rdx, rbx
cmp r8, rbx
cmovb rdx, r8
lea rcx, [rbp + 0x27c]
test rdx, rdx
je 0x14003f624
lea rax, [rbp + 0x27c]
sub r9, rax
nop dword [rax]
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14003f62f
add rcx, 2
sub rdx, 1
jne 0x14003f610
cmp rbx, r8
jb 0x14003f62f
jbe 0x14003f591
lea rdx, [rbp + 0x250]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003f5c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r13d
cmp r15, 7
jbe 0x14003f68e
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003f686
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040120
mov rcx, rsi
call fcn.140040a84
test ebx, ebx
je 0x14004014c
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14004014c
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp - 0x70]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rbp - 0x70]
test r8d, r8d
je 0x140040127
mov qword [0x14009b138], 0xffffffffffffffff
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009b138], rax
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 0x494]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x490], 0x438
mov edx, dword [rbp - 0x70]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x490]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14003f760
lea rdx, [rbp + 0x4c0]
lea rcx, str.gta_game_five.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14003f79b
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x4c0]
lea rcx, str.gta_game_five.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14003f79b
lea rdx, [rbp + 0x490]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14003f760
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r13
jmp 0x14003f7a2
mov rdx, qword [rbp + 0x4b8]
add rdx, 0x31a50
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp - 0x80]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x18]
mov rdx, qword [rbp - 0x80]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x18]
movss dword [rbp + 0x988], xmm0
mov rdx, qword [rbp - 0x80]
add rdx, 0x98
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x14]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x14]
movss dword [rsp + 0x78], xmm0
mov rdx, qword [rbp - 0x80]
add rdx, 4
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x10]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x10]
movss dword [rsp + 0x7c], xmm0
mov ecx, dword [0x14009b3c8]
test ecx, ecx
je 0x14003f909
cmp ecx, 1
jne 0x14003f9a4
lea ebx, [rcx + 4]
nop dword [rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x988]
mov rdx, qword [rbp - 0x80]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x988], 0x235
mov rdx, qword [rbp - 0x80]
add rdx, 0x98
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rsp + 0x78]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x78], 0xc4fa0000
mov rdx, qword [rbp - 0x80]
add rdx, 4
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rsp + 0x7c]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x7c], 0x3f800000
sub rbx, 1
jne 0x14003f870
jmp 0x14003f9a4
mov ebx, 5
nop
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x988]
mov rdx, qword [rbp - 0x80]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x988], 0x235
mov rdx, qword [rbp - 0x80]
add rdx, 0x98
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rsp + 0x78]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x78], 0x3f800000
mov rdx, qword [rbp - 0x80]
add rdx, 4
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rsp + 0x7c]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x7c], 0x3d4ccccd
sub rbx, 1
jne 0x14003f910
call fcn.1400394e0
mov r12, qword [rbp + 0x120]
lea rcx, str.Misc
call fcn.1400393d0
test al, al
je 0x14003feb9
lea rdx, [0x14009b109]
lea rcx, [0x14007f1d0]
call fcn.14002f370
test al, al
je 0x14003fc3a
call fcn.14003df80
mov ebx, eax
mov ecx, eax
call fcn.14003ddf0
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rsp + 0x60], 0xbf8
mov dword [rsp + 0x64], 0x80
mov qword [rsp + 0x68], 8
mov dword [rsp + 0x70], 0x10
mov dword [rsp + 0x74], 0x160
mov ecx, 0x18
call fcn.140040d3c
mov r15, rax
mov qword [rbp + 0x10], rax
lea rdi, [rax + 0x18]
mov qword [rbp + 0x20], rdi
mov r8d, 0x18
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov ecx, 0x18
call fcn.140040d3c
mov rbx, rax
mov qword [rbp + 0x40], rax
lea rcx, [rax + 0x18]
mov qword [rbp + 0x50], rcx
sub rdi, r15
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x18]
mov qword [rbp + 0x48], rax
lea r8, [rbp + 0x40]
lea rdx, [rsi + 0x27eaa10]
mov rcx, r14
call fcn.14003de80
mov rbx, rax
mov dword [rbp - 0xc], 0
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0xc]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 8], 0x2c9337c1
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14009b109], 0
je 0x14003fc28
call fcn.14003df80
mov ebx, eax
mov ecx, eax
call fcn.14003ddf0
mov rsi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov dword [rbp + 0x40], 0xbf8
mov dword [rbp + 0x44], 0x80
mov qword [rbp + 0x48], 8
mov dword [rbp + 0x50], 0x10
mov dword [rbp + 0x54], 0x160
mov ecx, 0x18
call fcn.140040d3c
mov r13, rax
mov qword [rbp - 0x60], rax
lea rdi, [rax + 0x18]
mov qword [rbp - 0x50], rdi
mov r8d, 0x18
lea rdx, [rbp + 0x40]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x58], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0x18
call fcn.140040d3c
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0x70], rcx
sub rdi, r13
mov r8, rdi
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x18]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x60]
lea rdx, [rsi + 0x27eaa10]
mov rcx, r14
call fcn.14003de80
mov rbx, rax
mov dword [rbp - 4], 0
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp - 4]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp], 0x2fa56f8c
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test r13, r13
je 0x14003fc25
lea edx, [rdi + 0x18]
mov rcx, r13
call fcn.140040a84
xor r13d, r13d
test r15, r15
je 0x14003fc3a
mov edx, 0x18
mov rcx, r15
call fcn.140040a84
lea rdx, [0x14009b10b]
lea rcx, [0x14007f1e8]
call fcn.14002f370
test al, al
je 0x14003feb4
mov edx, 0x32
lea ecx, [rdx + 0x32]
call qword [sym.imp.KERNEL32.dll_Beep]
cmp byte [0x14009b10b], 0
je 0x14003feb4
lea rdx, [rbp - 0x6c]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp - 0x6c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009b138], 0xffffffffffffffff
mov r8d, dword [rbp - 0x6c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009b138], rax
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 0x494]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x490], 0x438
mov edx, dword [rbp - 0x6c]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x490]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14003fd10
lea rdx, [rbp + 0x4c0]
lea rcx, str.FiveM_GTAProcess.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14003fd4b
nop dword [rax]
lea rdx, [rbp + 0x4c0]
lea rcx, str.FiveM_GTAProcess.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14003fd4b
lea rdx, [rbp + 0x490]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14003fd10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r13
jmp 0x14003fd52
mov rdx, qword [rbp + 0x4b8]
add rdx, 0x247f840
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xd8]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xd8]
add rdx, 8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x128]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x128]
add rdx, 0xf8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x130]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x130]
add rdx, 0x48
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x110]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xd8]
add rdx, 8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x108]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x108]
add rdx, 0x48
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xe8]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x110]
add rdx, 0x114
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x11c]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xe8]
add rdx, 0x12c
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x118]
mov rcx, qword [0x14009b138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, 0x64
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.1400394e0
call fcn.140037b90
call fcn.14000fa20
call fcn.140009880
mov rcx, qword [0x14009b370]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r13d
movss dword [rsp + 0x28], xmm9
mov dword [rsp + 0x20], r13d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x14009b370]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14003ff67
call fcn.140009d10
mov rbx, qword [0x14009b110]
cmp dword [rbx + 0x1c90], 0
jg 0x14003ff37
mov r8d, 0x675
lea rdx, [0x1400436c0]
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x1c98]
mov rcx, qword [rax]
add rcx, 0x40
mov rax, r13
cmp byte [rcx], 0
cmovne rax, rcx
mov rcx, rax
call fcn.14003ba40
mov rcx, qword [0x14009b370]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14009b370]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14003ffe1
mov rcx, qword [0x14009b370]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14003ffe1
call fcn.14003c1b0
mov rcx, qword [0x14009b370]
mov rax, qword [rcx]
lea rdx, [0x14009b380]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x14003ffdc
mov r8d, 0x2d
lea rdx, str.D:ALL_SRC_
lea rcx, [0x1400438ec]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.14003c020
lea rbx, [0x14007efd0]
lea rdi, [0x14007f048]
lea rsi, [0x14007f058]
lea r14, [0x14007f05c]
lea r15, [0x14007f060]
cmp dword [rbp + 0x1d8], 0x12
jne 0x14003e8c0
call fcn.14003c1b0
mov rcx, qword [0x14009b320]
test rcx, rcx
je 0x14004002f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14009b320], r13
mov rcx, qword [0x14009b338]
test rcx, rcx
je 0x140040041
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14009b338], r13
mov qword [0x14009b340], r13
mov qword [0x14009b348], r13
mov qword [0x14009b350], r13
mov qword [0x14009b358], r13
mov qword [0x14009b360], r13
mov dword [0x14009af40], 9
mov byte [0x14009b330], 0
mov byte [0x14009ad85], 1
mov rbx, qword [0x14009b110]
mov rcx, rbx
call fcn.140008ba0
cmp qword [0x14009b110], rbx
jne 0x1400400a2
mov qword [0x14009b110], r13
test rbx, rbx
je 0x1400400ca
mov rcx, rbx
call fcn.140019600
mov rax, qword [0x14009b110]
test rax, rax
je 0x1400400c1
dec dword [rax + 0x3b4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14009b370]
test rcx, rcx
je 0x1400400e3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14009b370], r13
mov rcx, qword [0x14009b368]
test rcx, rcx
je 0x1400400fc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14009b368], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor eax, eax
jmp 0x1400401cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r9d, 0x10
lea r8, str.An_error_occurred
lea rdx, str._Please_open_FiveM
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0x10
lea r8, str.An_error_occurred
lea rdx, str._Please_open_FiveM
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x14009b368]
mov rdx, qword [0x14009b370]
test rdx, rdx
je 0x1400401a4
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14009b370], r13
mov rcx, qword [0x14009b368]
test rcx, rcx
je 0x1400401b6
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [0x14009b368], r13
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
lea r11, [rsp + 0xa30]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret