Function at 0x140030950
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor r12d, r12d
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400309cb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400309cb
lea rdx, [0x14007b0a8]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400309c8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400309a0
jmp 0x1400309cb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140030d08
lea rdx, [0x14007b0a8]
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2140688]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x70], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140030b50
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031daa
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140030aef
xor eax, eax
jmp 0x140030b2c
cmp rbx, 0x1000
jb 0x140030b24
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031db0
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140030be3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140030b2c
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140030c12
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031daa
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140030bb2
xor eax, eax
jmp 0x140030bf2
cmp rbx, 0x1000
jb 0x140030bea
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031db0
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140030be3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140030bf2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140030cc4
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140030cbb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030cbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x140030d08
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140030d00
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030d00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140030d6b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140030d6b
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140030d68
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140030d40
jmp 0x140030d6b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400310a8
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2053218]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140030ef0
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031db6
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140030e8f
xor eax, eax
jmp 0x140030ecc
cmp rbx, 0x1000
jb 0x140030ec4
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031dbc
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140030f83
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140030ecc
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140030fb2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031db6
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140030f52
xor eax, eax
jmp 0x140030f92
cmp rbx, 0x1000
jb 0x140030f8a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031dbc
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140030f83
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140030f92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140031064
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003105b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003105b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x1400310a8
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400310a0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400310a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003110b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003110b
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140031108
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400310e0
jmp 0x14003110b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140031448
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2024890]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140031290
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031dc2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003122f
xor eax, eax
jmp 0x14003126c
cmp rbx, 0x1000
jb 0x140031264
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031dc8
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140031323
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003126c
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140031352
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031dc2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400312f2
xor eax, eax
jmp 0x140031332
cmp rbx, 0x1000
jb 0x14003132a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031dc8
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140031323
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031332
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140031404
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400313fb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400313fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x140031448
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140031440
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140031440
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400314ab
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400314ab
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400314a8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140031480
jmp 0x1400314ab
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400317e8
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2051258]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140031630
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031dce
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400315cf
xor eax, eax
jmp 0x14003160c
cmp rbx, 0x1000
jb 0x140031604
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031dd4
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x1400316c3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003160c
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400316f2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031dce
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140031692
xor eax, eax
jmp 0x1400316d2
cmp rbx, 0x1000
jb 0x1400316ca
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031dd4
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x1400316c3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400316d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x1400317a4
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003179b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003179b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x1400317e8
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400317e0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400317e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003184b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003184b
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140031848
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140031820
jmp 0x14003184b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140031b88
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x206a778]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.14003e0ac
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x1400319d0
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031dda
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003196f
xor eax, eax
jmp 0x1400319ac
cmp rbx, 0x1000
jb 0x1400319a4
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031da4
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140031a63
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400319ac
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140031a92
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140031dda
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140031a32
xor eax, eax
jmp 0x140031a72
cmp rbx, 0x1000
jb 0x140031a6a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031da4
call fcn.14003e0ac
mov rcx, rax
test rax, rax
je 0x140031a63
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031a72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003e0ac
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140031b44
sub r15, rdi
sar r15, 2
lea rdx, [r15*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140031b3b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140031b3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003ddf4
nop
test rsi, rsi
je 0x140031b88
sub r14, rsi
sar r14, 2
lea rdx, [r14*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140031b80
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140031b80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14003ddf4
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140031beb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140031beb
nop dword [rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140031be8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140031bc0
jmp 0x140031beb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140031d90
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.1400307b0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
lea r14, [rbp + 0x240]
lea rdi, [rbp + 0x248]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x248], 2
lea rdx, [rbp + 0x248]
call fcn.14003db90
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov r8, rax
mov rdx, rdi
mov rcx, r14
call fcn.14003db50
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x248], r12
lea rcx, [rbp + 0x248]
call fcn.14003dac0
nop
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
lea rax, [rbp + 0x248]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x250]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.14003d9d0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.14003d8e0
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140030850
mov rdi, rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.14003d8e0
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140030850
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
lea rcx, [rsp + 0x50]
call fcn.14003d880
nop
lea rcx, [rsp + 0x30]
call fcn.14003d880
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3
call fcn.14002a9f0
nop
call fcn.14003db30
int3