Function at 0x180001f10
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Enumerate process modules
Enumerate processes
Get file attributes
Read file on windows
Terminate process

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x978]
sub rsp, 0xa78
mov rax, qword [0x18003b038]
xor rax, rsp
mov qword [rbp + 0x960], rax
xor edx, edx
lea rcx, [rbp + 0x120]
mov r8d, 0x104
call fcn.1800140e0
xor edx, edx
lea rcx, [rbp + 0x340]
mov r8d, 0x104
call fcn.1800140e0
xor edx, edx
lea rcx, [rbp + 0x230]
mov r8d, 0x104
call fcn.1800140e0
xor edx, edx
lea rcx, [rbp + 0x450]
mov r8d, 0x104
call fcn.1800140e0
mov rcx, qword [0x18003bbf8]
lea rdx, [rbp + 0x230]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x230]
movsxd rbx, eax
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x340]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x450]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rbx
test ebx, ebx
jle 0x180002008
nop dword [rax]
nop word [rax + rax]
cmp byte [rbp + rcx + 0x230], 0x5c
je 0x18000211d
dec ebx
dec rcx
test rcx, rcx
jg 0x180001ff0
mov qword [rsp + 0xa98], rdi
lea rcx, [rbp + 0x340]
mov qword [rsp + 0xaa0], r13
mov qword [rsp + 0xaa8], r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180002043
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18000209b
lea r9, [rbp + 0x120]
mov edx, 0x100
lea r8, str._s_not_found.
lea rcx, [rbp - 0x10]
call fcn.1800029a0
mov r9d, 0x10
lea r8, [0x18002d4d1]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea rcx, [rbp + 0x560]
mov r8d, 0x400
mov edi, eax
xor r14b, r14b
call fcn.1800140e0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor edx, edx
lea rcx, [rbp - 0xc]
mov r8d, 0x12c
mov rbx, rax
call fcn.1800140e0
mov dword [rbp - 0x10], 0x130
mov r13d, 1
cmp rbx, 0xffffffffffffffff
je 0x180002256
lea rdx, [rbp - 0x10]
mov rcx, rbx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x180002242
cmp dword [rbp - 8], edi
je 0x180002168
lea rdx, [rbp - 0x10]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x180002103
jmp 0x180002242
movsxd rbx, ebx
lea rcx, [rbp + 0x120]
add rcx, rbx
lea rdx, str.PlayGTAV.exe
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0x340]
add rcx, rbx
lea rdx, str._socialclub.dll
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp rbx, 0x104
jae 0x180002411
mov byte [rbp + rbx + 0x450], 0
jmp 0x180002008
mov r8d, dword [rbp + 0x10]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x180002242
mov qword [rsp + 0xa70], r15
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, rax
xor r15d, r15d
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1800021f7
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x1800021f7
mov edx, eax
mov qword [rsp + 0xa90], rsi
lea ecx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1800021ef
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rax
mov rcx, rdi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1800021e6
mov r15, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0xa90]
mov r9d, 0x104
lea r8, [rbp + 0x560]
mov rdx, r15
mov rcx, rdi
call sub.KERNEL32.dll_K32GetModuleFileNameExA
mov r15, qword [rsp + 0xa70]
test eax, eax
je 0x180002239
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
movzx r14d, r14b
cmove r14d, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
jne 0x18000232a
jmp 0x180002283
mov r9d, 0x10
lea r8, [0x18002d4d0]
lea rdx, str.Sorry__something_went_wrong__the_handle_for_retrieving_the_running_processes_list_can_not_be_created_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x68
lea rax, [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x120]
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
lea rax, [rbp + 0x450]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180002319
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, [0x18002d4d2]
lea rdx, str.Couldnt_start_the_game.
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.180005b60
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180006390
lea rdx, [0x180001930]
lea rcx, [0x18003bbe8]
call fcn.180006440
lea rdx, [0x180001c10]
lea rcx, [0x18003bbe0]
call fcn.180006440
lea rdx, [0x180001630]
lea rcx, [0x18003bbf0]
call fcn.180006440
lea r8, [0x18002d4d4]
lea rdx, str.launc.dat
lea rcx, [rsp + 0x58]
call fcn.1800193b0
mov r14, qword [rsp + 0xaa8]
mov rdi, qword [rsp + 0xa98]
test eax, eax
jne 0x1800023d8
mov r9, qword [rsp + 0x58]
lea rcx, [rsp + 0x50]
mov r8, r13
mov rdx, r13
call fcn.180019824
test rax, rax
je 0x1800023ce
movzx eax, byte [rsp + 0x50]
shr al, 1
not al
and al, r13b
mov byte [section..data], al
mov rcx, qword [rsp + 0x58]
call fcn.18001952c
lea rdx, [0x1800017e0]
lea rcx, [0x18003bbd8]
call fcn.180006440
call fcn.180005d90
mov r13, qword [rsp + 0xaa0]
mov rcx, qword [rbp + 0x960]
xor rcx, rsp
call fcn.180012ad0
add rsp, 0xa78
pop rbx
pop rbp
ret
call fcn.180012744
int3