Function at 0x140036810
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor r12d, r12d
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003688b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003688b
lea rdx, [0x1400802a0]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140036888
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140036860
jmp 0x14003688b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140036bc8
lea rdx, [0x1400802a0]
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2140688]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x70], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140036a10
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c6a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400369af
xor eax, eax
jmp 0x1400369ec
cmp rbx, 0x1000
jb 0x1400369e4
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c70
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140036aa3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400369ec
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140036ad2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c6a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036a72
xor eax, eax
jmp 0x140036ab2
cmp rbx, 0x1000
jb 0x140036aaa
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c70
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140036aa3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140036ab2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140036b84
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140036b7b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036b7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x140036bc8
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140036bc0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036bc0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140036c2b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140036c2b
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140036c28
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140036c00
jmp 0x140036c2b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140036f68
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2053218]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140036db0
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c76
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036d4f
xor eax, eax
jmp 0x140036d8c
cmp rbx, 0x1000
jb 0x140036d84
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c7c
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140036e43
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140036d8c
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140036e72
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c76
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036e12
xor eax, eax
jmp 0x140036e52
cmp rbx, 0x1000
jb 0x140036e4a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c7c
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140036e43
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140036e52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140036f24
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140036f1b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036f1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x140036f68
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140036f60
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036f60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140036fcb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140036fcb
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140036fc8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140036fa0
jmp 0x140036fcb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140037308
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2024890]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140037150
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c82
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400370ef
xor eax, eax
jmp 0x14003712c
cmp rbx, 0x1000
jb 0x140037124
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c88
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x1400371e3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003712c
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140037212
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c82
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400371b2
xor eax, eax
jmp 0x1400371f2
cmp rbx, 0x1000
jb 0x1400371ea
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c88
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x1400371e3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400371f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x1400372c4
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400372bb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400372bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x140037308
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140037300
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037300
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003736b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003736b
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140037368
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140037340
jmp 0x14003736b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400376a8
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2051258]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x1400374f0
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c8e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003748f
xor eax, eax
jmp 0x1400374cc
cmp rbx, 0x1000
jb 0x1400374c4
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c94
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140037583
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400374cc
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400375b2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c8e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140037552
xor eax, eax
jmp 0x140037592
cmp rbx, 0x1000
jb 0x14003758a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c94
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140037583
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140037592
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140037664
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003765b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003765b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x1400376a8
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400376a0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400376a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003770b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003770b
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140037708
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400376e0
jmp 0x14003770b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140037a48
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x206a778]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140037890
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c9a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003782f
xor eax, eax
jmp 0x14003786c
cmp rbx, 0x1000
jb 0x140037864
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c64
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140037923
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003786c
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140037952
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x140037c9a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400378f2
xor eax, eax
jmp 0x140037932
cmp rbx, 0x1000
jb 0x14003792a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140037c64
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140037923
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140037932
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140037a04
sub r15, rdi
sar r15, 2
lea rdx, [r15*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400379fb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400379fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x140037a48
sub r14, rsi
sar r14, 2
lea rdx, [r14*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140037a40
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037a40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140037aab
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140037aab
nop dword [rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140037aa8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140037a80
jmp 0x140037aab
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140037c50
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
lea r14, [rbp + 0x240]
lea rdi, [rbp + 0x248]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x248], 2
lea rdx, [rbp + 0x248]
call fcn.1400427f0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov r8, rax
mov rdx, rdi
mov rcx, r14
call fcn.1400427b0
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x248], r12
lea rcx, [rbp + 0x248]
call fcn.140042720
nop
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
lea rax, [rbp + 0x248]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x250]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.140042630
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140042540
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140035280
mov rdi, rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.140042540
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x41a00000
mov dword [rbp + 0x238], 0x41a00000
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
lea rcx, [rsp + 0x50]
call fcn.1400424e0
nop
lea rcx, [rsp + 0x30]
call fcn.1400424e0
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3