Function at 0x1400391c0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003923b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003923b
nop dword [rax]
lea rdx, [0x1400802a0]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140039238
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140039210
jmp 0x14003923b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400395a9
lea rdx, [0x1400802a0]
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2f32010]
mov qword [rbp + 0x240], rax
mov dword [rbp - 0x70], 0x60
mov dword [rbp - 0x6c], 0x28
mov dword [rbp - 0x68], 0x10
lea rbx, [rbp - 0x70]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x78], rax
lea r14, [rax + 0xc]
mov qword [rbp - 0x78], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rbp - 0x80], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x1400393ed
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a502
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003938c
xor eax, eax
jmp 0x1400393c9
cmp rbx, 0x1000
jb 0x1400393c1
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a508
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140039482
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400393c9
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400394b1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a502
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039451
xor eax, eax
jmp 0x140039491
cmp rbx, 0x1000
jb 0x140039489
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a508
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140039482
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039491
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140039565
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003955c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003955c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x1400395a9
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400395a1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400395a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003960b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003960b
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140039608
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400395e0
jmp 0x14003960b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003997d
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ea03c0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x10
lea rbx, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x14
lea r12, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x1400397c1
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a50e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039760
xor eax, eax
jmp 0x14003979d
cmp rbx, 0x1000
jb 0x140039795
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a514
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140039856
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003979d
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140039885
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a50e
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039825
xor eax, eax
jmp 0x140039865
cmp rbx, 0x1000
jb 0x14003985d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a514
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140039856
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039865
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x48], rax
add rbx, rax
mov qword [rsp + 0x58], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x48]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140039939
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140039930
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039930
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x14003997d
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140039975
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039975
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400399db
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400399db
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400399d8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400399b0
jmp 0x1400399db
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140039d4d
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2e18bb0]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x10
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x140039b91
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a51a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039b30
xor eax, eax
jmp 0x140039b6d
cmp rbx, 0x1000
jb 0x140039b65
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a520
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140039c26
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039b6d
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140039c55
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a51a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039bf5
xor eax, eax
jmp 0x140039c35
cmp rbx, 0x1000
jb 0x140039c2d
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a520
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140039c26
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039c35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140039d09
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140039d00
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039d00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x140039d4d
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140039d45
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039d45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140039dab
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140039dab
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140039da8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140039d80
jmp 0x140039dab
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003a11d
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2db1190]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x10
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x78], rax
lea r15, [rax + 0xc]
mov qword [rbp - 0x78], r15
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x60], rax
lea r14, [rax + 0xc]
mov qword [rsp + 0x70], r14
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rdi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x140039f61
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a526
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039f00
xor eax, eax
jmp 0x140039f3d
cmp rbx, 0x1000
jb 0x140039f35
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a52c
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140039ff6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039f3d
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003a025
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a526
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140039fc5
xor eax, eax
jmp 0x14003a005
cmp rbx, 0x1000
jb 0x140039ffd
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a52c
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140039ff6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x14003a0d9
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003a0d0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a0d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x14003a11d
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003a115
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a115
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003a17b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003a17b
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14003a178
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003a150
jmp 0x14003a17b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14003a4e8
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2ef5850]
mov qword [rbp + 0x240], rax
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x38], 0x10
lea rbx, [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], 0
mov ecx, 0xc
call fcn.140042d0c
mov r14, rax
mov qword [rsp + 0x78], rax
lea rdi, [rax + 0xc]
mov qword [rbp - 0x78], rdi
mov r8d, 0xc
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r14 + 0xc]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x48], 0x60
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x50], 0x14
lea r12, [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov ecx, 0xc
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x70], r15
mov r8d, 0xc
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
lea r12, [rsi + 0xc]
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, r14
mov qword [rbp + 0x248], rbx
sar rbx, 2
test rbx, rbx
je 0x14003a331
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a532
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a2d0
xor eax, eax
jmp 0x14003a30d
cmp rbx, 0x1000
jb 0x14003a305
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a4fc
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003a3c6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a30d
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x248]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x248], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rsi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x14003a3f5
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003a532
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003a395
xor eax, eax
jmp 0x14003a3d5
cmp rbx, 0x1000
jb 0x14003a3cd
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003a4fc
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x14003a3c6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a3d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x248]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x14003a4a9
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14003a4a0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a4a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
nop
test r14, r14
je 0x14003a4e8
sub rdi, r14
and rdi, 0xfffffffffffffffc
mov rax, r14
cmp rdi, 0x1000
jb 0x14003a4dd
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a4dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, r14
call fcn.140042a54
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3