Function at 0x140035380
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
xor r12d, r12d
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400353fb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400353fb
lea rdx, [0x1400802a0]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400353f8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400353d0
jmp 0x1400353fb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140035738
lea rdx, [0x1400802a0]
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2140688]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x70], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140035580
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x1400367da
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003551f
xor eax, eax
jmp 0x14003555c
cmp rbx, 0x1000
jb 0x140035554
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400367e0
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140035613
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003555c
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140035642
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x1400367da
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400355e2
xor eax, eax
jmp 0x140035622
cmp rbx, 0x1000
jb 0x14003561a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400367e0
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140035613
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140035622
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x1400356f4
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400356eb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400356eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x140035738
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140035730
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035730
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003579b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003579b
nop dword [rax]
lea rdx, str.FiveM_b2944_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035798
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140035770
jmp 0x14003579b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140035ad8
lea rdx, str.FiveM_b2944_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2053218]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140035920
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x1400367e6
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400358bf
xor eax, eax
jmp 0x1400358fc
cmp rbx, 0x1000
jb 0x1400358f4
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400367ec
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x1400359b3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400358fc
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400359e2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x1400367e6
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140035982
xor eax, eax
jmp 0x1400359c2
cmp rbx, 0x1000
jb 0x1400359ba
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400367ec
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x1400359b3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400359c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140035a94
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140035a8b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035a8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x140035ad8
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140035ad0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035ad0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140035b3b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140035b3b
nop dword [rax]
lea rdx, str.FiveM_b2802_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035b38
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140035b10
jmp 0x140035b3b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140035e78
lea rdx, str.FiveM_b2802_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2024890]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140035cc0
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x1400367f2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140035c5f
xor eax, eax
jmp 0x140035c9c
cmp rbx, 0x1000
jb 0x140035c94
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400367f8
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140035d53
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140035c9c
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140035d82
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x1400367f2
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140035d22
xor eax, eax
jmp 0x140035d62
cmp rbx, 0x1000
jb 0x140035d5a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400367f8
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140035d53
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140035d62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140035e34
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140035e2b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035e2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x140035e78
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140035e70
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035e70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140035edb
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140035edb
nop dword [rax]
lea rdx, str.FiveM_b2612_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035ed8
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140035eb0
jmp 0x140035edb
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140036218
lea rdx, str.FiveM_b2612_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x2051258]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r15, [rax + 8]
mov qword [rsp + 0x60], r15
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r14, [rax + 8]
mov qword [rsp + 0x78], r14
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140036060
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x1400367fe
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140035fff
xor eax, eax
jmp 0x14003603c
cmp rbx, 0x1000
jb 0x140036034
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036804
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x1400360f3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003603c
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x140036122
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x1400367fe
lea rbx, [rbx*4]
test rbx, rbx
jne 0x1400360c2
xor eax, eax
jmp 0x140036102
cmp rbx, 0x1000
jb 0x1400360fa
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140036804
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x1400360f3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140036102
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x1400361d4
sub r14, rdi
sar r14, 2
lea rdx, [r14*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400361cb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400361cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x140036218
sub r15, rsi
sar r15, 2
lea rdx, [r15*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140036210
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036210
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003627b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003627b
nop dword [rax]
lea rdx, str.FiveM_b3095_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140036278
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140036250
jmp 0x14003627b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400365b8
lea rdx, str.FiveM_b3095_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
lea rax, [rbx + 0x206a778]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov ecx, 8
call fcn.140042d0c
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r14, [rax + 8]
mov qword [rsp + 0x60], r14
mov rax, qword [rbp + 0x240]
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov ecx, 8
call fcn.140042d0c
mov rdi, rax
mov qword [rsp + 0x68], rax
lea r15, [rax + 8]
mov qword [rsp + 0x78], r15
mov rax, qword [rbp + 0x248]
mov qword [rdi], rax
lea r12, [rdi + 8]
mov qword [rsp + 0x70], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub rbx, rsi
mov qword [rbp + 0x240], rbx
sar rbx, 2
test rbx, rbx
je 0x140036400
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003680a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x14003639f
xor eax, eax
jmp 0x1400363dc
cmp rbx, 0x1000
jb 0x1400363d4
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400367d4
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140036493
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400363dc
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp + 0x240]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
sub r12, rdi
mov rbx, r12
sar rbx, 2
test rbx, rbx
je 0x1400364c2
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x14003680a
lea rbx, [rbx*4]
test rbx, rbx
jne 0x140036462
xor eax, eax
jmp 0x1400364a2
cmp rbx, 0x1000
jb 0x14003649a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400367d4
call fcn.140042d0c
mov rcx, rax
test rax, rax
je 0x140036493
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400364a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140042d0c
mov qword [rsp + 0x30], rax
add rbx, rax
mov qword [rsp + 0x40], rbx
mov r8, r12
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, qword [rbp + 0x240]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rdi, rdi
je 0x140036574
sub r15, rdi
sar r15, 2
lea rdx, [r15*4]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003656b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003656b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140042a54
nop
test rsi, rsi
je 0x1400365b8
sub r14, rsi
sar r14, 2
lea rdx, [r14*4]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400365b0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400365b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140042a54
mov edi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003661b
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003661b
nop dword [rax]
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140036618
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400365f0
jmp 0x14003661b
mov edi, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400367c0
lea rdx, str.FiveM_GTAProcess.exe
mov ecx, edi
call fcn.1400351e0
mov rbx, rax
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov dword [rbp + 0x240], 0x50
mov dword [rbp + 0x244], 0xd8
lea r14, [rbp + 0x240]
lea rdi, [rbp + 0x248]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x248], 2
lea rdx, [rbp + 0x248]
call fcn.1400427f0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea r8, [rax + 8]
mov qword [rsp + 0x40], r8
mov r8, rax
mov rdx, rdi
mov rcx, r14
call fcn.1400427b0
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x248], r12
lea rcx, [rbp + 0x248]
call fcn.140042720
nop
mov dword [rbp + 0x248], 0x50
mov dword [rbp + 0x24c], 0xdc
lea rax, [rbp + 0x248]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x250]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.140042630
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140042540
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140035280
mov rdi, rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.140042540
mov r8, rax
lea rdx, [rbx + 0x212b208]
mov rcx, rsi
call fcn.140035280
mov rbx, rax
mov dword [rbp + 0x230], 0x497423f0
mov dword [rbp + 0x238], 0x497423f0
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x230]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x238]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
lea rcx, [rsp + 0x50]
call fcn.1400424e0
nop
lea rcx, [rsp + 0x30]
call fcn.1400424e0
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3
call fcn.14002ac20
nop
call fcn.140042790
int3