Function at 0x140001440
Capabilities:
Check if file exists
Delete directory
Delete file
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x4f0
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x4e8], rax
xor r14d, r14d
mov r12d, r14d
mov dword [rsp + 0x40], r14d
lea rdx, str.e_90m_____Dekbangtlez__:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400035f0
mov rcx, rax
lea rdx, str.e_93m
call fcn.1400035f0
mov rcx, rax
lea rdx, str.Waiting_For_Lobby_FiveM...
call fcn.1400035f0
mov rcx, rax
lea rdx, str._e_90m_e_92m__e_90m_
call fcn.1400035f0
nop
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400014c0
lea rcx, [0x140006568]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.e_90m_____Dekbangtlez__:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400035f0
mov rcx, rax
lea rdx, str.e_93m
call fcn.1400035f0
mov rcx, rax
lea rdx, str.Press_F1_For_Sp00fer_FiveM.exe_in_Lobby_Menu
call fcn.1400035f0
mov rcx, rax
lea rdx, str._e_90m_e_92m__e_90m_
call fcn.1400035f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140006568]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400014c0
lea rcx, [0x140006568]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
movdqa xmm1, xmmword [0x140006ac0]
movdqa xmmword [rsp + 0x200], xmm1
movsd xmm0, qword [str.discord.dll]
movsd qword [rsp + 0x1f0], xmm0
movzx eax, word [0x140006658]
mov word [rsp + 0x1f8], ax
movzx eax, byte [0x14000665a]
mov byte [rsp + 0x1fa], al
mov byte [rsp + 0x1fb], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x220], xmm1
mov ecx, 0x20
call fcn.140003e60
mov rdx, rax
mov qword [rsp + 0x210], rax
movdqa xmm0, xmmword [0x140006b20]
movdqa xmmword [rsp + 0x220], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_chrome.bin]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x140006670]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140006678]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14000667c]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x14000667e]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x240], xmm1
mov ecx, 0x20
call fcn.140003e60
mov rdx, rax
mov qword [rsp + 0x230], rax
movdqa xmm0, xmmword [0x140006b10]
movdqa xmmword [rsp + 0x240], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game.bin]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x140006690]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140006698]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x14000669c]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x250], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x260], xmm1
mov ecx, 0x30
call fcn.140003e60
mov qword [rsp + 0x250], rax
movdqa xmm0, xmmword [0x140006b30]
movdqa xmmword [rsp + 0x260], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_372.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400066b0]
movups xmmword [rax + 0x10], xmm0
movzx ecx, byte [0x1400066c0]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x280], xmm1
mov ecx, 0x30
call fcn.140003e60
mov qword [rsp + 0x270], rax
movdqa xmm0, xmmword [0x140006b40]
movdqa xmmword [rsp + 0x280], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_1604.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400066d8]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x1400066e8]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x2a0], xmm1
mov ecx, 0x30
call fcn.140003e60
mov qword [rsp + 0x290], rax
movdqa xmm0, xmmword [0x140006b40]
movdqa xmmword [rsp + 0x2a0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_1868.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140006700]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x140006710]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x2c0], xmm1
mov ecx, 0x30
call fcn.140003e60
mov qword [rsp + 0x2b0], rax
movdqa xmm0, xmmword [0x140006b40]
movdqa xmmword [rsp + 0x2c0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_2060.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140006728]
movups xmmword [rax + 0x10], xmm0
movzx edx, word [0x140006738]
mov word [rax + 0x20], dx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x2e0], xmm1
mov ecx, 0x30
call fcn.140003e60
mov qword [rsp + 0x2d0], rax
movdqa xmm0, xmmword [0x140006b40]
movdqa xmmword [rsp + 0x2e0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_2189.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140006750]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x140006760]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x140006aa0]
movdqa xmmword [rsp + 0x300], xmm1
movsd xmm0, qword [str.botan.dll]
movsd qword [rsp + 0x2f0], xmm0
movzx eax, byte [0x140006770]
mov byte [rsp + 0x2f8], al
mov byte [rsp + 0x2f9], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x310], xmm0
movdqa xmm1, xmmword [0x140006ad0]
movdqa xmmword [rsp + 0x320], xmm1
movsd xmm0, qword [str.asi_five.dll]
movsd qword [rsp + 0x310], xmm0
mov eax, dword [0x140006780]
mov dword [rsp + 0x318], eax
mov byte [rsp + 0x31c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x330], xmm0
movdqa xmm1, xmmword [0x140006aa0]
movdqa xmmword [rsp + 0x340], xmm1
movsd xmm0, qword [str.steam.dll]
movsd qword [rsp + 0x330], xmm0
movzx eax, byte [0x140006790]
mov byte [rsp + 0x338], al
mov byte [rsp + 0x339], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x350], xmm0
movdqa xmm1, xmmword [0x140006af0]
movdqa xmmword [rsp + 0x360], xmm1
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x350], xmm0
mov eax, dword [0x1400067a0]
mov dword [rsp + 0x358], eax
movzx eax, word [0x1400067a4]
mov word [rsp + 0x35c], ax
movzx eax, byte [0x1400067a6]
mov byte [rsp + 0x35e], al
mov byte [rsp + 0x35f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x370], xmm0
movdqa xmmword [rsp + 0x380], xmm1
movsd xmm0, qword [str.CitizenGame.dll]
movsd qword [rsp + 0x370], xmm0
mov eax, dword [0x1400067b0]
mov dword [rsp + 0x378], eax
movzx eax, word [0x1400067b4]
mov word [rsp + 0x37c], ax
movzx eax, byte [0x1400067b6]
mov byte [rsp + 0x37e], al
mov byte [rsp + 0x37f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x390], xmm0
movdqa xmm1, xmmword [0x140006ad0]
movdqa xmmword [rsp + 0x3a0], xmm1
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x390], xmm0
mov eax, dword [0x1400067c0]
mov dword [rsp + 0x398], eax
mov byte [rsp + 0x39c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x3c0], xmm1
mov ecx, 0x20
call fcn.140003e60
mov qword [rsp + 0x3b0], rax
movdqa xmm0, xmmword [0x140006b00]
movdqa xmmword [rsp + 0x3c0], xmm0
movups xmm1, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm1
movzx ecx, word [0x1400067d8]
mov word [rax + 0x10], cx
movzx ecx, byte [0x1400067da]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x140006ae0]
movdqa xmmword [rsp + 0x3e0], xmm1
movsd xmm0, qword [str.CitizenFX.ini]
movsd qword [rsp + 0x3d0], xmm0
mov eax, dword [0x1400067e8]
mov dword [rsp + 0x3d8], eax
movzx eax, byte [0x1400067ec]
mov byte [rsp + 0x3dc], al
mov byte [rsp + 0x3dd], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x140006ab0]
movdqa xmmword [rsp + 0x400], xmm1
movsd xmm0, qword [str.caches.XML]
movsd qword [rsp + 0x3f0], xmm0
movzx eax, word [0x1400067f8]
mov word [rsp + 0x3f8], ax
mov byte [rsp + 0x3fa], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x410], xmm0
movdqa xmm1, xmmword [0x140006ad0]
movdqa xmmword [rsp + 0x420], xmm1
movsd xmm0, qword [str.adhesive.dll]
movsd qword [rsp + 0x410], xmm0
mov eax, dword [0x140006808]
mov dword [rsp + 0x418], eax
mov byte [rsp + 0x41c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x430], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x440], xmm1
mov ecx, 0x20
call fcn.140003e60
mov qword [rsp + 0x430], rax
movdqa xmm0, xmmword [0x140006b00]
movdqa xmmword [rsp + 0x440], xmm0
movups xmm1, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm1
movzx ecx, word [0x1400067d8]
mov word [rax + 0x10], cx
movzx ecx, byte [0x1400067da]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x450], xmm0
movdqa xmm1, xmmword [0x140006af0]
movdqa xmmword [rsp + 0x460], xmm1
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x450], xmm0
mov eax, dword [0x1400067a0]
mov dword [rsp + 0x458], eax
movzx eax, word [0x1400067a4]
mov word [rsp + 0x45c], ax
movzx eax, byte [0x1400067a6]
mov byte [rsp + 0x45e], al
mov byte [rsp + 0x45f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x470], xmm0
movdqa xmm1, xmmword [0x140006ad0]
movdqa xmmword [rsp + 0x480], xmm1
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x470], xmm0
mov eax, dword [0x1400067c0]
mov dword [rsp + 0x478], eax
mov byte [rsp + 0x47c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x490], xmm0
movdqa xmm1, xmmword [0x140006a80]
movdqa xmmword [rsp + 0x4a0], xmm1
mov dword [rsp + 0x490], 0x73676f6c
mov byte [rsp + 0x494], 0
movups xmmword [rsp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x140006a90]
movdqa xmmword [rsp + 0x4c0], xmm1
mov rax, qword [str.crashes]
mov dword [rsp + 0x4b0], eax
movzx eax, word [0x140006814]
mov word [rsp + 0x4b4], ax
movzx eax, byte [0x140006816]
mov byte [rsp + 0x4b6], al
mov byte [rsp + 0x4b7], 0
lea rdi, [rsp + 0x1f0]
movabs r15, 0x7fffffffffffffff
mov r13d, 0xf
lea rdx, str.FiveM.app_
lea rax, [rsp + 0x4d0]
cmp rdi, rax
je 0x140001f57
mov rcx, qword [0x14000aa38]
mov rax, r15
sub rax, rcx
cmp rax, 0xb
jae 0x140001d16
call fcn.1400012b0
lea r9, [0x14000aa28]
cmp qword [0x14000aa40], 0xf
cmova r9, qword [0x14000aa28]
mov qword [rsp + 0x30], 0xb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x98]
call fcn.140003c90
or r12d, 2
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140001d5e
mov r9, qword [rdi]
mov rsi, qword [rdi + 0x10]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140001dbd
lea rax, [rsi + rcx]
mov qword [rsp + 0xa8], rax
lea rbx, [rsp + 0x98]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x98]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
lea rax, [rsp + 0x98]
jmp 0x140001dd2
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0x98]
call fcn.140003aa0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], r14
mov qword [rsp + 0xd0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r13
mov byte [rax], 0
or r12d, 1
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0xf
jbe 0x140001e59
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400041ac
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r13
mov byte [rsp + 0x98], 0
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0xf
cmova rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140001f08
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140001f08
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0xf
cmova rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140001f08
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140001f08
lea r8, [rsp + 0xb8]
lea rdx, str.Error_deleting_file:
lea rcx, [rsp + 0x78]
call fcn.1400037c0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400012d0
lea rdx, [0x140007f78]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0xf
jbe 0x140001f4e
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400041ac
add rdi, 0x20
jmp 0x140001ce6
lea r9, [fcn.140003000]
mov edx, 0x20
lea r8d, [rdx - 9]
lea rcx, [rsp + 0x1f0]
call fcn.140003e9c
nop
jmp 0x140001f88
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xa8], xmm1
lea rdi, [0x14000aa08]
cmp qword [0x14000aa20], 0xf
cmova rdi, qword [0x14000aa08]
mov rbx, qword [0x14000aa18]
cmp rbx, r15
jbe 0x140001fc7
call fcn.1400012b0
cmp rbx, 0xf
ja 0x140001fed
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], r13
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x98], xmm0
jmp 0x14000208f
mov rax, rbx
or rax, 0xf
cmp rax, r15
jbe 0x140002022
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003e60
test rax, rax
je 0x14000204c
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140002060
mov r15, rax
mov ecx, 0x16
cmp rax, rcx
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140002053
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x140002007
call fcn.140001210
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002060
call fcn.140003e60
mov r14, rax
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], r15
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r13, qword [rsp + 0xb0]
lea rcx, [rsp + 0x98]
cmp r13, 0xf
cmova rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1400020f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400020f2
lea r8, [rsp + 0x98]
lea rdx, str.Error_deleting_directory:
lea rcx, [rsp + 0x78]
call fcn.1400037c0
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400012d0
lea rdx, [0x140007f78]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [rsp + 0x98]
call fcn.140003000
nop
lea rdx, str.C:WindowsSystem32driversetchosts
lea rcx, [rsp + 0x98]
call fcn.140003060
nop
lea rcx, [rsp + 0xe0]
call fcn.1400022f0
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xe0]
call fcn.140002fb0
nop
lea rcx, [rsp + 0xe0]
call fcn.140002fa0
test al, al
je 0x140002193
lea rdx, str.127.0.0.1_xboxlive.com_n
lea rcx, [rsp + 0xe0]
call fcn.1400035f0
lea rdx, str.127.0.0.1_user.auth.xboxlive.com_n
lea rcx, [rsp + 0xe0]
call fcn.1400035f0
lea rdx, str.127.0.0.1_presence_heartbeat.xboxlive.com_n
lea rcx, [rsp + 0xe0]
call fcn.1400035f0
lea rcx, [rsp + 0xe0]
call fcn.140002f60
nop
lea rcx, [rsp + 0xe0]
call fcn.140002230
nop
lea rcx, [rsp + 0x98]
call fcn.140003000
nop
mov edx, 0x258
lea ecx, [rdx - 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.e_90m_____Dekbangtlez__:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400035f0
mov rcx, rax
lea rdx, str.e_92m
call fcn.1400035f0
mov rcx, rax
lea rdx, str.Sp00f_FiveM.exe_succesful__
call fcn.1400035f0
mov rcx, rax
lea rdx, str._e_90m_e_92m__e_90m_
call fcn.1400035f0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x40040
lea r8, str.Dekbangtlez
lea rdx, str.Thank_you_for_using_my_sp00f__unban_FiveM.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3