Function at 0x140001440
Capabilities:
Check if file exists
Delete directory
Delete file
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x4f0
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x4e8], rax
xor r14d, r14d
mov r12d, r14d
mov dword [rsp + 0x40], r14d
lea r9d, [r14 + 0x30]
lea r8, [0x140006638]
lea rdx, [0x140006660]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [0x1400037f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Waiting_For_Lobby
call fcn.140003620
mov rcx, rax
lea rdx, [0x140003820]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.FiveM...
call fcn.140003620
mov rcx, rax
lea rdx, [0x1400037f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400065d1]
call fcn.140003620
nop dword [rax]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140001500
lea rcx, [0x1400065d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400037f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.OK____Press_F1_Lobby_FiveM_for_Unban
call fcn.140003620
mov rcx, rax
lea rdx, [0x140003820]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Spoofer
call fcn.140003620
mov rcx, rax
lea rdx, [0x1400037f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400065d1]
call fcn.140003620
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400065d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001500
lea rcx, [0x1400065d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
movdqa xmm1, xmmword [0x140006cc0]
movdqa xmmword [rsp + 0x200], xmm1
movsd xmm0, qword [str.discord.dll]
movsd qword [rsp + 0x1f0], xmm0
movzx eax, word [0x1400068d8]
mov word [rsp + 0x1f8], ax
movzx eax, byte [0x1400068da]
mov byte [rsp + 0x1fa], al
mov byte [rsp + 0x1fb], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x220], xmm1
mov ecx, 0x20
call fcn.140004210
mov rdx, rax
mov qword [rsp + 0x210], rax
movdqa xmm0, xmmword [0x140006d20]
movdqa xmmword [rsp + 0x220], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_chrome.bin]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x1400068f0]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400068f8]
mov dword [rax + 0x18], ecx
movzx eax, word [0x1400068fc]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x1400068fe]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x240], xmm1
mov ecx, 0x20
call fcn.140004210
mov rdx, rax
mov qword [rsp + 0x230], rax
movdqa xmm0, xmmword [0x140006d10]
movdqa xmmword [rsp + 0x240], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game.bin]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x140006910]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140006918]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x14000691c]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x250], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x260], xmm1
mov ecx, 0x30
call fcn.140004210
mov qword [rsp + 0x250], rax
movdqa xmm0, xmmword [0x140006d30]
movdqa xmmword [rsp + 0x260], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_372.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140006930]
movups xmmword [rax + 0x10], xmm0
movzx ecx, byte [0x140006940]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x280], xmm1
mov ecx, 0x30
call fcn.140004210
mov qword [rsp + 0x270], rax
movdqa xmm0, xmmword [0x140006d40]
movdqa xmmword [rsp + 0x280], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_1604.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140006958]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x140006968]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x2a0], xmm1
mov ecx, 0x30
call fcn.140004210
mov qword [rsp + 0x290], rax
movdqa xmm0, xmmword [0x140006d40]
movdqa xmmword [rsp + 0x2a0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_1868.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140006980]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x140006990]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x2c0], xmm1
mov ecx, 0x30
call fcn.140004210
mov qword [rsp + 0x2b0], rax
movdqa xmm0, xmmword [0x140006d40]
movdqa xmmword [rsp + 0x2c0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_2060.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400069a8]
movups xmmword [rax + 0x10], xmm0
movzx edx, word [0x1400069b8]
mov word [rax + 0x20], dx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x2e0], xmm1
mov ecx, 0x30
call fcn.140004210
mov qword [rsp + 0x2d0], rax
movdqa xmm0, xmmword [0x140006d40]
movdqa xmmword [rsp + 0x2e0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_2189.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400069d0]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x1400069e0]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x140006ca0]
movdqa xmmword [rsp + 0x300], xmm1
movsd xmm0, qword [str.botan.dll]
movsd qword [rsp + 0x2f0], xmm0
movzx eax, byte [0x1400069f0]
mov byte [rsp + 0x2f8], al
mov byte [rsp + 0x2f9], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x310], xmm0
movdqa xmm1, xmmword [0x140006cd0]
movdqa xmmword [rsp + 0x320], xmm1
movsd xmm0, qword [str.asi_five.dll]
movsd qword [rsp + 0x310], xmm0
mov eax, dword [0x140006a00]
mov dword [rsp + 0x318], eax
mov byte [rsp + 0x31c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x330], xmm0
movdqa xmm1, xmmword [0x140006ca0]
movdqa xmmword [rsp + 0x340], xmm1
movsd xmm0, qword [str.steam.dll]
movsd qword [rsp + 0x330], xmm0
movzx eax, byte [0x140006a10]
mov byte [rsp + 0x338], al
mov byte [rsp + 0x339], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x350], xmm0
movdqa xmm1, xmmword [0x140006cf0]
movdqa xmmword [rsp + 0x360], xmm1
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x350], xmm0
mov eax, dword [0x140006a20]
mov dword [rsp + 0x358], eax
movzx eax, word [0x140006a24]
mov word [rsp + 0x35c], ax
movzx eax, byte [0x140006a26]
mov byte [rsp + 0x35e], al
mov byte [rsp + 0x35f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x370], xmm0
movdqa xmmword [rsp + 0x380], xmm1
movsd xmm0, qword [str.CitizenGame.dll]
movsd qword [rsp + 0x370], xmm0
mov eax, dword [0x140006a30]
mov dword [rsp + 0x378], eax
movzx eax, word [0x140006a34]
mov word [rsp + 0x37c], ax
movzx eax, byte [0x140006a36]
mov byte [rsp + 0x37e], al
mov byte [rsp + 0x37f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x390], xmm0
movdqa xmm1, xmmword [0x140006cd0]
movdqa xmmword [rsp + 0x3a0], xmm1
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x390], xmm0
mov eax, dword [0x140006a40]
mov dword [rsp + 0x398], eax
mov byte [rsp + 0x39c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x3c0], xmm1
mov ecx, 0x20
call fcn.140004210
mov qword [rsp + 0x3b0], rax
movdqa xmm0, xmmword [0x140006d00]
movdqa xmmword [rsp + 0x3c0], xmm0
movups xmm1, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm1
movzx ecx, word [0x140006a58]
mov word [rax + 0x10], cx
movzx ecx, byte [0x140006a5a]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x140006ce0]
movdqa xmmword [rsp + 0x3e0], xmm1
movsd xmm0, qword [str.CitizenFX.ini]
movsd qword [rsp + 0x3d0], xmm0
mov eax, dword [0x140006a68]
mov dword [rsp + 0x3d8], eax
movzx eax, byte [0x140006a6c]
mov byte [rsp + 0x3dc], al
mov byte [rsp + 0x3dd], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x140006cb0]
movdqa xmmword [rsp + 0x400], xmm1
movsd xmm0, qword [str.caches.XML]
movsd qword [rsp + 0x3f0], xmm0
movzx eax, word [0x140006a78]
mov word [rsp + 0x3f8], ax
mov byte [rsp + 0x3fa], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x410], xmm0
movdqa xmm1, xmmword [0x140006cd0]
movdqa xmmword [rsp + 0x420], xmm1
movsd xmm0, qword [str.adhesive.dll]
movsd qword [rsp + 0x410], xmm0
mov eax, dword [0x140006a88]
mov dword [rsp + 0x418], eax
mov byte [rsp + 0x41c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x430], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x440], xmm1
mov ecx, 0x20
call fcn.140004210
mov qword [rsp + 0x430], rax
movdqa xmm0, xmmword [0x140006d00]
movdqa xmmword [rsp + 0x440], xmm0
movups xmm1, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm1
movzx ecx, word [0x140006a58]
mov word [rax + 0x10], cx
movzx ecx, byte [0x140006a5a]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x450], xmm0
movdqa xmm1, xmmword [0x140006cf0]
movdqa xmmword [rsp + 0x460], xmm1
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x450], xmm0
mov eax, dword [0x140006a20]
mov dword [rsp + 0x458], eax
movzx eax, word [0x140006a24]
mov word [rsp + 0x45c], ax
movzx eax, byte [0x140006a26]
mov byte [rsp + 0x45e], al
mov byte [rsp + 0x45f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x470], xmm0
movdqa xmm1, xmmword [0x140006cd0]
movdqa xmmword [rsp + 0x480], xmm1
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x470], xmm0
mov eax, dword [0x140006a40]
mov dword [rsp + 0x478], eax
mov byte [rsp + 0x47c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x490], xmm0
movdqa xmm1, xmmword [0x140006c80]
movdqa xmmword [rsp + 0x4a0], xmm1
mov dword [rsp + 0x490], 0x73676f6c
mov byte [rsp + 0x494], 0
movups xmmword [rsp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x140006c90]
movdqa xmmword [rsp + 0x4c0], xmm1
mov rax, qword [str.crashes]
mov dword [rsp + 0x4b0], eax
movzx eax, word [0x140006a94]
mov word [rsp + 0x4b4], ax
movzx eax, byte [0x140006a96]
mov byte [rsp + 0x4b6], al
mov byte [rsp + 0x4b7], 0
lea rdi, [rsp + 0x1f0]
movabs r15, 0x7fffffffffffffff
mov r13d, 0xf
lea rdx, str.FiveM.app_
lea rax, [rsp + 0x4d0]
cmp rdi, rax
je 0x140001fb8
mov rcx, qword [0x14000aa50]
mov rax, r15
sub rax, rcx
cmp rax, 0xb
jae 0x140001d77
call fcn.1400012b0
lea r9, [0x14000aa40]
cmp qword [0x14000aa58], 0xf
cmova r9, qword [0x14000aa40]
mov qword [rsp + 0x30], 0xb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x98]
call fcn.140003d20
or r12d, 1
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140001dbf
mov r9, qword [rdi]
mov rsi, qword [rdi + 0x10]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140001e1e
lea rax, [rsi + rcx]
mov qword [rsp + 0xa8], rax
lea rbx, [rsp + 0x98]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x98]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
lea rax, [rsp + 0x98]
jmp 0x140001e33
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0x98]
call fcn.140003b30
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], r14
mov qword [rsp + 0xd0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r13
mov byte [rax], 0
or r12d, 2
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0xf
jbe 0x140001eba
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001eb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001eb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000455c
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], r13
mov byte [rsp + 0x98], 0
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0xf
cmova rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140001f69
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140001f69
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 0xf
cmova rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140001f69
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140001f69
lea r8, [rsp + 0xb8]
lea rdx, str.Error_deleting_file:
lea rcx, [rsp + 0x78]
call fcn.140003850
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400012d0
lea rdx, [0x140008260]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0xf
jbe 0x140001faf
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001faa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001faa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000455c
add rdi, 0x20
jmp 0x140001d47
lea r9, [fcn.140003030]
mov edx, 0x20
lea r8d, [rdx - 9]
lea rcx, [rsp + 0x1f0]
call fcn.14000424c
nop
jmp 0x140001fe9
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xa8], xmm1
lea rdi, [0x14000aa20]
cmp qword [0x14000aa38], 0xf
cmova rdi, qword [0x14000aa20]
mov rbx, qword [0x14000aa30]
cmp rbx, r15
jbe 0x140002028
call fcn.1400012b0
cmp rbx, 0xf
ja 0x14000204e
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], r13
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x98], xmm0
jmp 0x1400020f0
mov rax, rbx
or rax, 0xf
cmp rax, r15
jbe 0x140002083
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004210
test rax, rax
je 0x1400020ad
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400020c1
mov r15, rax
mov ecx, 0x16
cmp rax, rcx
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x1400020b4
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x140002068
call fcn.140001210
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400020c1
call fcn.140004210
mov r14, rax
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], r15
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r13, qword [rsp + 0xb0]
lea rcx, [rsp + 0x98]
cmp r13, 0xf
cmova rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140002153
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140002153
lea r8, [rsp + 0x98]
lea rdx, str.Error_deleting_directory:
lea rcx, [rsp + 0x78]
call fcn.140003850
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400012d0
lea rdx, [0x140008260]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [rsp + 0x98]
call fcn.140003030
nop
lea rdx, str.C:WindowsSystem32driversetchosts
lea rcx, [rsp + 0x98]
call fcn.140003090
nop
lea rcx, [rsp + 0xe0]
call fcn.140002320
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xe0]
call fcn.140002fe0
nop
lea rcx, [rsp + 0xe0]
call fcn.140002fd0
test al, al
je 0x1400021f4
lea rdx, str.127.0.0.1_xboxlive.com_n
lea rcx, [rsp + 0xe0]
call fcn.140003620
lea rdx, str.127.0.0.1_user.auth.xboxlive.com_n
lea rcx, [rsp + 0xe0]
call fcn.140003620
lea rdx, str.127.0.0.1_presence_heartbeat.xboxlive.com_n
lea rcx, [rsp + 0xe0]
call fcn.140003620
lea rcx, [rsp + 0xe0]
call fcn.140002f90
nop
lea rcx, [rsp + 0xe0]
call fcn.140002260
nop
lea rcx, [rsp + 0x98]
call fcn.140003030
nop
mov edx, 0x258
lea ecx, [rdx - 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, [0x1400037f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Spoofer_Successfully_Enjoy_Bro___
call fcn.140003620
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3