Function at 0x140048040
Capabilities:
Execute command
Move file

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14005e040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov ecx, 0x30
call fcn.14004b8d4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x10
mov qword [rsp + 0x48], 0x17
movups xmm0, xmmword [str.taskkill__f__im]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140053590]
movups xmmword [rax + 0x10], xmm1
mov word [rax + 0x20], bx
mov qword [rsp + 0x20], 9
mov edx, 9
lea rcx, [rsp + 0x30]
call fcn.14004aac0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
lea rdx, str.Would_kill_process:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14004a680
mov rcx, rax
lea rdx, str.Steam.exe
call fcn.14004a680
lea rdx, [0x14004a860]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004814a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048145
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048145
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004b6e0
lea rdx, str.SOFTWAREMicrosoftMSLicensingHardwareID
mov rcx, 0xffffffff80000002
call fcn.140047de0
lea rdx, str.SOFTWAREMicrosoftMSLicensingStore
mov rcx, 0xffffffff80000002
call fcn.140047de0
lea rdx, str.SoftwareWinRARArcHistory
mov rcx, 0xffffffff80000001
call fcn.140047de0
lea rdx, str.SYSTEMControlSet001Services_bamStateUserSettingsS_1_5_21_1282084573_1681065996_3115981261_1001
mov rcx, 0xffffffff80000002
call fcn.140047de0
lea rdx, str.SYSTEMControlSet001Services_bamStateUserSettingsS_1_5_21_332004695_2829936588_140372829_1002
mov rcx, 0xffffffff80000002
call fcn.140047de0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView
mov rcx, 0xffffffff80000001
call fcn.140047de0
lea rdx, str.Local_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov rcx, 0xffffffff80000000
call fcn.140047de0
lea rcx, str.C:Windows_tempor1
call fcn.140047e90
lea rcx, str.C:Windows_temp
call fcn.140047e90
lea rcx, str.C:Windows_tmp
call fcn.140047e90
lea rcx, str.C:Windows_ff.tmp
call fcn.140047e90
lea rcx, str.C:Windowshistory
call fcn.140047e90
lea rcx, str.C:Windowscookies
call fcn.140047e90
lea rcx, str.C:Windows_recent
call fcn.140047e90
lea rcx, str.C:Windows_spoolprinters
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appcfx_curl_x86_64.dll
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appcacheBrowser
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appcachedb
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appcachedunno
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appcachepriv
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appcache_servers
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appcache_subprocess
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appcacheunconfirmed
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.app_steam_api64.dll
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appcache_authbrowser
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appcachecrashometry
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appcachelauncher_skip
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appcachelauncher_skip_mtl2
call fcn.140047f90
lea rcx, str._LocalAppData_DigitalEntitlements
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appprofiles.dll
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appCitizenFX_SubProcess_chrome.bin
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appCitizenFX_SubProcess_game.bin
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appCitizenFX_SubProcess_game_372.bin
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appCitizenFX_SubProcess_game_1604.bin
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appCitizenFX_SubProcess_game_1868.bin
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appCitizenFX_SubProcess_game_2060.bin
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appCitizenFX_SubProcess_game_2189.bin
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appCitizenGame.dll
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.app_asi_five.dll
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.app_steam.dll
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appCitizenFX.ini
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appcaches.XML
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.app_adhesive.dll
call fcn.140047f90
lea rcx, str._LocalAppData_FiveMFiveM.appdiscord.dll
call fcn.140047f90
lea rcx, str._userprofile_AppDataRoamingCitizenFX
call fcn.140047e90
lea rcx, str._LocalAppData_FiveMFiveM.appcrashes
call fcn.140047e90
mov r8d, 1
lea rdx, str.STARCHARMS_SPOOFER
lea rcx, str._userprofile_AppDataRoamingdiscord0.0.309modulesdiscord_rpc
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400483d6
lea rdx, str.Would_rename_Discord_directory_to_STARCHARMS_SPOOFER
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14004a680
jmp 0x1400483fd
lea rdx, str.Failed_to_rename_Discord_directory._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004a680
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004a860]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14004b290
add rsp, 0x60
pop rbx
ret