Function at 0x1800048d0
Capabilities:
Delete file
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x18000d040]
xor rax, rsp
mov qword [rbp + 0x90], rax
lea rcx, str.pat1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.pat2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r14d, r14d
nop word [rax + rax]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x180004980
lea rcx, [0x1800096ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pat1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.pat2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.fail_to_find_fivem
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180006d40
jmp 0x180004930
mov qword [rsp + 0x30], 0x42960000
mov dword [rsp + 0x38], 0xffffffff
mov word [rsp + 0x3c], 0x9808
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov rsi, r14
mov qword [rsp + 0x68], r14
mov qword [rbp - 0x68], r14
lea rcx, [rsp + 0x40]
call fcn.180002eb0
lea rcx, [rbp - 0x78]
cmp rcx, rax
je 0x1800049e8
mov rdi, qword [rax]
mov qword [rbp - 0x78], rdi
mov rbx, qword [rax + 8]
mov qword [rbp - 0x70], rbx
mov rsi, qword [rax + 0x10]
mov qword [rsp + 0x68], rsi
mov qword [rbp - 0x68], rsi
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x1800049f0
mov rbx, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x78]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180004a42
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000506e
call fcn.180007730
cmp rdi, rbx
jne 0x180004b53
call fcn.180002290
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0xe
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180002010
mov rbx, rax
lea rax, [rbp - 0x78]
cmp rax, rbx
je 0x180004ae7
test rdi, rdi
je 0x180004ac5
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180004abd
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005075
mov rcx, rdi
call fcn.180007730
mov rax, qword [rbx]
mov qword [rbp - 0x78], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x70], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x68], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180004b2f
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004b2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005075
call fcn.180007730
lea rcx, [rbp - 0x78]
call fcn.180002c60
mov rsi, qword [rbp - 0x68]
mov qword [rsp + 0x68], rsi
mov rbx, qword [rbp - 0x70]
mov qword [rsp + 0x58], rbx
mov rdi, qword [rbp - 0x78]
mov qword [rsp + 0x60], rdi
mov r13, rdi
cmp rdi, rbx
je 0x180005017
nop
mov rdi, qword [r13]
mov dword [rbp - 0x48], 0
call fcn.180002290
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor esi, esi
test rax, rax
je 0x180004ba3
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp - 0x48]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x44], 0x42960000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp - 0x44]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x40], 0x42960000
mov qword [rsp + 0x44], 0x42960000
mov dword [rsp + 0x4c], 0xffffffff
mov word [rsp + 0x50], 0x9808
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov r12, rsi
mov qword [rbp - 0x50], rsi
lea rcx, [rsp + 0x70]
call fcn.180002560
lea rcx, [rbp - 0x60]
cmp rcx, rax
je 0x180004c36
mov r14, qword [rax]
mov qword [rbp - 0x60], r14
mov r15, qword [rax + 8]
mov qword [rbp - 0x58], r15
mov r12, qword [rax + 0x10]
mov qword [rbp - 0x50], r12
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
jmp 0x180004c3e
mov r15, qword [rbp - 0x58]
mov r14, qword [rbp - 0x60]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180004c85
mov rax, qword [rbp - 0x80]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004c80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000507c
call fcn.180007730
cmp r14, r15
jne 0x180004d86
call fcn.180002290
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0x12
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.180002010
mov rbx, rax
lea rax, [rbp - 0x60]
cmp rax, rbx
je 0x180004d2a
test r14, r14
je 0x180004d08
sub r12, r14
sar r12, 3
lea rdx, [r12*8]
mov rax, r14
cmp rdx, 0x1000
jb 0x180004d00
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005083
mov rcx, r14
call fcn.180007730
mov rax, qword [rbx]
mov qword [rbp - 0x60], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x58], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x50], rax
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180004d71
mov rax, qword [rbp - 0x80]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004d6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005083
call fcn.180007730
lea rcx, [rbp - 0x60]
call fcn.180002950
mov r12, qword [rbp - 0x50]
mov r15, qword [rbp - 0x58]
mov r14, qword [rbp - 0x60]
mov rsi, r14
cmp r14, r15
je 0x180004fba
nop dword [rax]
nop word [rax + rax]
mov rdi, qword [rsi]
mov dword [rbp - 0x40], 0
call fcn.180002290
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180004de6
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x40]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x3c], 0x42960000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp - 0x3c]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0x40
lea r8, str.info
lea rdx, str.You_Use
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x180004f9a
nop dword [rax + rax]
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180004e6c
call fcn.180003500
call fcn.180003b40
jmp 0x180004e76
call fcn.1800031e0
call fcn.180003820
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180004f6e
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
xor ebx, ebx
mov dword [rbp - 0x18], ebx
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0x28], 1
lea rcx, str.rage_scripting_five.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str._GetNativeHandler_scrEngine_rage__SAP6AXPEAVscrNativeCallContext_2__Z_K_Z
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movabs rcx, 0x43a66c31c68491c0
call rax
test rax, rax
je 0x180004efc
lea rcx, [rbp - 0x30]
call rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
lea rax, [rbp + 0x50]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x50]
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x48], ebx
mov eax, dword [rbp - 0x10]
mov dword [rbp + 0x50], eax
mov dword [rbp + 0x38], 1
lea rcx, str.rage_scripting_five.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str._GetNativeHandler_scrEngine_rage__SAP6AXPEAVscrNativeCallContext_2__Z_K_Z
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movabs rcx, 0xe1ef3c1216aff2cd
call rax
test rax, rax
je 0x180004f6e
lea rcx, [rbp + 0x30]
call rax
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180005058
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x180004e50
lea rdx, str.Window_has_been_closed._Exiting_hotkey_loop._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180006d40
add rsi, 8
cmp rsi, r15
jne 0x180004da0
test r14, r14
je 0x180004ffb
sub r12, r14
sar r12, 3
lea rdx, [r12*8]
mov rax, r14
cmp rdx, 0x1000
jb 0x180004ff3
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000508a
mov rcx, r14
call fcn.180007730
add r13, 8
cmp r13, qword [rsp + 0x58]
jne 0x180004b60
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
xor r14d, r14d
test rdi, rdi
je 0x180004930
sub rsi, rdi
and rsi, 0xfffffffffffffff8
mov rax, rdi
cmp rsi, 0x1000
jb 0x180005048
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005091
mov rdx, rsi
mov rcx, rdi
call fcn.180007730
jmp 0x180004930
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x180004fad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3