Function at 0x1800040e0
Capabilities:
Delete file
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x18000d040]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rcx, str.pat1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.pat2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r14d, r14d
nop
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x180004180
lea rcx, [0x1800096ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.pat1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.pat2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.fail_to_find_fivem
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180006d40
jmp 0x180004130
mov qword [rbp - 0x79], 0x42960000
mov dword [rbp - 0x71], 0xffffffff
mov word [rbp - 0x6d], 0x9808
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x39], xmm1
mov rdi, r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x29], r14
lea rcx, [rbp - 0x69]
call fcn.180002eb0
lea rcx, [rbp - 0x39]
cmp rcx, rax
je 0x1800041e2
mov rsi, qword [rax]
mov qword [rbp - 0x39], rsi
mov rbx, qword [rax + 8]
mov qword [rbp - 0x31], rbx
mov rdi, qword [rax + 0x10]
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x29], rdi
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x1800041ea
mov rbx, qword [rbp - 0x31]
mov rsi, qword [rbp - 0x39]
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x51], rbx
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x180004238
mov rax, qword [rbp - 0x59]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004233
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004893
call fcn.180007730
cmp rsi, rbx
jne 0x180004342
call fcn.180002290
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0xe
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x69]
call fcn.180002010
mov rbx, rax
lea rax, [rbp - 0x39]
cmp rax, rbx
je 0x1800042db
test rsi, rsi
je 0x1800042b9
sub rdi, rsi
sar rdi, 3
lea rdx, [rdi*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800042b1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000489a
mov rcx, rsi
call fcn.180007730
mov rax, qword [rbx]
mov qword [rbp - 0x39], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x31], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x29], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x180004321
mov rax, qword [rbp - 0x59]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000431c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000489a
call fcn.180007730
lea rcx, [rbp - 0x39]
call fcn.180002c60
mov rdi, qword [rbp - 0x29]
mov qword [rbp - 0x49], rdi
mov rbx, qword [rbp - 0x31]
mov qword [rbp - 0x51], rbx
mov rsi, qword [rbp - 0x39]
mov qword [rbp - 0x41], rsi
mov r13, rsi
cmp rsi, rbx
je 0x18000483c
nop
mov rdi, qword [r13]
mov dword [rbp + 0x17], 0
call fcn.180002290
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor esi, esi
test rax, rax
je 0x180004393
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 4]
lea r8, [rbp + 0x17]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x1b], 0x42960000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x1b]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp - 0x69], 0x42960000
mov qword [rbp - 0x65], 0x42960000
mov dword [rbp - 0x5d], 0xffffffff
mov word [rbp - 0x59], 0x9808
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
mov r15, rsi
mov qword [rbp - 0x11], rsi
lea rcx, [rbp - 9]
call fcn.180002560
lea rcx, [rbp - 0x21]
cmp rcx, rax
je 0x180004421
mov r14, qword [rax]
mov qword [rbp - 0x21], r14
mov r12, qword [rax + 8]
mov qword [rbp - 0x19], r12
mov r15, qword [rax + 0x10]
mov qword [rbp - 0x11], r15
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
jmp 0x180004429
mov r12, qword [rbp - 0x19]
mov r14, qword [rbp - 0x21]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x18000446f
mov rax, qword [rbp + 7]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000446a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800048a1
call fcn.180007730
cmp r14, r12
jne 0x18000456d
call fcn.180002290
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 0x12
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 9]
call fcn.180002010
mov rbx, rax
lea rax, [rbp - 0x21]
cmp rax, rbx
je 0x180004512
test r14, r14
je 0x1800044f0
sub r15, r14
sar r15, 3
lea rdx, [r15*8]
mov rax, r14
cmp rdx, 0x1000
jb 0x1800044e8
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800048a8
mov rcx, r14
call fcn.180007730
mov rax, qword [rbx]
mov qword [rbp - 0x21], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x19], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x11], rax
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x180004558
mov rax, qword [rbp + 7]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004553
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800048a8
call fcn.180007730
lea rcx, [rbp - 0x21]
call fcn.180002950
mov r15, qword [rbp - 0x11]
mov r12, qword [rbp - 0x19]
mov r14, qword [rbp - 0x21]
mov rsi, r14
cmp r14, r12
je 0x1800047e2
nop dword [rax]
mov rdi, qword [rsi]
mov dword [rbp + 0x1f], 0
call fcn.180002290
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1800045c6
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x1f]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp + 0x23], 0x42960000
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x23]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], 0xb
mov qword [rbp + 0xf], 0xf
movsd xmm0, qword [str.192.168.1.1]
movsd qword [rbp - 9], xmm0
movzx eax, word [0x1800096d0]
mov word [rbp - 1], ax
movzx eax, byte [0x1800096d2]
mov byte [rbp + 1], al
mov byte [rbp + 2], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__getpid]
mov edi, eax
mov r9d, 0x40
lea r8, str.info
lea rdx, str.You_Use
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x180004786
nop dword [rax]
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180004750
lea rcx, [0x1800096ac]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._Address_Detected_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180006d40
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rdx, qword [rbp - 9]
mov r8, qword [rbp + 7]
mov rcx, rax
call fcn.180007200
mov rcx, rax
lea rdx, [0x180006f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Current_process_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180006d40
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x180006f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Direction_angle_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180006d40
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x180006f10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.180003500
call fcn.180003b40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000475a
call fcn.1800031e0
call fcn.180003820
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18000487d
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x180004680
lea rdx, str.Window_has_been_closed._Exiting_hotkey_loop._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180006d40
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x1800047d5
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800047d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800048af
call fcn.180007730
add rsi, 8
cmp rsi, r12
jne 0x180004580
test r14, r14
je 0x180004823
sub r15, r14
sar r15, 3
lea rdx, [r15*8]
mov rax, r14
cmp rdx, 0x1000
jb 0x18000481b
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800048b6
mov rcx, r14
call fcn.180007730
add r13, 8
cmp r13, qword [rbp - 0x51]
jne 0x180004350
mov rdi, qword [rbp - 0x49]
mov rsi, qword [rbp - 0x41]
xor r14d, r14d
test rsi, rsi
je 0x180004130
sub rdi, rsi
and rdi, 0xfffffffffffffff8
mov rax, rsi
cmp rdi, 0x1000
jb 0x18000486d
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800048bd
mov rdx, rdi
mov rcx, rsi
call fcn.180007730
jmp 0x180004130
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x18000479a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3