Function at 0x140005770
Capabilities:
Check if file exists
Delete directory
Delete file
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x3d0
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x3c8], rax
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x40], r14d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r11 - 0x60], xmm0
mov qword [r11 - 0x50], rax
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14000be60]
movdqa xmmword [rsp + 0x80], xmm1
movsd xmm0, qword [str.discord.dll]
movsd qword [rsp + 0x70], xmm0
movzx eax, word [0x14000b9a0]
mov word [rsp + 0x78], ax
movzx eax, byte [0x14000b9a2]
mov byte [rsp + 0x7a], al
mov byte [rsp + 0x7b], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0xa0], xmm1
lea ecx, [r14 + 0x20]
call fcn.140009290
mov rdx, rax
mov qword [rsp + 0x90], rax
movdqa xmm0, xmmword [0x14000bec0]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_chrome.bin]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x14000b9b8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14000b9c0]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14000b9c4]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x14000b9c6]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0xc0], xmm1
lea ecx, [r14 + 0x20]
call fcn.140009290
mov rdx, rax
mov qword [rsp + 0xb0], rax
movdqa xmm0, xmmword [0x14000beb0]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game.bin]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x14000b9d8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14000b9e0]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x14000b9e4]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0xe0], xmm1
lea ecx, [r14 + 0x30]
call fcn.140009290
mov qword [rsp + 0xd0], rax
movdqa xmm0, xmmword [0x14000bed0]
movdqa xmmword [rsp + 0xe0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_372.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14000b9f8]
movups xmmword [rax + 0x10], xmm0
movzx ecx, byte [0x14000ba08]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x100], xmm1
lea ecx, [r14 + 0x30]
call fcn.140009290
mov qword [rsp + 0xf0], rax
movdqa xmm0, xmmword [0x14000bee0]
movdqa xmmword [rsp + 0x100], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_1604.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14000ba20]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x14000ba30]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x120], xmm1
lea ecx, [r14 + 0x30]
call fcn.140009290
mov qword [rsp + 0x110], rax
movdqa xmm0, xmmword [0x14000bee0]
movdqa xmmword [rsp + 0x120], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_1868.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14000ba48]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x14000ba58]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x140], xmm1
lea ecx, [r14 + 0x30]
call fcn.140009290
mov qword [rsp + 0x130], rax
movdqa xmm0, xmmword [0x14000bee0]
movdqa xmmword [rsp + 0x140], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_2060.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14000ba70]
movups xmmword [rax + 0x10], xmm0
movzx edx, word [0x14000ba80]
mov word [rax + 0x20], dx
mov byte [rax + 0x22], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x160], xmm1
lea ecx, [r14 + 0x30]
call fcn.140009290
mov qword [rsp + 0x150], rax
movdqa xmm0, xmmword [0x14000bee0]
movdqa xmmword [rsp + 0x160], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_2189.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x14000ba98]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x14000baa8]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
movdqa xmm1, xmmword [0x14000be40]
movdqa xmmword [rsp + 0x180], xmm1
movsd xmm0, qword [str.botan.dll]
movsd qword [rsp + 0x170], xmm0
movzx eax, byte [0x14000bab8]
mov byte [rsp + 0x178], al
mov byte [rsp + 0x179], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
movdqa xmm1, xmmword [0x14000be70]
movdqa xmmword [rsp + 0x1a0], xmm1
movsd xmm0, qword [str.asi_five.dll]
movsd qword [rsp + 0x190], xmm0
mov eax, dword [0x14000bac8]
mov dword [rsp + 0x198], eax
mov byte [rsp + 0x19c], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x14000be40]
movdqa xmmword [rsp + 0x1c0], xmm1
movsd xmm0, qword [str.steam.dll]
movsd qword [rsp + 0x1b0], xmm0
movzx eax, byte [0x14000bad8]
mov byte [rsp + 0x1b8], al
mov byte [rsp + 0x1b9], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
movdqa xmm1, xmmword [0x14000be90]
movdqa xmmword [rsp + 0x1e0], xmm1
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x1d0], xmm0
mov eax, dword [0x14000bae8]
mov dword [rsp + 0x1d8], eax
movzx eax, word [0x14000baec]
mov word [rsp + 0x1dc], ax
movzx eax, byte [0x14000baee]
mov byte [rsp + 0x1de], al
mov byte [rsp + 0x1df], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
movdqa xmmword [rsp + 0x200], xmm1
movsd xmm0, qword [str.CitizenGame.dll]
movsd qword [rsp + 0x1f0], xmm0
mov eax, dword [0x14000baf8]
mov dword [rsp + 0x1f8], eax
movzx eax, word [0x14000bafc]
mov word [rsp + 0x1fc], ax
movzx eax, byte [0x14000bafe]
mov byte [rsp + 0x1fe], al
mov byte [rsp + 0x1ff], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
movdqa xmm1, xmmword [0x14000be70]
movdqa xmmword [rsp + 0x220], xmm1
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x210], xmm0
mov eax, dword [0x14000bb08]
mov dword [rsp + 0x218], eax
mov byte [rsp + 0x21c], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x240], xmm1
lea ecx, [r14 + 0x20]
call fcn.140009290
mov qword [rsp + 0x230], rax
movdqa xmm0, xmmword [0x14000bea0]
movdqa xmmword [rsp + 0x240], xmm0
movups xmm1, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm1
movzx ecx, word [0x14000bb20]
mov word [rax + 0x10], cx
movzx ecx, byte [0x14000bb22]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x250], xmm0
movdqa xmm1, xmmword [0x14000be80]
movdqa xmmword [rsp + 0x260], xmm1
movsd xmm0, qword [str.CitizenFX.ini]
movsd qword [rsp + 0x250], xmm0
mov eax, dword [0x14000bb30]
mov dword [rsp + 0x258], eax
movzx eax, byte [0x14000bb34]
mov byte [rsp + 0x25c], al
mov byte [rsp + 0x25d], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x270], xmm0
movdqa xmm1, xmmword [0x14000be50]
movdqa xmmword [rsp + 0x280], xmm1
movsd xmm0, qword [str.caches.XML]
movsd qword [rsp + 0x270], xmm0
movzx eax, word [0x14000bb40]
mov word [rsp + 0x278], ax
mov byte [rsp + 0x27a], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
movdqa xmm1, xmmword [0x14000be70]
movdqa xmmword [rsp + 0x2a0], xmm1
movsd xmm0, qword [str.adhesive.dll]
movsd qword [rsp + 0x290], xmm0
mov eax, dword [0x14000bb50]
mov dword [rsp + 0x298], eax
mov byte [rsp + 0x29c], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x2c0], xmm1
lea ecx, [r14 + 0x20]
call fcn.140009290
mov qword [rsp + 0x2b0], rax
movdqa xmm0, xmmword [0x14000bea0]
movdqa xmmword [rsp + 0x2c0], xmm0
movups xmm1, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm1
movzx ecx, word [0x14000bb20]
mov word [rax + 0x10], cx
movzx ecx, byte [0x14000bb22]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x2d0], xmm0
movdqa xmm1, xmmword [0x14000be90]
movdqa xmmword [rsp + 0x2e0], xmm1
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x2d0], xmm0
mov eax, dword [0x14000bae8]
mov dword [rsp + 0x2d8], eax
movzx eax, word [0x14000baec]
mov word [rsp + 0x2dc], ax
movzx eax, byte [0x14000baee]
mov byte [rsp + 0x2de], al
mov byte [rsp + 0x2df], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x14000be70]
movdqa xmmword [rsp + 0x300], xmm1
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x2f0], xmm0
mov eax, dword [0x14000bb08]
mov dword [rsp + 0x2f8], eax
mov byte [rsp + 0x2fc], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x310], xmm0
movdqa xmm1, xmmword [0x14000be20]
movdqa xmmword [rsp + 0x320], xmm1
mov dword [rsp + 0x310], 0x73676f6c
mov byte [rsp + 0x314], r14b
movups xmmword [rsp + 0x330], xmm0
movdqa xmm1, xmmword [0x14000be30]
movdqa xmmword [rsp + 0x340], xmm1
mov rax, qword [str.crashes]
mov dword [rsp + 0x330], eax
movzx eax, word [0x14000bb5c]
mov word [rsp + 0x334], ax
movzx eax, byte [0x14000bb5e]
mov byte [rsp + 0x336], al
mov byte [rsp + 0x337], r14b
movdqu xmmword [rsp + 0x388], xmm0
mov qword [rsp + 0x398], r14
mov ecx, 0x2e0
call fcn.140009290
mov rbx, rax
mov qword [rsp + 0x388], rax
mov qword [rsp + 0x390], rax
lea rcx, [rax + 0x2e0]
mov qword [rsp + 0x398], rcx
lea rax, [rsp + 0x388]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x70]
lea r15, [rsp + 0x350]
xorps xmm0, xmm0
movups xmmword [rsp + 0x3a0], xmm0
mov qword [rsp + 0x3a0], rbx
mov qword [rsp + 0x3a8], rbx
lea rax, [rsp + 0x388]
mov qword [rsp + 0x3b0], rax
cmp rdi, r15
je 0x140005fb8
mov rdx, rdi
mov rcx, rbx
call fcn.140007aa0
add rbx, 0x20
mov qword [rsp + 0x3a8], rbx
add rdi, 0x20
jmp 0x140005f96
mov rdx, rbx
mov rcx, rbx
call fcn.140008650
mov qword [rsp + 0x390], rbx
lea r9, [fcn.140007920]
mov edx, 0x20
lea r8d, [rdx - 9]
lea rcx, [rsp + 0x70]
call fcn.1400092cc
mov rcx, qword [rsp + 0x388]
mov rbx, rcx
mov rdi, qword [rsp + 0x390]
movabs r15, 0x7fffffffffffffff
lea r12, [0x140010a00]
lea r13, str.FiveM.app_
cmp rbx, rdi
je 0x14000620d
mov rax, r15
mov rcx, qword [0x140010a10]
sub rax, rcx
cmp rax, 0xb
jae 0x140006031
call fcn.1400014e0
mov r9, r12
cmp qword [0x140010a18], 0xf
cmova r9, qword [0x140010a00]
mov qword [rsp + 0x30], 0xb
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
call fcn.140008ab0
or esi, 1
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140006071
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400078a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3a0], xmm0
mov qword [rsp + 0x3b0], r14
mov qword [rsp + 0x3b8], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x3a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x3b0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or esi, 2
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140006103
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400060fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400095dc
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x3a0]
cmp qword [rsp + 0x3b8], 0xf
cmova rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1400061b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400061b6
lea rcx, [rsp + 0x3a0]
cmp qword [rsp + 0x3b8], 0xf
cmova rcx, qword [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400061b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400061b6
lea r8, [rsp + 0x3a0]
lea rdx, str.Error_deleting_file:
lea rcx, [rsp + 0x368]
call fcn.1400080e0
nop
mov rdx, rax
lea rcx, [rsp + 0x350]
call fcn.140001500
lea rdx, [0x14000dd58]
lea rcx, [rsp + 0x350]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rdx, qword [rsp + 0x3b8]
cmp rdx, 0xf
jbe 0x1400061fc
inc rdx
mov rcx, qword [rsp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400061f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400095dc
add rbx, 0x20
mov rcx, qword [rsp + 0x388]
jmp 0x140006010
test rcx, rcx
je 0x140006264
mov rdx, qword [rsp + 0x390]
call fcn.140008650
mov rdx, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x388]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000625e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000625e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400095dc
nop
lea rdx, str.Do_you_want_Spoof_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007eb0
mov rcx, rax
lea rdx, [0x140008080]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop word [rax + rax]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140006290
call fcn.140004c90
int3