Function at 0x1400022a0
Capabilities:
Check if file exists
Delete directory
Delete file
Execute command
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x3c0
mov rax, qword [0x14007d180]
xor rax, rsp
mov qword [rsp + 0x3b8], rax
xor r14d, r14d
mov esi, r14d
mov dword [rsp + 0x44], r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [r11 - 0x2f8], 0xb
mov qword [r11 - 0x2f0], 0xf
movsd xmm0, qword [str.discord.dll]
movsd qword [rsp + 0xd0], xmm0
movzx eax, word [0x140068960]
mov word [rsp + 0xd8], ax
movzx eax, byte [0x140068962]
mov byte [rsp + 0xda], al
mov byte [rsp + 0xdb], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [r11 - 0x2d8], r14
mov qword [r11 - 0x2d0], 0xf
lea ecx, [r14 + 0x20]
call fcn.14005a808
mov rcx, rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], 0x1f
mov qword [rsp + 0x108], 0x1f
movups xmm0, xmmword [str.CitizenFX_SubProcess_chrome.bin]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140068978]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x140068980]
mov dword [rcx + 0x18], eax
movzx eax, word [0x140068984]
mov word [rcx + 0x1c], ax
movzx eax, byte [0x140068986]
mov byte [rcx + 0x1e], al
mov byte [rcx + 0x1f], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], r14
mov qword [rsp + 0x128], reloc.WS2_32.dll_ntohs
lea ecx, [r14 + 0x20]
call fcn.14005a808
mov rdx, rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x120], 0x1d
mov qword [rsp + 0x128], 0x1f
movups xmm0, xmmword [str.CitizenFX_SubProcess_game.bin]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140068998]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400689a0]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x1400689a4]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], r14
mov qword [rsp + 0x148], reloc.WS2_32.dll_ntohs
lea ecx, [r14 + 0x30]
call fcn.14005a808
mov rcx, rax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x140], 0x21
mov qword [rsp + 0x148], 0x2f
movups xmm0, xmmword [str.CitizenFX_SubProcess_game_372.bin]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400689b8]
movups xmmword [rax + 0x10], xmm1
movzx eax, byte [0x1400689c8]
mov byte [rcx + 0x20], al
mov byte [rcx + 0x21], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], r14
mov qword [rsp + 0x168], reloc.WS2_32.dll_ntohs
lea ecx, [r14 + 0x30]
call fcn.14005a808
mov rcx, rax
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x160], 0x22
mov qword [rsp + 0x168], 0x2f
movups xmm0, xmmword [str.CitizenFX_SubProcess_game_1604.bin]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400689e0]
movups xmmword [rax + 0x10], xmm1
movzx eax, word [0x1400689f0]
mov word [rcx + 0x20], ax
mov byte [rcx + 0x22], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x188], reloc.WS2_32.dll_ntohs
lea ecx, [r14 + 0x30]
call fcn.14005a808
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x180], 0x22
mov qword [rsp + 0x188], 0x2f
movups xmm0, xmmword [str.CitizenFX_SubProcess_game_1868.bin]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140068a08]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x140068a18]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], r14
mov qword [rsp + 0x1a8], reloc.WS2_32.dll_ntohs
lea ecx, [r14 + 0x30]
call fcn.14005a808
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x1a0], 0x22
mov qword [rsp + 0x1a8], 0x2f
movups xmm0, xmmword [str.CitizenFX_SubProcess_game_2060.bin]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140068a30]
movups xmmword [rax + 0x10], xmm1
movzx edx, word [0x140068a40]
mov word [rax + 0x20], dx
mov byte [rax + 0x22], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], reloc.WS2_32.dll_ntohs
lea ecx, [r14 + 0x30]
call fcn.14005a808
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1c0], 0x22
mov qword [rsp + 0x1c8], 0x2f
movups xmm0, xmmword [str.CitizenFX_SubProcess_game_2189.bin]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140068a58]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x140068a68]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
mov qword [rsp + 0x1e0], 9
mov qword [rsp + 0x1e8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.botan.dll]
movsd qword [rsp + 0x1d0], xmm0
movzx eax, byte [0x140068a78]
mov byte [rsp + 0x1d8], al
mov byte [rsp + 0x1d9], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
mov qword [rsp + 0x200], send
mov qword [rsp + 0x208], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.asi_five.dll]
movsd qword [rsp + 0x1f0], xmm0
mov eax, dword [0x140068a88]
mov dword [rsp + 0x1f8], eax
mov byte [rsp + 0x1fc], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
mov qword [rsp + 0x220], 9
mov qword [rsp + 0x228], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.steam.dll]
movsd qword [rsp + 0x210], xmm0
movzx eax, byte [0x140068a98]
mov byte [rsp + 0x218], al
mov byte [rsp + 0x219], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
mov qword [rsp + 0x240], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x248], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x230], xmm0
mov eax, dword [0x140068aa8]
mov dword [rsp + 0x238], eax
movzx eax, word [0x140068aac]
mov word [rsp + 0x23c], ax
movzx eax, byte [0x140068aae]
mov byte [rsp + 0x23e], al
mov byte [rsp + 0x23f], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x250], xmm0
mov qword [rsp + 0x260], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x268], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.CitizenGame.dll]
movsd qword [rsp + 0x250], xmm0
mov eax, dword [0x140068ab8]
mov dword [rsp + 0x258], eax
movzx eax, word [0x140068abc]
mov word [rsp + 0x25c], ax
movzx eax, byte [0x140068abe]
mov byte [rsp + 0x25e], al
mov byte [rsp + 0x25f], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x270], xmm0
mov qword [rsp + 0x280], send
mov qword [rsp + 0x288], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x270], xmm0
mov eax, dword [0x140068ac8]
mov dword [rsp + 0x278], eax
mov byte [rsp + 0x27c], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x290], xmm0
mov qword [rsp + 0x2a0], r14
mov qword [rsp + 0x2a8], reloc.WS2_32.dll_ntohs
lea ecx, [r14 + 0x20]
call fcn.14005a808
mov rdx, rax
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x2a0], reloc.WS2_32.dll_send
mov qword [rsp + 0x2a8], 0x1f
movups xmm0, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm0
movzx ecx, word [0x140068ae0]
mov word [rax + 0x10], cx
movzx eax, byte [0x140068ae2]
mov byte [rdx + 0x12], al
mov byte [rdx + 0x13], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x2b0], xmm0
mov qword [rsp + 0x2c0], send
mov qword [rsp + 0x2c8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.CitizenFX.ini]
movsd qword [rsp + 0x2b0], xmm0
mov eax, dword [0x140068af0]
mov dword [rsp + 0x2b8], eax
movzx eax, byte [0x140068af4]
mov byte [rsp + 0x2bc], al
mov byte [rsp + 0x2bd], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x2d0], xmm0
mov qword [rsp + 0x2e0], 0xa
mov qword [rsp + 0x2e8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.caches.XML]
movsd qword [rsp + 0x2d0], xmm0
movzx eax, word [0x140068b00]
mov word [rsp + 0x2d8], ax
mov byte [rsp + 0x2da], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x2f0], xmm0
mov qword [rsp + 0x300], send
mov qword [rsp + 0x308], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.adhesive.dll]
movsd qword [rsp + 0x2f0], xmm0
mov eax, dword [0x140068b10]
mov dword [rsp + 0x2f8], eax
mov byte [rsp + 0x2fc], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x310], xmm0
mov qword [rsp + 0x320], r14
mov qword [rsp + 0x328], reloc.WS2_32.dll_ntohs
lea ecx, [r14 + 0x20]
call fcn.14005a808
mov qword [rsp + 0x310], rax
mov qword [rsp + 0x320], reloc.WS2_32.dll_send
mov qword [rsp + 0x328], 0x1f
movups xmm0, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm0
movzx ecx, word [0x140068ae0]
mov word [rax + 0x10], cx
movzx ecx, byte [0x140068ae2]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x330], xmm0
mov qword [rsp + 0x340], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x348], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x330], xmm0
mov eax, dword [0x140068aa8]
mov dword [rsp + 0x338], eax
movzx eax, word [0x140068aac]
mov word [rsp + 0x33c], ax
movzx eax, byte [0x140068aae]
mov byte [rsp + 0x33e], al
mov byte [rsp + 0x33f], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x350], xmm0
mov qword [rsp + 0x360], send
mov qword [rsp + 0x368], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x350], xmm0
mov eax, dword [0x140068ac8]
mov dword [rsp + 0x358], eax
mov byte [rsp + 0x35c], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x370], xmm0
mov qword [rsp + 0x380], 4
mov qword [rsp + 0x388], reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x370], 0x73676f6c
mov byte [rsp + 0x374], r14b
movups xmmword [rsp + 0x390], xmm0
mov qword [rsp + 0x3a0], 7
mov qword [rsp + 0x3a8], reloc.WS2_32.dll_ntohs
mov rax, qword [str.crashes]
mov dword [rsp + 0x390], eax
movzx eax, word [0x140068b1c]
mov word [rsp + 0x394], ax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x396], al
mov byte [rsp + 0x397], r14b
lea rdi, [rsp + 0xd0]
lea r12, [rsp + 0x3b0]
movabs r13, 0x7fffffffffffffff
lea r15, [0x1400846f8]
movzx ebx, byte [rsp + 0x40]
lea rdx, str.FiveM.app_
cmp rdi, r12
je 0x140002d60
mov rcx, qword [0x140084708]
mov rax, r13
sub rax, rcx
cmp rax, 0xb
jae 0x140002b8c
call fcn.1400017f0
mov r9, r15
cmp qword [0x140084710], 0xf
cmova r9, qword [0x1400846f8]
mov qword [rsp + 0x30], send
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov r8, r15
movzx edx, bl
lea rcx, [rsp + 0x48]
call fcn.14000cec0
or esi, 1
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140002bd2
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000b4e0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
or esi, 2
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140002c64
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005ab54
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 0xf
cmova rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140002d11
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140002d11
lea rcx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 0xf
cmova rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140002d11
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140002d11
lea r8, [rsp + 0xb0]
lea rdx, str.Error_deleting_file:
lea rcx, [rsp + 0x80]
call fcn.14000c2a0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140001810
lea rdx, [0x140079510]
lea rcx, [rsp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0xf
jbe 0x140002d57
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005ab54
add rdi, 0x20
jmp 0x140002b64
lea r9, [fcn.14000b570]
mov edx, 0x20
lea r8d, [rdx - 9]
lea rcx, [rsp + 0xd0]
call fcn.14005a844
nop
call fcn.140002df0
mov rcx, rax
call fcn.14000b4b0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x80]
call fcn.140002e50
mov rcx, rax
call fcn.14000b470
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c310
lea rcx, [rsp + 0x80]
call fcn.140002eb0
mov rcx, rax
call fcn.14000b430
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c310
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3