Function at 0x140011631
Capabilities:
Check if file exists
Delete directory
Delete file
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
jmp 0x14001db50
push rbp
push rdi
sub rsp, 0xb28
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1fe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140037040]
xor rax, rbp
mov qword [rbp + 0xae0], rax
lea rcx, [0x14003f105]
call fcn.1400118ed
lea rdx, str.e_90m_____Dekbangtlez__:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001111d
lea rdx, str.e_93m
mov rcx, rax
call fcn.14001111d
lea rdx, str.Waiting_For_Lobby_FiveM...
mov rcx, rax
call fcn.14001111d
lea rdx, str._e_90m_e_92m__e_90m_
mov rcx, rax
call fcn.14001111d
xor eax, eax
cmp eax, 1
je 0x14001e26e
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14001dbf7
jmp 0x14001e269
lea rcx, [0x1400319dc]
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, str.e_90m_____Dekbangtlez__:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001111d
lea rdx, str.e_93m
mov rcx, rax
call fcn.14001111d
lea rdx, str.Press_F1_For_Sp00fer_FiveM.exe_in_Lobby_Menu
mov rcx, rax
call fcn.14001111d
lea rdx, str._e_90m_e_92m__e_90m_
mov rcx, rax
call fcn.14001111d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400319dc]
call qword [sym.imp.ucrtbased.dll_system]
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14001e269
lea rcx, [0x1400319dc]
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rdx, str.discord.dll
lea rcx, [rbp + 0x30]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.CitizenFX_SubProcess_chrome.bin
lea rcx, [rbp + 0x58]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.CitizenFX_SubProcess_game.bin
lea rcx, [rbp + 0x80]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.CitizenFX_SubProcess_game_372.bin
lea rcx, [rbp + 0xa8]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.CitizenFX_SubProcess_game_1604.bin
lea rcx, [rbp + 0xd0]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.CitizenFX_SubProcess_game_1868.bin
lea rcx, [rbp + 0xf8]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.CitizenFX_SubProcess_game_2060.bin
lea rcx, [rbp + 0x120]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.CitizenFX_SubProcess_game_2189.bin
lea rcx, [rbp + 0x148]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.botan.dll
lea rcx, [rbp + 0x170]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.asi_five.dll
lea rcx, [rbp + 0x198]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.steam.dll
lea rcx, [rbp + 0x1c0]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.steam_api64.dll
lea rcx, [rbp + 0x1e8]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.CitizenGame.dll
lea rcx, [rbp + 0x210]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.profiles.dll
lea rcx, [rbp + 0x238]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.cfx_curl_x86_64.dll
lea rcx, [rbp + 0x260]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.CitizenFX.ini
lea rcx, [rbp + 0x288]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.caches.XML
lea rcx, [rbp + 0x2b0]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.adhesive.dll
lea rcx, [rbp + 0x2d8]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.cfx_curl_x86_64.dll
lea rcx, [rbp + 0x300]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.steam_api64.dll
lea rcx, [rbp + 0x328]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.profiles.dll
lea rcx, [rbp + 0x350]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.logs
lea rcx, [rbp + 0x378]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
lea rdx, str.crashes
lea rcx, [rbp + 0x3a0]
call fcn.1400113fc
nop
lea rax, [rbp + 0x30]
mov qword [rbp + 0x3e8], rax
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x408], rax
mov rax, qword [rbp + 0x3e8]
add rax, 0x398
mov qword [rbp + 0x428], rax
jmp 0x14001df0c
mov rax, qword [rbp + 0x408]
add rax, 0x28
mov qword [rbp + 0x408], rax
mov rax, qword [rbp + 0x428]
cmp qword [rbp + 0x408], rax
je 0x14001e04e
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x448], rax
lea r8, str.FiveM.app_
lea rdx, [0x140037748]
lea rcx, [rbp + 0x9b8]
call fcn.140011721
mov qword [rbp + 0xac8], rax
mov rax, qword [rbp + 0xac8]
mov qword [rbp + 0xad0], rax
mov r8, qword [rbp + 0x448]
mov rdx, qword [rbp + 0xad0]
lea rcx, [rbp + 0x468]
call fcn.14001130c
mov qword [rbp + 0xad8], rax
lea rcx, [rbp + 0x9b8]
call fcn.1400111bd
lea rcx, [rbp + 0x468]
call fcn.1400110f5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x14001e03d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14001e03d
lea rcx, [rbp + 0x468]
call fcn.1400110f5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14001e03d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14001e03d
lea r8, [rbp + 0x468]
lea rdx, str.Error_deleting_file:
lea rcx, [rbp + 0xa28]
call fcn.140011069
mov qword [rbp + 0xac8], rax
mov rax, qword [rbp + 0xac8]
mov qword [rbp + 0xad0], rax
mov rdx, qword [rbp + 0xad0]
lea rcx, [rbp + 0x9f8]
call fcn.14001134d
lea rdx, [0x140036a38]
lea rcx, [rbp + 0x9f8]
call fcn.1400119ba
nop
lea rcx, [rbp + 0xa28]
call fcn.1400111bd
nop
lea rcx, [rbp + 0x468]
call fcn.1400111bd
jmp 0x14001defa
lea r9, [fcn.1400111bd]
mov r8d, 0x17
mov edx, 0x28
lea rcx, [rbp + 0x30]
call fcn.140011262
nop
jmp 0x14001e06c
lea rdx, [0x140037720]
lea rcx, [rbp + 0x4c8]
call fcn.14001114f
mov qword [rbp + 0xac8], rax
lea rcx, [rbp + 0x4c8]
call fcn.1400110f5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x14001e10d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14001e10d
lea r8, [rbp + 0x4c8]
lea rdx, str.Error_deleting_directory:
lea rcx, [rbp + 0xa98]
call fcn.140011069
mov qword [rbp + 0xac8], rax
mov rax, qword [rbp + 0xac8]
mov qword [rbp + 0xad0], rax
mov rdx, qword [rbp + 0xad0]
lea rcx, [rbp + 0xa68]
call fcn.14001134d
lea rdx, [0x140036a38]
lea rcx, [rbp + 0xa68]
call fcn.1400119ba
nop
lea rcx, [rbp + 0xa98]
call fcn.1400111bd
nop
lea rcx, [rbp + 0x4c8]
call fcn.1400111bd
nop
jmp 0x14001e11c
lea rdx, str.C:WindowsSystem32driversetchosts
lea rcx, [rbp + 0x528]
call fcn.1400113fc
mov qword [rbp + 0xac8], rax
mov edx, 0x108
lea rcx, [rbp + 0x570]
call fcn.140011393
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 8
lea rdx, [rbp + 0x528]
lea rcx, [rbp + 0x570]
call fcn.14001191f
mov qword [rbp + 0xac8], rax
lea rcx, [rbp + 0x570]
call fcn.14001164f
movzx eax, al
test eax, eax
je 0x14001e1ce
lea rdx, str.127.0.0.1_xboxlive.com_n
lea rcx, [rbp + 0x570]
call fcn.14001111d
lea rdx, str.127.0.0.1_user.auth.xboxlive.com_n
lea rcx, [rbp + 0x570]
call fcn.14001111d
lea rdx, str.127.0.0.1_presence_heartbeat.xboxlive.com_n
lea rcx, [rbp + 0x570]
call fcn.14001111d
lea rcx, [rbp + 0x570]
call fcn.1400114ba
nop
lea rcx, [rbp + 0x570]
call fcn.14001124e
nop
lea rcx, [rbp + 0x528]
call fcn.1400111bd
nop
jmp 0x14001e1ea
mov edx, 0x258
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.e_90m_____Dekbangtlez__:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001111d
lea rdx, str.e_92m
mov rcx, rax
call fcn.14001111d
lea rdx, str.Sp00f_FiveM.exe_succesful__
mov rcx, rax
call fcn.14001111d
lea rdx, str._e_90m_e_92m__e_90m_
mov rcx, rax
call fcn.14001111d
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x40040
lea r8, str.Dekbangtlez
lea rdx, str.Thank_you_for_using_my_sp00f__unban_FiveM.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
jmp 0x14001dbcd
lea rcx, [rbp - 0x30]
lea rdx, [0x14002a650]
call fcn.14001177b
mov rcx, qword [rbp + 0xae0]
xor rcx, rbp
call fcn.14001146a
lea rsp, [rbp + 0xaf8]
pop rdi
pop rbp
ret