Function at 0x1400016d0
Capabilities:
Execute command
Self delete
Set registry value

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 3
call fcn.1400024d0
lea rcx, str.RD__S__Q__temp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.MKDIR__temp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.takeown__f__temp___r__d_y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.takeown__f_C:_Windows_Temp__r__d_y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RD__S__Q_C:_Windows_Temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.MKDIR_C:_Windows_Temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.takeown__f_C:_Windows_Temp__r__d_y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.takeown__f__temp___r__d_y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_wuauserv
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_UsoSvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__s__q_C:_Windows_SoftwareDistribution
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.md_C:_Windows_SoftwareDistribution
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:_Windows_Prefetch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__S__Q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__S__Q_C:_Windows_Prefetch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:_ProgramData_Microsoft_Windows_WER_ReportArchive
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del___S__Q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__S__Q_C:_ProgramData_Microsoft_Windows_WER_ReportArchive
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd__APPDATA__Microsoft_Windows_Recent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del___S__Q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__S__Q__APPDATA__Microsoft_Windows_Recent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__DigitalEntitlements
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__userprofile__AppData_Roaming_CitizenFX
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_Browser
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_dunno
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_priv
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_servers
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_subprocess
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_unconfirmed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_authbrowser
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_cache_crashometry
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_cache_launcher_skip
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_cache_launcher_skip_mtl2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_crashes.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_logs.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_mods.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_discord.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DELETE_HKEY_CURRENT_USER_Software_WinRAR_ArcHistory___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE_SYSTEM_ControlSet001_Services_bam_State_UserSettings_S___1___5___21___1282084573___1681065996___3115981261___1001___va___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER_Software_Microsoft_Windows_CurrentVersion_Explorer_FeatureUsage_AppSwitched___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE_SYSTEM_ControlSet001_Services_bam_State_UserSettings_S___1___5___21___332004695___2829936588___140372829___1002__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_XboxGipSvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_XboxNetApiSvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_XblGameSave
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_XblAuthManager
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_XboxGipSvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_XboxNetApiSvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_XblGameSave
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_XblAuthManager
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_delete_XblAuthManager
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks___Change___TN_Microsoft_XblGameSave_XblGameSaveTask___disable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks___Change___TN_Microsoft_XblGameSave_XblGameSaveTaskLogon___disable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKLM_SOFTWARE_Policies_Microsoft_Windows_GameDVR___v_AllowGameDVR___t_REG_DWORD___d_0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.set_hostspath___windir___System32_drivers_etc_hosts
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_MSLicensing_HardwareID___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_MSLicensing_Store___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f129]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_Steam.exe__start_Steam.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.set_hostspath_windir__System32_drivers_etc_hosts
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_127.0.0.1_xboxlive.com_____hostspath_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_127.0.0.1_presence___heartbeat.xboxlive.com______hostspath__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_127.0.0.1_user.auth.xboxlive.com______hostspath_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_127.0.0.1_presence_heartbeat.xboxlive.com_____hostspath_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE__SOFTWARE__Microsoft__MSLicensing__HardwareID__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE__SOFTWARE__Microsoft__MSLicensing__Store__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__WinRAR__ArcHistory__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE__SYSTEM__ControlSet001__Services__bam__State__UserSettings__S_1_5_21_1282084573_1681065996_3115981261_1001__va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__Microsoft__Windows__CurrentVersion__Explorer__FeatureUsage__ShowJumpView__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__Classes__Local_Settings__Software__Microsoft__Windows__Shell__MuiCache__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE__SYSTEM__ControlSet001__Services__bam__State__UserSettings__S_1_5_21_332004695_2829936588_140372829_1002__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CLASSES_ROOT__Local_Settings__Software__Microsoft__Windows__Shell__MuiCache__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__Classes__Local_Settings__Software__Microsoft__Windows__Shell__MuiCache__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__Microsoft__Windows_NT__CurrentVersion__AppCompatFlags__Compatibility_Assistant__Store__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_tempor1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_tmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_ff.tmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_history
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_cookies
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_recent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_spool_printers
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX_SubProcess_chrome.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX_SubProcess_game.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX_SubProcess_game_372.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX_SubProcess_game_1868.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_botan.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_asi_five.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_steam.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_steam_api64.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenGame.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_profiles.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_cfx_curl_x86_64.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_caches.XML
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_adhesive.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret