Function at 0x1400015d0
Capabilities:
Check if file exists
Delete directory
Delete file
Encode data using xor
Execute command
Log keystrokes via polling
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x520
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x518], rax
xor r14d, r14d
mov r12d, r14d
mov dword [rsp + 0x50], r14d
mov edx, 0x320
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
movsd xmm0, qword [str.wWYYW_eoIQM_A]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x1400069e8]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x1400069ec]
mov byte [rsp + 0x4c], al
mov r8d, r14d
cmp dword [0x14000a088], 2
jl 0x14000174d
movdqa xmm4, xmmword [0x140006b60]
movdqa xmm2, xmmword [0x140006b10]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140006b30]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140006b40]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.5555555555555555]
movd xmm0, dword [str.wWYYW_eoIQM_A]
xorps xmm2, xmm0
movd dword [rsp + 0x40], xmm2
movdqa xmm3, xmmword [0x140006b20]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140006b30]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140006b40]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.5555555555555555]
movd xmm0, dword [rsp + 0x44]
xorps xmm2, xmm0
movd dword [rsp + 0x44], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rsp + 0x40]
add r9, rax
nop dword [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x140001760
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe8]
call fcn.140003360
nop
lea rcx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 0xf
cmova rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, [0x140006548]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400038f0
mov rcx, rax
lea rdx, [0x140006559]
call fcn.1400038f0
mov rcx, rax
lea rdx, str.____Waiting_For_Lobby_FiveM...
call fcn.1400038f0
mov rcx, rax
lea rdx, [0x1400065b4]
call fcn.1400038f0
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140001810
lea rcx, [0x14000655c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Press__F10__For_Unban_FiveM_in_Lobby_Menu
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400038f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000655c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001810
lea rcx, [0x14000655c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x220], xmm0
movdqa xmm1, xmmword [0x140006a80]
movdqu xmmword [rsp + 0x230], xmm1
movsd xmm0, qword [str.discord.dll]
movsd qword [rsp + 0x220], xmm0
movzx eax, word [0x140006630]
mov word [rsp + 0x228], ax
movzx eax, byte [0x140006632]
mov byte [rsp + 0x22a], al
mov byte [rsp + 0x22b], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x250], xmm1
mov ecx, 0x20
call fcn.140004160
mov rdx, rax
mov qword [rsp + 0x240], rax
movdqa xmm0, xmmword [0x140006ae0]
movdqu xmmword [rsp + 0x250], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_chrome.bin]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x140006648]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140006650]
mov dword [rax + 0x18], ecx
movzx eax, word [0x140006654]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x140006656]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x270], xmm1
mov ecx, 0x20
call fcn.140004160
mov rdx, rax
mov qword [rsp + 0x260], rax
movdqa xmm0, xmmword [0x140006ad0]
movdqu xmmword [rsp + 0x270], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game.bin]
movups xmmword [rax], xmm1
movsd xmm0, qword [0x140006668]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140006670]
mov dword [rax + 0x18], ecx
movzx eax, byte [0x140006674]
mov byte [rdx + 0x1c], al
mov byte [rdx + 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x280], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x290], xmm1
mov ecx, 0x30
call fcn.140004160
mov qword [rsp + 0x280], rax
movdqa xmm0, xmmword [0x140006af0]
movdqu xmmword [rsp + 0x290], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_372.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140006688]
movups xmmword [rax + 0x10], xmm0
movzx ecx, byte [0x140006698]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2b0], xmm1
mov ecx, 0x30
call fcn.140004160
mov qword [rsp + 0x2a0], rax
movdqa xmm0, xmmword [0x140006b00]
movdqu xmmword [rsp + 0x2b0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_1604.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400066b0]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x1400066c0]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2d0], xmm1
mov ecx, 0x30
call fcn.140004160
mov qword [rsp + 0x2c0], rax
movdqa xmm0, xmmword [0x140006b00]
movdqu xmmword [rsp + 0x2d0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_1868.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x1400066d8]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x1400066e8]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x2e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2f0], xmm1
mov ecx, 0x30
call fcn.140004160
mov qword [rsp + 0x2e0], rax
movdqa xmm0, xmmword [0x140006b00]
movdqu xmmword [rsp + 0x2f0], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_2060.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140006700]
movups xmmword [rax + 0x10], xmm0
movzx edx, word [0x140006710]
mov word [rax + 0x20], dx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x300], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x310], xmm1
mov ecx, 0x30
call fcn.140004160
mov qword [rsp + 0x300], rax
movdqa xmm0, xmmword [0x140006b00]
movdqu xmmword [rsp + 0x310], xmm0
movups xmm1, xmmword [str.CitizenFX_SubProcess_game_2189.bin]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140006728]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x140006738]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x320], xmm0
movdqa xmm1, xmmword [0x140006a60]
movdqu xmmword [rsp + 0x330], xmm1
movsd xmm0, qword [str.botan.dll]
movsd qword [rsp + 0x320], xmm0
movzx eax, byte [0x140006748]
mov byte [rsp + 0x328], al
mov byte [rsp + 0x329], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x340], xmm0
movdqa xmm1, xmmword [0x140006a90]
movdqu xmmword [rsp + 0x350], xmm1
movsd xmm0, qword [str.asi_five.dll]
movsd qword [rsp + 0x340], xmm0
mov eax, dword [0x140006758]
mov dword [rsp + 0x348], eax
mov byte [rsp + 0x34c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x360], xmm0
movdqa xmm1, xmmword [0x140006a60]
movdqu xmmword [rsp + 0x370], xmm1
movsd xmm0, qword [str.steam.dll]
movsd qword [rsp + 0x360], xmm0
movzx eax, byte [0x140006768]
mov byte [rsp + 0x368], al
mov byte [rsp + 0x369], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x380], xmm0
movdqa xmm1, xmmword [0x140006ab0]
movdqu xmmword [rsp + 0x390], xmm1
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x380], xmm0
mov eax, dword [0x140006778]
mov dword [rsp + 0x388], eax
movzx eax, word [0x14000677c]
mov word [rsp + 0x38c], ax
movzx eax, byte [0x14000677e]
mov byte [rsp + 0x38e], al
mov byte [rsp + 0x38f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3a0], xmm0
movdqu xmmword [rsp + 0x3b0], xmm1
movsd xmm0, qword [str.CitizenGame.dll]
movsd qword [rsp + 0x3a0], xmm0
mov eax, dword [0x140006788]
mov dword [rsp + 0x3a8], eax
movzx eax, word [0x14000678c]
mov word [rsp + 0x3ac], ax
movzx eax, byte [0x14000678e]
mov byte [rsp + 0x3ae], al
mov byte [rsp + 0x3af], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3c0], xmm0
movdqa xmm1, xmmword [0x140006a90]
movdqu xmmword [rsp + 0x3d0], xmm1
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x3c0], xmm0
mov eax, dword [0x140006798]
mov dword [rsp + 0x3c8], eax
mov byte [rsp + 0x3cc], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x3e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x3f0], xmm1
mov ecx, 0x20
call fcn.140004160
mov qword [rsp + 0x3e0], rax
movdqa xmm0, xmmword [0x140006ac0]
movdqu xmmword [rsp + 0x3f0], xmm0
movups xmm1, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm1
movzx ecx, word [0x1400067b0]
mov word [rax + 0x10], cx
movzx ecx, byte [0x1400067b2]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x400], xmm0
movdqa xmm1, xmmword [0x140006aa0]
movdqu xmmword [rsp + 0x410], xmm1
movsd xmm0, qword [str.CitizenFX.ini]
movsd qword [rsp + 0x400], xmm0
mov eax, dword [0x1400067c0]
mov dword [rsp + 0x408], eax
movzx eax, byte [0x1400067c4]
mov byte [rsp + 0x40c], al
mov byte [rsp + 0x40d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x420], xmm0
movdqa xmm1, xmmword [0x140006a70]
movdqu xmmword [rsp + 0x430], xmm1
movsd xmm0, qword [str.caches.XML]
movsd qword [rsp + 0x420], xmm0
movzx eax, word [0x1400067d0]
mov word [rsp + 0x428], ax
mov byte [rsp + 0x42a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x440], xmm0
movdqa xmm1, xmmword [0x140006a90]
movdqu xmmword [rsp + 0x450], xmm1
movsd xmm0, qword [str.adhesive.dll]
movsd qword [rsp + 0x440], xmm0
mov eax, dword [0x1400067e0]
mov dword [rsp + 0x448], eax
mov byte [rsp + 0x44c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x460], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x470], xmm1
mov ecx, 0x20
call fcn.140004160
mov qword [rsp + 0x460], rax
movdqa xmm0, xmmword [0x140006ac0]
movdqu xmmword [rsp + 0x470], xmm0
movups xmm1, xmmword [str.cfx_curl_x86_64.dll]
movups xmmword [rax], xmm1
movzx ecx, word [0x1400067b0]
mov word [rax + 0x10], cx
movzx ecx, byte [0x1400067b2]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x480], xmm0
movdqa xmm1, xmmword [0x140006ab0]
movdqu xmmword [rsp + 0x490], xmm1
movsd xmm0, qword [str.steam_api64.dll]
movsd qword [rsp + 0x480], xmm0
mov eax, dword [0x140006778]
mov dword [rsp + 0x488], eax
movzx eax, word [0x14000677c]
mov word [rsp + 0x48c], ax
movzx eax, byte [0x14000677e]
mov byte [rsp + 0x48e], al
mov byte [rsp + 0x48f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x4a0], xmm0
movdqa xmm1, xmmword [0x140006a90]
movdqu xmmword [rsp + 0x4b0], xmm1
movsd xmm0, qword [str.profiles.dll]
movsd qword [rsp + 0x4a0], xmm0
mov eax, dword [0x140006798]
mov dword [rsp + 0x4a8], eax
mov byte [rsp + 0x4ac], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x4c0], xmm0
movdqa xmm1, xmmword [0x140006a40]
movdqu xmmword [rsp + 0x4d0], xmm1
mov dword [rsp + 0x4c0], 0x73676f6c
mov byte [rsp + 0x4c4], 0
movups xmmword [rsp + 0x4e0], xmm0
movdqa xmm1, xmmword [0x140006a50]
movdqu xmmword [rsp + 0x4f0], xmm1
mov rax, qword [str.crashes]
mov dword [rsp + 0x4e0], eax
movzx eax, word [0x1400067ec]
mov word [rsp + 0x4e4], ax
movzx eax, byte [0x1400067ee]
mov byte [rsp + 0x4e6], al
mov byte [rsp + 0x4e7], 0
lea rdi, [rsp + 0x220]
movabs r15, 0x7fffffffffffffff
mov r13d, 0xf
lea rdx, str.FiveM.app_
lea rax, [rsp + 0x500]
cmp rdi, rax
je 0x140002279
mov rcx, qword [0x14000aa38]
mov rax, r15
sub rax, rcx
cmp rax, 0xb
jae 0x140002035
call fcn.140001440
lea r9, [0x14000aa28]
cmp qword [0x14000aa40], 0xf
cmova r9, qword [0x14000aa28]
mov qword [rsp + 0x30], 0xb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0xa8]
call fcn.140003f90
or r12d, 1
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14000207d
mov r9, qword [rdi]
mov rsi, qword [rdi + 0x10]
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1400020dc
lea rax, [rcx + rsi]
mov qword [rsp + 0xb8], rax
lea rbx, [rsp + 0xa8]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0xa8]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
lea rax, [rsp + 0xa8]
jmp 0x1400020f1
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0xa8]
call fcn.140003da0
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xc8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xd8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r13
mov byte [rax], 0
or r12d, 2
mov rdx, qword [rsp + 0xc0]
cmp rdx, 0xf
jbe 0x140002178
inc rdx
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002173
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002173
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400044ac
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xc0], r13
mov byte [rsp + 0xa8], 0
lea rcx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0xf
cmova rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x14000222a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14000222a
lea rcx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0xf
cmova rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14000222a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000222a
lea r8, [rsp + 0xc8]
lea rdx, str.Error_deleting_file:
lea rcx, [rsp + 0x88]
call fcn.140003ac0
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140001460
lea rdx, [0x140008008]
lea rcx, [rsp + 0x58]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0xf
jbe 0x140002270
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000226b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000226b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400044ac
add rdi, 0x20
jmp 0x140002005
lea r9, [fcn.140003300]
mov edx, 0x20
lea r8d, [rdx - 9]
lea rcx, [rsp + 0x220]
call fcn.14000419c
nop
jmp 0x1400022aa
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xb8], xmm1
lea rdi, [0x14000aa08]
cmp qword [0x14000aa20], 0xf
cmova rdi, qword [0x14000aa08]
mov rbx, qword [0x14000aa18]
cmp rbx, r15
jbe 0x1400022e9
call fcn.140001440
cmp rbx, 0xf
ja 0x14000230f
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], r13
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0xa8], xmm0
jmp 0x1400023b1
mov rax, rbx
or rax, 0xf
cmp rax, r15
jbe 0x140002344
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004160
test rax, rax
je 0x14000236e
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140002382
mov r15, rax
mov ecx, 0x16
cmp rax, rcx
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140002375
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x140002329
call fcn.1400013a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002382
call fcn.140004160
mov r14, rax
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], r15
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r13, qword [rsp + 0xc0]
lea rcx, [rsp + 0xa8]
cmp r13, 0xf
cmova rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140002417
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140002417
lea r8, [rsp + 0xa8]
lea rdx, str.Error_deleting_directory:
lea rcx, [rsp + 0x88]
call fcn.140003ac0
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140001460
lea rdx, [0x140008008]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [rsp + 0xa8]
call fcn.140003300
nop
lea rdx, str.C:WindowsSystem32driversetchosts
lea rcx, [rsp + 0xa8]
call fcn.140003360
nop
lea rcx, [rsp + 0x110]
call fcn.1400025f0
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x110]
call fcn.1400032b0
nop
lea rcx, [rsp + 0x110]
call fcn.1400032a0
test al, al
je 0x1400024b8
lea rdx, str.127.0.0.1_xboxlive.com_n
lea rcx, [rsp + 0x110]
call fcn.1400038f0
lea rdx, str.127.0.0.1_user.auth.xboxlive.com_n
lea rcx, [rsp + 0x110]
call fcn.1400038f0
lea rdx, str.127.0.0.1_presence_heartbeat.xboxlive.com_n
lea rcx, [rsp + 0x110]
call fcn.1400038f0
lea rcx, [rsp + 0x110]
call fcn.140003260
nop
lea rcx, [rsp + 0x110]
call fcn.140002530
nop
lea rcx, [rsp + 0xa8]
call fcn.140003300
nop
mov edx, 0x258
lea ecx, [rdx - 0x64]
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, str.____Unban_FiveM_successfully
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400038f0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x40040
lea r8, str.Banana_Store
lea rdx, str.Unban_FiveM_successfully
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3