Function at 0x1400016d0
Capabilities:
Execute command
Self delete

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 3
call fcn.140002350
lea rcx, str.RD__S__Q__temp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.MKDIR__temp_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.takeown__f__temp___r__d_y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.takeown__f_C:_Windows_Temp__r__d_y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.RD__S__Q_C:_Windows_Temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.MKDIR_C:_Windows_Temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.takeown__f_C:_Windows_Temp__r__d_y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.takeown__f__temp___r__d_y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14005f1d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_wuauserv
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_UsoSvc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__s__q_C:_Windows_SoftwareDistribution
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.md_C:_Windows_SoftwareDistribution
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:_Windows_Prefetch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__S__Q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__S__Q_C:_Windows_Prefetch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:_ProgramData_Microsoft_Windows_WER_ReportArchive
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del___S__Q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__S__Q_C:_ProgramData_Microsoft_Windows_WER_ReportArchive
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd__APPDATA__Microsoft_Windows_Recent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del___S__Q
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__S__Q__APPDATA__Microsoft_Windows_Recent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__DigitalEntitlements
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__userprofile__AppData_Roaming_CitizenFX
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_Browser
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_dunno
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_priv
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_servers
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_subprocess
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_unconfirmed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q__LocalAppData__FiveM_FiveM.app_cache_authbrowser
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_cache_crashometry
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_cache_launcher_skip
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_cache_launcher_skip_mtl2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_crashes.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_logs.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_mods.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_discord.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_Steam.exe__start_Steam.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.set_hostspath_windir__System32_drivers_etc_hosts
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_127.0.0.1_xboxlive.com_____hostspath_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_127.0.0.1_user.auth.xboxlive.com_____hostspath_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_127.0.0.1_presence_heartbeat.xboxlive.com_____hostspath_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE__SOFTWARE__Microsoft__MSLicensing__HardwareID__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE__SOFTWARE__Microsoft__MSLicensing__Store__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__WinRAR__ArcHistory__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE__SYSTEM__ControlSet001__Services__bam__State__UserSettings__S_1_5_21_1282084573_1681065996_3115981261_1001__va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__Microsoft__Windows__CurrentVersion__Explorer__FeatureUsage__ShowJumpView__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__Classes__Local_Settings__Software__Microsoft__Windows__Shell__MuiCache__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_LOCAL_MACHINE__SYSTEM__ControlSet001__Services__bam__State__UserSettings__S_1_5_21_332004695_2829936588_140372829_1002__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CLASSES_ROOT__Local_Settings__Software__Microsoft__Windows__Shell__MuiCache__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__Classes__Local_Settings__Software__Microsoft__Windows__Shell__MuiCache__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE_HKEY_CURRENT_USER__Software__Microsoft__Windows_NT__CurrentVersion__AppCompatFlags__Compatibility_Assistant__Store__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_tempor1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_temp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_tmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_ff.tmp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_history
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_cookies
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_recent
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.deltree__y_c:_windows_spool_printers
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX_SubProcess_chrome.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX_SubProcess_game.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX_SubProcess_game_372.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX_SubProcess_game_1868.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_botan.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_asi_five.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_steam.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_steam_api64.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenGame.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_profiles.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_cfx_curl_x86_64.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_CitizenFX.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_caches.XML
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__q__f__LocalAppData__FiveM_FiveM.app_adhesive.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_explorer.exe__start_explorer
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret