Function at 0x1400024c0
Capabilities:
Create process on windows
Execute command
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140005538]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
lea rdx, [0x140005538]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
lea rdx, str._ne_90m_Loading..._:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
mov rcx, rax
lea rdx, str.e_93m
call fcn.140003140
mov rcx, rax
lea rdx, str.Xbox_Checking...
call fcn.140003140
mov rcx, rax
lea rdx, str._e_90m_e_92m__e_90m_
call fcn.140003140
mov ecx, 0x8fc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._ne_90m_Loading..._:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
mov rcx, rax
lea rdx, str.e_93m
call fcn.140003140
mov rcx, rax
lea rdx, str.FiveM_Checking....
call fcn.140003140
mov rcx, rax
lea rdx, str._e_90m_e_92m__e_90m_
call fcn.140003140
mov ecx, 0x8fc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._ne_90m_Loading..._:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
mov rcx, rax
lea rdx, str.e_93m
call fcn.140003140
mov rcx, rax
lea rdx, str.Loader_Checking_Spoofer....
call fcn.140003140
mov rcx, rax
lea rdx, str._e_90m_e_92m__e_90m_
call fcn.140003140
mov ecx, 0x8fc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__Command___Get_AppxPackage__AllUsers_xbox__Remove_AppxPackage_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___LocalAppData_DigitalEntitlements_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___LocalAppData_D3DSCache_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___LocalAppData_Rockstar_Games_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_steam.exe__t
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140005538]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
lea rdx, [0x140005538]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
lea rdx, str._ne_90m_Loading..._:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
mov rcx, rax
lea rdx, str.e_36m
call fcn.140003140
mov rcx, rax
lea rdx, str.Open_Waiting_For_Lobby_e_35mFiveM...
call fcn.140003140
mov rcx, rax
lea rdx, str._e_90m_e_34m__e_90m_
call fcn.140003140
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.fivem:__
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop word [rax + rax]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140002700
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x140005538]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
lea rdx, [0x140005538]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
lea rdx, str._ne_90m_Loading..._:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003140
mov rcx, rax
lea rdx, str.e_93m
call fcn.140003140
mov rcx, rax
lea rdx, str.Press_F10_For_Sp00fer_e_35mFiveM.exe_e_93min_Lobby_Menu
call fcn.140003140
mov rcx, rax
lea rdx, str._e_90m_e_92m__e_90m_
call fcn.140003140
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140002700
lea rcx, [0x140005534]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x1f4
mov ecx, 0x398
call qword [sym.imp.KERNEL32.dll_Beep]
mov r9d, 0x40040
lea r8, str.info
lea rdx, str.Enjoy_using_my_sp00f__unban_FiveM.exe
xor ecx, ecx
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_MessageBoxW]