Function at 0x140003e00
Capabilities:
Delete file
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r9d, 0x31
lea r8, str.Sirius_Diff
lea rdx, str.DEL____
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x140003e80
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400058b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [0x140007640]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r13d, r13d
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140003eeb
lea rcx, [0x140007640]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Rimuru1.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.Rimuru2.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.Rimuru3.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
jmp 0x140003ea1
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x140007640]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003ea1
lea rcx, [0x140007640]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x50], 0x3deb851f
mov word [rbp - 0x4c], 0x6e5c
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov r15, r13
mov qword [rbp - 0x20], r13
lea rcx, [rbp - 0x48]
call fcn.140001b10
lea rcx, [rbp - 0x30]
cmp rcx, rax
je 0x140003f78
mov r14, qword [rax]
mov qword [rbp - 0x30], r14
mov r12, qword [rax + 8]
mov qword [rbp - 0x28], r12
mov r15, qword [rax + 0x10]
mov qword [rbp - 0x20], r15
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
jmp 0x140003f80
mov r12, qword [rbp - 0x28]
mov r14, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140003fc6
mov rax, qword [rbp - 0x38]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004224
call fcn.14000590c
cmp r14, r12
jne 0x1400040c4
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
mov r8d, 6
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x48]
call fcn.1400012b0
mov rbx, rax
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x140004069
test r14, r14
je 0x140004047
sub r15, r14
sar r15, 3
lea rdx, [r15*8]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000403f
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000422b
mov rcx, r14
call fcn.14000590c
mov rax, qword [rbx]
mov qword [rbp - 0x30], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x28], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400040af
mov rax, qword [rbp - 0x38]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000422b
call fcn.14000590c
lea rcx, [rbp - 0x30]
call fcn.140001800
mov r15, qword [rbp - 0x20]
mov r12, qword [rbp - 0x28]
mov r14, qword [rbp - 0x30]
mov rsi, r14
cmp r14, r12
je 0x1400041e3
mov rdi, qword [rsi]
mov dword [rbp - 0x18], 0
call fcn.140001530
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140004112
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x18]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x14], 0x3deb851f
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x14]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400041d6
nop dword [rax]
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140004164
call fcn.140002cf0
mov ecx, 0x32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140004178
call fcn.140002fe0
mov ecx, 0x33
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000418c
call fcn.1400032d0
mov ecx, 0x34
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400041a0
call fcn.1400038d0
mov ecx, 0x35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400041be
call fcn.140003bd0
call fcn.140002a00
call fcn.1400035d0
xor edx, edx
lea rcx, str.grcWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140004150
add rsi, 8
cmp rsi, r12
jne 0x1400040d0
test r14, r14
je 0x140003ea1
sub r15, r14
and r15, 0xfffffffffffffff8
mov rax, r14
cmp r15, 0x1000
jb 0x140004214
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004232
mov rdx, r15
mov rcx, r14
call fcn.14000590c
jmp 0x140003ea1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3