Function at 0x140015c10
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
sub rsp, 0x1b0
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401c4080]
xor rax, rsp
mov qword [rbp + 0x120], rax
call fcn.140012fe0
mov rcx, rax
call fcn.140013070
test eax, eax
je 0x140015c7b
mov dword [0x1401ffd48], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401ffd50], rax
call fcn.140012fe0
test rax, rax
je 0x1400165fd
mov dword [rbp + 0x60], 0x50
mov dword [rbp + 0x64], 0x40
lea rax, [0x140020cf0]
mov qword [rbp + 0x68], rax
xor r12d, r12d
mov qword [rbp + 0x70], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x90], xmm1
lea r14, [0x1401a02a8]
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], r12
lea rcx, [rbp + 0x60]
call qword [sym.imp.USER32.dll_RegisterClassExA]
cvttss2si edi, dword [0x1401cd6d0]
cvttss2si esi, dword [0x1401cd6cc]
mov r15d, 1
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x1401cd6d0]
mulss xmm0, dword [0x1401a8fdc]
subss xmm1, xmm0
cvttss2si ebx, xmm1
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x1401cd6cc]
mulss xmm0, dword [0x1401a8fdc]
subss xmm1, xmm0
cvttss2si ecx, xmm1
mov qword [rsp + 0x58], r12
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ecx
mov r9d, 0x80000000
mov r8, r14
mov rdx, qword [rbp + 0xa0]
mov ecx, 0x80
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rdi, rax
mov qword [0x1401cd6d8], rax
movabs rax, 0x9a07873bca4ebf96
mov qword [rbp + 0xb0], rax
mov rcx, qword [rbp + 0xb0]
mov qword [rbp + 0xd0], rcx
movabs rax, 0x4d266a7dc416c19c
mov qword [rbp + 0xb0], rax
mov rcx, qword [rbp + 0xb0]
mov qword [rbp + 0xd8], rcx
movabs rsi, 0xfe29b508b82bcce3
mov qword [rbp + 0xb0], rsi
mov rcx, qword [rbp + 0xb0]
mov qword [rbp + 0xe0], rcx
movabs r14, 0x4d266a7dc416adf0
mov qword [rbp + 0xb0], r14
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xe8], rax
movdqa xmm0, xmmword [rbp + 0xd0]
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0xd0], xmm0
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140015fad
movabs rax, 0x914ddb61ef5fa9b0
mov qword [rbp + 0xb0], rax
mov rcx, qword [rbp + 0xb0]
mov qword [rbp + 0xe0], rcx
movabs rax, 0x2455050da979ee87
mov qword [rbp + 0xb0], rax
mov rcx, qword [rbp + 0xb0]
mov qword [rbp + 0xe8], rcx
movabs rax, 0xac3b62c73af061c9
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xf0], rax
movabs rax, 0x694ebb465eb48a23
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0xb0], rsi
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xb0], r14
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x108], rax
movabs rax, 0xde4f1686549f08bd
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x110], rax
movabs rax, 0x694ebb232ac1e84a
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rdx, [rbp + 0xe0]
mov rcx, rbx
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140015fa4
movdqa xmm0, xmmword [reloc.WS2_32.dll_closesocket]
movdqu xmmword [rbp + 0xb0], xmm0
mov dword [rbp + 0x100], reloc.WS2_32.dll_send
lea rcx, [rbp + 0xb0]
mov qword [rbp + 0x108], rcx
mov dword [rbp + 0x110], reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x100]
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movdqa xmm0, xmmword [0x1401a91c0]
movdqu xmmword [rbp + 0xc0], xmm0
lea rdx, [rbp + 0xc0]
mov rcx, qword [0x1401cd6d8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rax, qword [0x1401cd6d8]
mov qword [rbp + 0x24], r12
mov qword [rbp + 0x38], 2
mov qword [rbp + 0x50], 2
mov qword [rbp + 0x10], r12
mov dword [rbp + 0x20], Ordinal_30
mov dword [rbp + 0x18], reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0x1c], r15d
mov dword [rbp + 0x34], reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x2c], r15
mov qword [rbp + 0x48], r15
mov dword [rbp + 0xd0], 0xb000
mov dword [rbp + 0xd4], 0xa000
lea rax, [0x1401cd708]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x50], rax
lea rax, [0x1401cd700]
mov qword [rsp + 0x48], rax
lea rax, [0x1401cd710]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x1400160d9
call fcn.140020d80
mov rdx, qword [rbp + 0x78]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.14012ed90
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [0x1401cd710]
mov rax, qword [rcx]
lea r9, [rbp + 0xb0]
lea r8, [0x1401a15e8]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [0x1401cd700]
mov rax, qword [rcx]
lea r9, [0x1401cd718]
xor r8d, r8d
mov rdx, qword [rbp + 0xb0]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0xb0]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov edx, 0xa
mov rcx, qword [0x1401cd6d8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401cd6d8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, qword [0x1401cd6d8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, qword [0x1401ceac8]
test rbx, rbx
je 0x14001617e
inc dword [rbx + 0xf0]
mov ecx, 0x5e78
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp + 0xb0], rax
lea rcx, [rbp]
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x1400161b3
xor edx, edx
mov rcx, rax
call fcn.140026050
jmp 0x1400161b6
mov rax, r12
mov qword [0x1401ceac8], rax
call fcn.140029c40
test rbx, rbx
je 0x1400161ce
mov qword [0x1401ceac8], rbx
call fcn.1400170c0
mov rcx, qword [0x1401cd6d8]
call fcn.140050930
mov r14, qword [0x1401cd708]
mov rsi, qword [0x1401cd700]
mov rdi, qword [0x1401ceac8]
test rdi, rdi
je 0x1400161ff
inc dword [rdi + 0xf0]
mov ecx, 0x78
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140016240
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov dword [rax + 0x70], 0x1388
mov dword [rax + 0x74], 0x2710
jmp 0x140016243
mov rbx, r12
mov qword [rdi + 0x98], rbx
lea rax, str.imgui_impl_dx11
mov qword [rdi + 0x88], rax
or dword [rdi + 0xc], 8
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xb0], r12
mov rax, qword [rsi]
lea r8, [rbp + 0xe0]
lea rdx, [0x1401a74f8]
mov rcx, rsi
call qword [rax]
test eax, eax
jne 0x1400162db
mov rcx, qword [rbp + 0xe0]
mov rax, qword [rcx]
lea r8, [rbp + 0xd0]
lea rdx, [0x1401a7508]
call qword [rax + Ordinal_50]
test eax, eax
jne 0x1400162db
mov rcx, qword [rbp + 0xd0]
mov rax, qword [rcx]
lea r8, [rbp + 0xb0]
lea rdx, [0x1401a7518]
call qword [rax + Ordinal_50]
test eax, eax
jne 0x1400162db
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov rax, qword [rbp + 0xb0]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbp + 0xe0]
test rcx, rcx
je 0x1400162ed
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0xd0]
test rcx, rcx
je 0x1400162ff
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor bl, bl
mov dil, 1
nop word [rax + rax]
movzx esi, dil
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001637a
nop
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_DispatchMessageW]
movzx ebx, bl
cmp dword [rbp + 0x18], 0x12
cmove ebx, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140016340
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400163ab
test dil, dil
sete dil
mov rcx, qword [0x1401cd6d8]
test sil, sil
jne 0x1400163a3
mov edx, 5
jmp 0x1400163a5
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [0x1401ceac8]
test rax, rax
je 0x1400163c0
mov rcx, qword [rax + 0x98]
jmp 0x1400163c3
mov rcx, r12
cmp qword [rcx + 0x48], 0
jne 0x1400163cf
call fcn.1400502d0
call fcn.1400512b0
call fcn.14002c4c0
cmp byte [0x1401cd6c5], 0
je 0x1400163ee
lea rcx, [0x1401cd650]
call fcn.1400176d0
cmp byte [0x1401cd6c6], 0
je 0x140016403
lea rcx, [0x1401cd650]
call fcn.140019840
cmp byte [0x1401cd6c7], 0
je 0x140016418
lea rcx, [0x1401cd650]
call fcn.14001d6f0
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140016426
call fcn.14001e1a0
cmp byte [0x1401cd6c8], 0
je 0x14001643b
lea rcx, [0x1401cd650]
call fcn.14001e950
cmp byte [0x1401cd6c9], 0
je 0x140016450
lea rcx, [0x1401cd650]
call fcn.14001f300
call fcn.14002e5d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov rcx, qword [0x1401cd708]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1401cd718]
mov edx, r15d
call qword [rax + 0x108]
mov rcx, qword [0x1401cd708]
mov rax, qword [rcx]
lea r8, [rbp + 0x100]
mov rdx, qword [0x1401cd718]
call qword [rax + 0x190]
mov rax, qword [0x1401ceac8]
mov rcx, qword [rax + 0x48c8]
mov rax, qword [rcx]
add rax, 0x48
mov rcx, r12
cmp byte [rax], r12b
cmovne rcx, rax
call fcn.14004f860
mov rcx, qword [0x1401cd710]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, r15d
call qword [rax + 0x40]
test bl, bl
je 0x140016320
mov rbx, qword [0x1401ceac8]
test rbx, rbx
je 0x1400164ee
mov rdi, qword [rbx + 0x98]
jmp 0x1400164f1
mov rdi, r12
call fcn.140050810
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140016505
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140016513
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140016522
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x88], r12
mov qword [rbx + 0x98], r12
and dword [rbx + 0xc], 0xfffffff7
mov rax, qword [0x1401ceac8]
test rax, rax
je 0x140016546
dec dword [rax + 0xf0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x1401ceac8]
test rax, rax
je 0x140016564
mov rdi, qword [rax + 0x90]
jmp 0x140016567
mov rdi, r12
lea rbx, [rax + 8]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x140016581
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1401ceac8]
mov qword [rbx + 0x78], r12
mov qword [rbx + 0x88], r12
and dword [rbx + 4], 0xfffffff8
test rax, rax
je 0x14001659b
dec dword [rax + 0xf0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x1401ceac8]
mov qword [0x1401ceac8], rbx
call fcn.14002a080
mov qword [0x1401ceac8], r12
test rbx, rbx
je 0x1400165e6
mov rcx, rbx
call fcn.14003f850
mov rax, qword [0x1401ceac8]
test rax, rax
je 0x1400165dd
dec dword [rax + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.140020d80
mov rcx, qword [0x1401cd6d8]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x140016098
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]