Function at 0x1400015d0
Capabilities:
Execute command
Log keystrokes via polling
Parse pe header
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x40], rax
lea rcx, str.Kick_Close_Emo
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov edx, 0xffffffec
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov r9d, 2
mov r8b, 0xd7
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea rdx, str.Courier_New
lea rcx, [rsp + 0x40]
call fcn.140002320
nop
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0x30], eax
mov dword [rbp - 0x20], 0x54
mov dword [rbp - 0x18], 0x10000a
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r8, qword [rsp + 0x40]
mov edx, 0x20
lea rcx, [rbp - 0xc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
test eax, eax
jne 0x1400016f0
lea rdx, str.Failed_to_set_console_font.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140001735
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001730
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001730
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002f6c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov dword [rsp + 0x60], 0x140050
mov edx, dword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor r14d, r14d
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x6c], 0x13004f
lea r8, [rsp + 0x68]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
lea rdx, [rbp - 0x38]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x140
mov r9d, 0x280
mov r8d, dword [rbp - 0x34]
mov edx, dword [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, [0x140005590]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400028c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_n_n_n_n_n_________________
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x1400028f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Setting_Hotkey:
call fcn.1400024d0
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140002920
lea rcx, [0x140005590]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movzx ebx, byte [rsp + 0x30]
lea eax, [rbx - 0x41]
test al, 0xdf
je 0x14000197b
lea eax, [rbx - 0x42]
test al, 0xdf
je 0x140001977
lea eax, [rbx - 0x43]
test al, 0xdf
je 0x140001973
lea eax, [rbx - 0x44]
test al, 0xdf
je 0x14000196f
lea eax, [rbx - 0x45]
test al, 0xdf
je 0x14000196b
lea eax, [rbx - 0x46]
test al, 0xdf
je 0x140001967
lea eax, [rbx - 0x47]
test al, 0xdf
je 0x140001963
lea eax, [rbx - 0x48]
test al, 0xdf
je 0x14000195f
lea eax, [rbx - 0x49]
test al, 0xdf
je 0x14000195b
lea eax, [rbx - 0x4a]
test al, 0xdf
je 0x140001957
lea eax, [rbx - 0x4b]
test al, 0xdf
je 0x140001953
lea eax, [rbx - 0x4c]
test al, 0xdf
je 0x14000194f
lea eax, [rbx - 0x4d]
test al, 0xdf
je 0x14000194b
lea eax, [rbx - 0x4e]
test al, 0xdf
je 0x140001947
lea eax, [rbx - 0x4f]
test al, 0xdf
je 0x140001943
lea eax, [rbx - 0x50]
test al, 0xdf
je 0x14000193f
lea eax, [rbx - 0x51]
test al, 0xdf
je 0x14000193b
lea eax, [rbx - 0x52]
test al, 0xdf
je 0x140001937
lea eax, [rbx - 0x53]
test al, 0xdf
je 0x140001933
lea eax, [rbx - 0x54]
test al, 0xdf
je 0x14000192f
lea eax, [rbx - 0x55]
test al, 0xdf
je 0x14000192b
lea eax, [rbx - 0x56]
test al, 0xdf
je 0x140001927
lea eax, [rbx - 0x57]
test al, 0xdf
je 0x140001923
lea eax, [rbx - 0x58]
test al, 0xdf
je 0x14000191f
lea eax, [rbx - 0x59]
test al, 0xdf
je 0x14000191b
lea eax, [rbx - 0x5a]
test al, 0xdf
jne 0x14000197d
mov bl, 0x5a
jmp 0x14000197d
mov bl, 0x59
jmp 0x14000197d
mov bl, 0x58
jmp 0x14000197d
mov bl, 0x57
jmp 0x14000197d
mov bl, 0x56
jmp 0x14000197d
mov bl, 0x55
jmp 0x14000197d
mov bl, 0x54
jmp 0x14000197d
mov bl, 0x53
jmp 0x14000197d
mov bl, 0x52
jmp 0x14000197d
mov bl, 0x51
jmp 0x14000197d
mov bl, 0x50
jmp 0x14000197d
mov bl, 0x4f
jmp 0x14000197d
mov bl, 0x4e
jmp 0x14000197d
mov bl, 0x4d
jmp 0x14000197d
mov bl, 0x4c
jmp 0x14000197d
mov bl, 0x4b
jmp 0x14000197d
mov bl, 0x4a
jmp 0x14000197d
mov bl, 0x49
jmp 0x14000197d
mov bl, 0x48
jmp 0x14000197d
mov bl, 0x47
jmp 0x14000197d
mov bl, 0x46
jmp 0x14000197d
mov bl, 0x45
jmp 0x14000197d
mov bl, 0x44
jmp 0x14000197d
mov bl, 0x43
jmp 0x14000197d
mov bl, 0x42
jmp 0x14000197d
mov bl, 0x41
lea rcx, [0x140005590]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400028c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_n_n_n_n_n_________________
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x1400028f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Waiting
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x1400028c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.1___3_Minute_to_Setup_Program__n
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x60], 0x3ee0cd3e
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov qword [rbp - 0x70], r14
call fcn.140001430
mov edi, eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140001a51
lea rdx, str.awdawd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9, rsi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400011c0
lea rcx, [rbp - 0x80]
cmp rcx, rax
je 0x140001a90
mov rsi, qword [rax]
mov qword [rbp - 0x80], rsi
mov r12, qword [rax + 8]
mov qword [rbp - 0x78], r12
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x70], rcx
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x140001a98
mov r12, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x80]
mov qword [rbp - 0x38], rsi
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001ae7
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ae2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ae2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002f6c
mov dword [rsp + 0x60], 0x4a30dee0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
mov qword [rbp - 0x58], r14
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400011c0
lea rcx, [rbp - 0x68]
cmp rcx, rax
je 0x140001b4f
mov rdx, qword [rax]
mov qword [rsp + 0x38], rdx
mov qword [rbp - 0x68], rdx
mov r15, qword [rax + 8]
mov qword [rbp - 0x60], r15
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x58], rcx
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x140001b5c
mov r15, qword [rbp - 0x60]
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001ba7
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ba2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ba2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002f6c
mov dword [rsp + 0x60], 0xdb4149e8
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov qword [rbp - 0x40], r14
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400011c0
lea rcx, [rbp - 0x50]
cmp rcx, rax
je 0x140001c0c
mov r13, qword [rax]
mov qword [rbp - 0x50], r13
mov r14, qword [rax + 8]
mov qword [rbp - 0x48], r14
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x40], rcx
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
jmp 0x140001c14
mov r14, qword [rbp - 0x48]
mov r13, qword [rbp - 0x50]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001c57
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002f6c
lea rcx, [0x140005590]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400028c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._n_n_n_n_n_n_n_________________
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x1400028f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.HotKey_:
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x1400028c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
movzx edx, bl
call fcn.1400026b0
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400028c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._________________
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x1400028c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.3_Second_Hide_Program...
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400028c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str._________________
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x1400028c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Press
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x1400029e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.___Home__
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x1400028f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Exit_Program_n
call fcn.1400024d0
mov rcx, rax
lea rdx, [0x140002880]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, 3
nop dword [rax + rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
dec edi
test edi, edi
jg 0x140001dc0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x70], 0x3ee0cd3e
mov dword [rsp + 0x74], 0x4a30dee0
mov dword [rsp + 0x78], 0xdb4149e8
mov dword [rsp + 0x64], 0x5c1d4ec6
movsx eax, bl
mov dword [rsp + 0x68], eax
xor dil, dil
nop dword [rax]
movzx ebx, dil
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400021b1
test dil, dil
sete byte [rsp + 0x30]
test bl, bl
jne 0x140001ff1
mov edx, 0x12c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Beep]
mov rbx, rsi
cmp rsi, r12
je 0x140001ecc
nop dword [rax]
mov rsi, qword [rbx]
mov dword [rsp + 0x60], 0
call fcn.140001430
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001e98
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x64]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r12
jne 0x140001e50
mov rbx, qword [rsp + 0x38]
cmp rbx, r15
je 0x140001f5c
nop word [rax + rax]
mov rsi, qword [rbx]
mov dword [rsp + 0x60], 0
call fcn.140001430
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001f28
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x64]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r15
jne 0x140001ee0
mov rbx, r13
cmp r13, r14
je 0x1400021ac
nop dword [rax + rax]
mov rsi, qword [rbx]
mov dword [rsp + 0x60], 0
call fcn.140001430
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001fb8
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x64]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r14
jne 0x140001f70
jmp 0x1400021ac
mov edx, 0x1f4
mov ecx, 0x44c
call qword [sym.imp.KERNEL32.dll_Beep]
mov rbx, rsi
cmp rsi, r12
je 0x14000208c
nop dword [rax]
mov rsi, qword [rbx]
mov dword [rsp + 0x60], 0
call fcn.140001430
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140002058
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r12
jne 0x140002010
mov rbx, qword [rsp + 0x38]
cmp rbx, r15
je 0x14000211c
nop word [rax + rax]
mov rsi, qword [rbx]
mov dword [rsp + 0x60], 0
call fcn.140001430
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400020e8
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x74]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r15
jne 0x1400020a0
mov rbx, r13
cmp r13, r14
je 0x1400021ac
nop dword [rax + rax]
mov rsi, qword [rbx]
mov dword [rsp + 0x60], 0
call fcn.140001430
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140002178
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x78]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r14
jne 0x140002130
movzx edi, byte [rsp + 0x30]
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov rsi, qword [rbp - 0x38]
mov eax, dword [rsp + 0x68]
jns 0x140001e10
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3