Function at 0x14004f250
Capabilities:
Get token membership
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140094fc0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov word [rbp + 0x1b], 0x500
lea rax, [rbp + 0x1f]
mov dword [rbp + 0x2f], edi
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x17]
mov dword [rsp + 0x48], edi
mov r9d, 0x220
mov dword [rsp + 0x40], edi
lea r8d, [rdi + 0x20]
mov dword [rsp + 0x38], edi
mov dl, 2
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rbp + 0x1f], rdi
mov dword [rbp + 0x17], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14004f2d7
mov rdx, qword [rbp + 0x1f]
lea r8, [rbp + 0x2f]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp dword [rbp + 0x2f], edi
jne 0x14004f30f
lea rdx, str.This_program_must_be_run_as_an_administrator_
call fcn.14000a1e0
lea rdx, [0x14000a3b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov eax, 1
jmp 0x14004f717
lea rdx, str.Insert:_Toggle_Menu
mov qword [rsp + 0xb0], rbx
call fcn.14000a1e0
lea rdx, [0x14000a3b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Delete:_Exit
call fcn.14000a1e0
lea rdx, [0x14000a3b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Counter_Strike_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
mov qword [0x140098c00], rax
lea rdx, [rbp + 0x37]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rbp + 0x1f]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp + 0x27]
mov r9d, dword [rbp + 0x37]
mov r8d, dword [rbp + 0x23]
mov eax, dword [rbp + 0x1f]
sub eax, ecx
sub ecx, dword [rbp + 0x1f]
sub eax, r9d
mov dword [0x14009500c], ecx
add eax, dword [rbp + 0x3f]
mov ecx, dword [rbp + 0x2b]
cdq
sub ecx, r8d
sub eax, edx
sub r8d, dword [rbp + 0x2b]
sar eax, 1
sub r8d, eax
mov dword [0x140095008], ecx
add r8d, dword [rbp + 0x43]
mov dword [0x140098bec], r8d
lea ecx, [r9 + rax]
mov dword [0x140098be8], ecx
call fcn.140053f10
mov edx, 1
mov ecx, 0x2000d
call fcn.140052ca0
mov edx, 1
mov ecx, 0x2000a
call fcn.140052ca0
xor edx, edx
mov ecx, 0x20005
call fcn.140052ca0
mov edx, 1
mov ecx, 0x20001
call fcn.140052ca0
mov edx, 1
mov ecx, 0x2200c
call fcn.140052ca0
mov edx, 1
mov ecx, 0x20007
call fcn.140052ca0
mov edx, dword [0x140095008]
lea r8, str.CS2External
mov ecx, dword [0x14009500c]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
call fcn.140052350
mov rcx, rax
mov qword [0x140098bf8], rax
call fcn.140059530
call fcn.14004f0a0
call fcn.140059500
mov rcx, rax
call fcn.140053000
test eax, eax
jne 0x14004f648
mov qword [rsp + 0xb8], rsi
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14004f640
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004f4ee
cmp byte [0x14009897c], dil
jne 0x14004f4f5
cmp byte [0x14009501f], dil
mov rcx, qword [0x1400989f8]
sete al
mov byte [0x14009897c], 1
mov byte [0x14009501f], al
mov byte [rcx + 0xe2], al
movzx eax, byte [0x14009501f]
mov byte [rcx + 0xe3], al
movzx eax, byte [0x14009501f]
mov byte [rcx + 0x58], al
jmp 0x14004f4f5
mov byte [0x14009897c], dil
cmp byte [0x14009501f], dil
mov r8d, edi
mov rcx, qword [0x140098bf8]
mov edx, 0x2000d
sete r8b
call fcn.140052b20
mov rbx, qword [0x140098c00]
lea rdx, [rbp + 0x37]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rbp + 0x1f]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp + 0x27]
mov r10d, dword [rbp + 0x37]
mov r8d, dword [rbp + 0x23]
mov eax, dword [rbp + 0x1f]
sub eax, ecx
sub ecx, dword [rbp + 0x1f]
sub eax, r10d
mov dword [0x14009500c], ecx
add eax, dword [rbp + 0x3f]
mov ecx, dword [rbp + 0x2b]
cdq
sub ecx, r8d
sub eax, edx
sub r8d, dword [rbp + 0x2b]
sar eax, 1
sub r8d, eax
mov dword [0x140095008], ecx
add r8d, dword [rbp + 0x43]
mov rcx, qword [0x140098bf8]
lea edx, [r10 + rax]
mov dword [0x140098bec], r8d
mov dword [0x140098be8], edx
call fcn.140052c40
mov r8d, dword [0x140095008]
mov edx, dword [0x14009500c]
mov rcx, qword [0x140098bf8]
call fcn.140052c70
call fcn.140052b00
mov ecx, 0x4000
call qword [sym.imp.OPENGL32.dll_glClear]
mov rbx, qword [0x1400989f8]
test rbx, rbx
je 0x14004f5cb
mov rbx, qword [rbx + 0xa0]
jmp 0x14004f5ce
mov rbx, rdi
cmp dword [rbx + 0x30], edi
jne 0x14004f5d8
call fcn.14003e5b0
cmp dword [rbx + 0x2c], edi
jne 0x14004f5e2
call fcn.14003e060
call fcn.14003cf30
call fcn.140014590
call fcn.14004fee0
call fcn.1400095b0
call fcn.140016370
mov rax, qword [0x1400989f8]
mov rcx, qword [rax + 0x4ba0]
mov rax, qword [rcx]
mov rcx, rdi
add rax, 0x50
cmp byte [rax], dil
cmovne rcx, rax
call fcn.14003d9f0
mov rcx, qword [0x140098bf8]
call fcn.1400595d0
call fcn.140059500
mov rcx, rax
call fcn.140053000
test eax, eax
je 0x14004f482
mov rsi, qword [rsp + 0xb8]
call fcn.14003d590
call fcn.14003c7c0
mov rbx, qword [0x1400989f8]
mov qword [0x1400989f8], rbx
call fcn.140012130
mov qword [0x1400989f8], rdi
test rbx, rbx
je 0x14004f6f1
mov rcx, rbx
call fcn.14002a2e0
mov r8, qword [0x1400989f8]
test r8, r8
je 0x14004f6e8
movsx rdx, word [r8 + 0x6228]
lea rcx, [r8 + 0x622c]
mov r9d, dword [r8 + 0x3fc0]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14004f6dd
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6228], cx
movsx rax, cx
lea rcx, [r8 + 0x622c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], edi
inc word [rcx + 6]
inc dword [r8 + 0x6224]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.1400540a0
mov rcx, qword [0x140098bf8]
call fcn.1400527d0
call fcn.1400540a0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov rbx, qword [rsp + 0xb0]
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140061870
mov rdi, qword [rsp + 0xc0]
add rsp, 0xa0
pop rbp
ret