Function at 0x1400039f0
Capabilities:
Log keystrokes via polling
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov edi, r15d
mov qword [rsp + 0x40], r15
mov esi, 0xf
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x30], dil
mov rbx, qword [0x140047e48]
mov r14, qword [0x140047e50]
cmp rbx, r14
je 0x140003b4f
nop dword [rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140003a7d
mov rdx, qword [rbx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140003a93
lea rcx, [rbp - 0x20]
call fcn.140006c50
lea rdx, [rbp - 0x20]
call fcn.1400022e0
mov eax, dword [0x140047df4]
mov dword [0x140047df0], eax
test eax, eax
jne 0x140003aca
add rbx, 0x20
cmp rbx, r14
jne 0x140003a70
jmp 0x140003b45
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x140003aef
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140003ae2
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140005990
lea rdx, str.Found_process_
lea rcx, [0x140046430]
call fcn.1400066e0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rax
call fcn.1400082b0
lea rdx, str._with_ID:
mov rcx, rax
call fcn.1400066e0
mov edx, dword [0x140047df0]
mov rcx, rax
call fcn.1400043d0
mov rcx, rax
call fcn.140006990
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
test rdi, rdi
je 0x140003df8
lea rcx, [rsp + 0x30]
cmp rsi, 0xf
seta r14b
mov rbx, qword [rsp + 0x30]
cmova rcx, rbx
cmp rdi, 0x14
jne 0x140003ba7
mov r8, rdi
lea rdx, str.FiveM_GTAProcess.exe
call fcn.1400319d0
test eax, eax
jne 0x140003ba7
mov dword [0x140047e20], 0x1efd4c8
mov dword [0x140047e1c], 0x247f840
lea rdx, str.Game_Version:_FiveM_GTAProcess.exe
jmp 0x140003dff
lea rcx, [rsp + 0x30]
test r14b, r14b
cmovne rcx, rbx
cmp rdi, 0x1a
jne 0x140003bec
mov r8, rdi
lea rdx, str.FiveM_b2060_GTAProcess.exe
call fcn.1400319d0
test eax, eax
jne 0x140003bec
mov dword [0x140047e20], 0x1ec3828
mov dword [0x140047e1c], 0x24c8858
lea rdx, str.Game_Version:_FiveM_b2060_GTAProcess.exe
jmp 0x140003dff
lea rcx, [rsp + 0x30]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 0x1a
jne 0x140003c32
mov r8, rdi
lea rdx, str.FiveM_b2189_GTAProcess.exe
call fcn.1400319d0
test eax, eax
jne 0x140003c32
mov dword [0x140047e20], 0x1ee18a8
mov dword [0x140047e1c], 0x24e6d90
lea rdx, str.Game_Version:_FiveM_b2189_GTAProcess.exe
jmp 0x140003dff
lea rcx, [rsp + 0x30]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 0x1a
jne 0x140003c78
mov r8, rdi
lea rdx, str.FiveM_b2372_GTAProcess.exe
call fcn.1400319d0
test eax, eax
jne 0x140003c78
mov dword [0x140047e20], 0x1f05208
mov dword [0x140047e1c], 0x252dcd8
lea rdx, str.Game_Version:_FiveM_b2372_GTAProcess.exe
jmp 0x140003dff
lea rcx, [rsp + 0x30]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 0x1a
jne 0x140003cbe
mov r8, rdi
lea rdx, str.FiveM_b2545_GTAProcess.exe
call fcn.1400319d0
test eax, eax
jne 0x140003cbe
mov dword [0x140047e20], 0x1f2e7a8
mov dword [0x140047e1c], 0x25667e8
lea rdx, str.Game_Version:_FiveM_b2545_GTAProcess.exe
jmp 0x140003dff
lea rcx, [rsp + 0x30]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 0x1a
jne 0x140003d04
mov r8, rdi
lea rdx, str.FiveM_b2612_GTAProcess.exe
call fcn.1400319d0
test eax, eax
jne 0x140003d04
mov dword [0x140047e20], 0x1f77ef0
mov dword [0x140047e1c], 0x2567db0
lea rdx, str.Game_Version:_FiveM_b2612_GTAProcess.exe
jmp 0x140003dff
lea rcx, [rsp + 0x30]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 0x1a
jne 0x140003d5e
mov r8, rdi
lea rdx, str.FiveM_b2699_GTAProcess.exe
call fcn.1400319d0
test eax, eax
jne 0x140003d5e
mov dword [0x140047e20], 0x20304c8
mov dword [0x140047e1c], 0x26684d8
mov dword [0x140047e24], 0x20d9868
mov dword [0x140047e18], 0x10c8
lea rdx, str.Game_Version:_FiveM_b2699_GTAPROCESS.exe
jmp 0x140003dff
lea rcx, [rsp + 0x30]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 0x1a
jne 0x140003da1
mov r8, rdi
lea rdx, str.FiveM_b2802_GTAProcess.exe
call fcn.1400319d0
test eax, eax
jne 0x140003da1
mov dword [0x140047e20], 0x1f5b820
mov dword [0x140047e1c], 0x254d448
lea rdx, str.Game_Version:_FiveM_b2802_GTAProcess.exe
jmp 0x140003dff
lea rcx, [rsp + 0x30]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 0x1a
jne 0x140003e13
mov r8, rdi
lea rdx, str.FiveM_b2944_GTAProcess.exe
call fcn.1400319d0
test eax, eax
jne 0x140003e13
mov dword [0x140047e20], 0x1f42068
mov dword [0x140047e1c], 0x257bea0
mov dword [0x140047e24], 0x1feb698
mov dword [0x140047e18], 0x10a8
lea rdx, str.Game_Version:_FiveM_bb2944_GTAProcess.exe
jmp 0x140003dff
lea rdx, str.No_matching_process_found_in_the_list.
lea rcx, [0x140046430]
call fcn.1400066e0
mov rcx, rax
call fcn.140006990
mov eax, dword [0x140047df4]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x68], r15
mov qword [rbp + 0xd0], r15
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftClipboard
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp + 0xd0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140003eb7
mov dword [rbp - 0x80], 3
lea rax, [rsp + 0x60]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x80]
mov qword [rbp + 0xd8], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003eca
lea rdx, str.Registry_error_n
lea rcx, [0x140046430]
call fcn.1400066e0
mov rax, qword [rsp + 0x68]
mov qword [0x140047df8], rax
mov edx, dword [0x140047e1c]
add rdx, rax
call fcn.140006a30
mov qword [0x140047e10], rax
mov edx, dword [0x140047e20]
add rdx, qword [0x140047df8]
call fcn.140006a30
mov qword [0x140047e08], rax
mov rdx, qword [0x140047e10]
add rdx, 8
call fcn.140006a30
mov qword [0x140047e28], rax
mov rdx, qword [0x140047df8]
add rdx, 0x20d8c90
call fcn.140006a30
mov qword [0x140047de8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
mov ecx, 8
call fcn.14000c970
lea rcx, [0x1400039e0]
mov qword [rax], rcx
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140009210]
xor edx, edx
xor ecx, ecx
call fcn.140016b0c
mov qword [rbp + 0x20], rax
test rax, rax
je 0x140004357
xorps xmm12, xmm12
movsd xmm11, qword [0x14003ebe0]
movsd xmm9, qword [0x14003ebf0]
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003fe5
mov dword [rbp + 0xd0], 0x43480000
mov rdx, qword [0x140047e28]
add rdx, 0x280
mov r9d, 4
lea r8, [rbp + 0xd0]
call fcn.140002210
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003fa0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x78], 0
mov esi, dword [rsp + 0x78]
movsd xmm10, qword [rsp + 0x70]
mov edx, dword [0x140047e24]
add rdx, qword [0x140047df8]
call fcn.140006a30
mov qword [0x140047e00], rax
mov eax, dword [0x140047df4]
mov dword [rbp - 0x60], eax
mov rax, qword [0x140047e28]
add rax, 0x90
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x70]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0xc
mov qword [rbp + 0xd0], r15
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftClipboard
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp + 0xd0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400040e5
mov dword [rbp], r15d
lea rax, [rbp - 0x60]
mov qword [rbp + 8], rax
lea rax, [rbp]
mov qword [rbp + 0xd8], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400040f8
lea rdx, str.Registry_error_n
lea rcx, [0x140046430]
call fcn.1400066e0
mov rdx, qword [0x140047e28]
add rdx, 0x30
call fcn.140006a30
mov rdi, rax
movsd qword [rbp - 0x40], xmm10
mov dword [rbp - 0x38], esi
lea rdx, [rax + 0x30]
mov r9d, 0xc
lea r8, [rbp - 0x40]
call fcn.140002210
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000433e
movaps xmm0, xmm12
unpcklps xmm0, xmm12
movsd qword [rbp - 0x30], xmm0
movss dword [rbp - 0x28], xmm12
mov rdx, qword [0x140047e28]
add rdx, 0x320
mov r9d, 0xc
lea r8, [rbp - 0x30]
call fcn.140002210
mov eax, dword [0x140047df4]
mov dword [rbp - 0x60], eax
mov rax, qword [0x140047e00]
add rax, 0x3d0
mov qword [rbp - 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0xc
mov qword [rbp + 0xd0], r15
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftClipboard
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp + 0xd0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140004227
mov dword [rbp + 0x10], r15d
lea rax, [rbp - 0x60]
mov qword [rbp + 0x18], rax
lea rax, [rbp + 0x10]
mov qword [rbp + 0xe0], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000423a
lea rdx, str.Registry_error_n
lea rcx, [0x140046430]
call fcn.1400066e0
movss xmm1, dword [rsp + 0x50]
cvtps2pd xmm1, xmm1
mulsd xmm1, xmm11
movss xmm0, dword [rbp - 0x70]
cvtps2pd xmm0, xmm0
addsd xmm1, xmm0
cvtpd2ps xmm6, xmm1
movss xmm1, dword [rsp + 0x54]
cvtps2pd xmm1, xmm1
mulsd xmm1, xmm11
movss xmm0, dword [rbp - 0x6c]
cvtps2pd xmm0, xmm0
addsd xmm1, xmm0
cvtpd2ps xmm7, xmm1
movss xmm1, dword [rsp + 0x58]
cvtps2pd xmm1, xmm1
mulsd xmm1, xmm11
movss xmm0, dword [rbp - 0x68]
cvtps2pd xmm0, xmm0
addsd xmm1, xmm0
cvtpd2ps xmm8, xmm1
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400042f2
movss xmm1, dword [rsp + 0x50]
cvtps2pd xmm1, xmm1
mulsd xmm1, xmm9
cvtps2pd xmm0, xmm6
addsd xmm1, xmm0
cvtpd2ps xmm6, xmm1
movss xmm2, dword [rsp + 0x54]
cvtps2pd xmm2, xmm2
mulsd xmm2, xmm9
cvtps2pd xmm0, xmm7
addsd xmm2, xmm0
cvtpd2ps xmm7, xmm2
movss xmm1, dword [rsp + 0x58]
cvtps2pd xmm1, xmm1
mulsd xmm1, xmm9
cvtps2pd xmm0, xmm8
addsd xmm1, xmm0
cvtpd2ps xmm8, xmm1
unpcklps xmm6, xmm7
movsd qword [rbp - 0x80], xmm6
movss dword [rbp - 0x78], xmm8
mov rdx, qword [0x140047e28]
add rdx, 0x90
mov r9d, 0xc
lea r8, [rbp - 0x80]
call fcn.140002210
movsd qword [rsp + 0x60], xmm6
movss dword [rsp + 0x68], xmm8
lea rdx, [rdi + 0x50]
mov r9d, 0xc
lea r8, [rsp + 0x60]
call fcn.140002210
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140004011
jmp 0x140003fa0
mov dword [rbp + 0x28], r15d
mov ecx, 6
call fcn.140009d14
int3