Function at 0x180106e00
Capabilities:
Check if file exists
Log keystrokes via application hook
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x4f0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x180515618]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
xor ebx, ebx
mov eax, ebx
xchg dword [0x18051aec0], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x18051aee8], eax
call fcn.18010abb0
call fcn.18010c0d0
call fcn.18010c830
call fcn.18010d5e0
xor edx, edx
mov rcx, qword [0x18051b1b0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [0x18051b1ac], eax
mov r9d, eax
xor r8d, r8d
lea rdx, [0x180108830]
lea ecx, [rbx + 4]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x18051aeb0], rax
mov r9d, dword [0x18051b1ac]
xor r8d, r8d
lea rdx, [0x180107aa0]
lea ecx, [rbx + 2]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x18051aeb8], rax
cmp qword [0x18051aeb0], rbx
je 0x1801077c9
test rax, rax
je 0x1801077c9
call fcn.180116e20
call fcn.180120e60
call fcn.18012fc60
call fcn.18010b900
call fcn.18010d410
mov qword [rsp + 0x3f0], rbx
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], rbx
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], 0xf
mov byte [rsp + 0x3f0], bl
mov qword [rsp + 0x2b0], 0x1f
mov qword [rsp + 0x2b8], 0x16
lea ecx, [rbx + 0x20]
call fcn.1801690ac
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x400], 0x1a
mov qword [rsp + 0x408], 0x1f
movups xmm0, xmmword [str.g_IsLoadDllModule_zs__nil]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1801e8400]
movsd qword [rax + 0x10], xmm1
movzx ecx, word [0x1801e8408]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], bl
mov qword [rsp + 0x3f0], rax
xor r8d, r8d
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0xb0]
call fcn.180116580
lea r14, [rsp + 0xb0]
mov qword [rsp + 0x2e0], r14
lea r15, [rsp + 0xb8]
mov qword [rsp + 0x2e8], r15
lea r12, [rsp + 0xc0]
mov qword [rsp + 0x2f0], r12
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x180107120
mov rsi, qword [rsp + 0xb8]
mov qword [rsp + 0x2f8], rsi
mov rdi, rcx
mov qword [rsp + 0xf0], rcx
cmp rdi, rsi
je 0x1801070a1
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180107079
mov rcx, qword [rdi]
mov qword [rsp + 0x300], rcx
inc rdx
mov qword [rsp + 0x1b0], rdx
mov qword [rsp + 0xe0], rdx
mov qword [rsp + 0xe8], rcx
cmp rdx, 0x1000
jb 0x180107074
add rdx, 0x27
mov qword [rsp + 0xe0], rdx
mov r8, qword [rcx - 8]
mov qword [rsp + 0x1b8], r8
sub rcx, r8
mov qword [rsp + 0x1c0], rcx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1801079fa
mov rcx, r8
mov qword [rsp + 0xe8], rcx
call fcn.1801690e8
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], send
mov byte [rdi], 0
add rdi, 0x20
mov qword [rsp + 0xf0], rdi
mov rcx, qword [rsp + 0xb0]
jmp 0x180106ff6
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
sar rdx, 5
mov qword [rsp + 0x1c8], rdx
shl rdx, 5
mov qword [rsp + 0xf8], rdx
mov qword [rsp + 0x100], rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180107111
add rdx, 0x27
mov qword [rsp + 0xf8], rdx
mov rcx, qword [rcx - 8]
mov qword [rsp + 0x1d0], rcx
sub rax, rcx
mov qword [rsp + 0x1d8], rax
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180107a00
mov qword [rsp + 0x100], rcx
call fcn.1801690e8
mov qword [r14], rbx
mov qword [r15], rbx
mov qword [r12], rbx
mov rdx, qword [rsp + 0x408]
cmp rdx, 0x10
jb 0x18010719b
inc rdx
mov qword [rsp + 0x1e0], rdx
mov qword [rsp + 0x108], rdx
mov rcx, qword [rsp + 0x3f0]
mov qword [rsp + 0x110], rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180107196
add rdx, 0x27
mov qword [rsp + 0x108], rdx
mov rcx, qword [rcx - 8]
mov qword [rsp + 0x1e8], rcx
sub rax, rcx
mov qword [rsp + 0x1f0], rax
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180107a06
mov qword [rsp + 0x110], rcx
call fcn.1801690e8
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], 0xf
mov byte [rsp + 0x3f0], 0
call fcn.180116b20
call fcn.180119250
mov qword [rsp + 0x410], rbx
mov qword [rsp + 0x420], rbx
mov qword [rsp + 0x428], rbx
mov qword [rsp + 0x420], rbx
mov qword [rsp + 0x428], 0xf
mov byte [rsp + 0x410], 0
mov qword [rsp + 0x1f8], 0x1f
mov qword [rsp + 0x200], 0x16
mov ecx, 0x20
call fcn.1801690ac
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x420], 0x18
mov qword [rsp + 0x428], 0x1f
movups xmm0, xmmword [str.g_IsLoadDllModule_zs__1]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1801e8420]
movsd qword [rax + 0x10], xmm1
mov byte [rax + 0x18], 0
mov qword [rsp + 0x410], rax
xor r8d, r8d
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0xc8]
call fcn.180116580
lea r14, [rsp + 0xc8]
mov qword [rsp + 0x210], r14
lea r15, [rsp + 0xd0]
mov qword [rsp + 0x218], r15
lea r12, [rsp + 0xd8]
mov qword [rsp + 0x220], r12
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x1801073fa
mov rsi, qword [rsp + 0xd0]
mov qword [rsp + 0x228], rsi
mov rdi, rcx
mov qword [rsp + 0x120], rcx
nop
cmp rdi, rsi
je 0x18010737b
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180107353
mov rcx, qword [rdi]
mov qword [rsp + 0x230], rcx
inc rdx
mov qword [rsp + 0x238], rdx
mov qword [rsp + 0x160], rdx
mov qword [rsp + 0x118], rcx
cmp rdx, 0x1000
jb 0x18010734e
add rdx, 0x27
mov qword [rsp + 0x160], rdx
mov r8, qword [rcx - 8]
mov qword [rsp + 0x240], r8
sub rcx, r8
mov qword [rsp + 0x248], rcx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180107a0c
mov rcx, r8
mov qword [rsp + 0x118], rcx
call fcn.1801690e8
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], send
mov byte [rdi], 0
add rdi, 0x20
mov qword [rsp + 0x120], rdi
mov rcx, qword [rsp + 0xc8]
jmp 0x1801072d0
mov rdx, qword [rsp + 0xd8]
sub rdx, rcx
sar rdx, 5
mov qword [rsp + 0x250], rdx
shl rdx, 5
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801073eb
add rdx, 0x27
mov qword [rsp + 0x128], rdx
mov rcx, qword [rcx - 8]
mov qword [rsp + 0x258], rcx
sub rax, rcx
mov qword [rsp + 0x260], rax
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180107a11
mov qword [rsp + 0x130], rcx
call fcn.1801690e8
mov qword [r14], rbx
mov qword [r15], rbx
mov qword [r12], rbx
mov rdx, qword [rsp + 0x428]
cmp rdx, 0x10
jb 0x180107475
inc rdx
mov qword [rsp + 0x268], rdx
mov qword [rsp + 0x138], rdx
mov rcx, qword [rsp + 0x410]
mov qword [rsp + 0x180], rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180107470
add rdx, 0x27
mov qword [rsp + 0x138], rdx
mov rcx, qword [rcx - 8]
mov qword [rsp + 0x270], rcx
sub rax, rcx
mov qword [rsp + 0x278], rax
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180107a17
mov qword [rsp + 0x180], rcx
call fcn.1801690e8
mov qword [rsp + 0x420], rbx
mov qword [rsp + 0x428], 0xf
mov byte [rsp + 0x410], 0
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801e8430]
call fcn.180117bb0
call fcn.18010d240
cmp dword [0x1802307b0], 0
je 0x1801074bb
mov eax, 1
xchg dword [0x18051aec0], eax
mov edi, ebx
mov dword [rsp + 0x30], ebx
lea r15, str.__:
lea rsi, [0x1801e4e9b]
lea r13, str.heart_not_beating
lea r14, [0x18010d3d0]
lea r12, vtable.std::_Func_impl_no_alloc_bool____cdecl___void___bool___.0
nop dword [rax]
nop dword [rax + rax]
cmp dword [0x1802307b0], 0
je 0x18010779b
mov cl, 1
call fcn.18010d3e0
test al, al
jne 0x180107712
inc edi
mov dword [rsp + 0x30], edi
cmp edi, 0xa
jbe 0x180107718
call fcn.18010f3a0
mov rcx, qword [rax + 0x1a0]
mov eax, dword [rcx + 0x40]
cmp eax, 1
jg 0x1801076d5
call fcn.18010f3a0
mov rdi, qword [rax + 0x1a0]
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], 7
movups xmm6, xmmword [rsp + 0x1a0]
mov qword [rsp + 0x3d0], rbx
mov qword [rsp + 0x3e0], rbx
mov qword [rsp + 0x3e8], rbx
mov qword [rsp + 0x3e0], rbx
mov qword [rsp + 0x3e8], send
mov byte [rsp + 0x3d0], 0
mov qword [rsp + 0x3e0], 0xa
movsd xmm0, qword [str.DllMainRun]
movsd qword [rsp + 0x3d0], xmm0
movzx eax, word [0x1801e8468]
mov word [rsp + 0x3d8], ax
mov byte [rsp + 0x3da], 0
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x4b0]
call fcn.180139750
nop
cmp qword [rax + 0x18], 0x10
jb 0x1801075e3
mov rax, qword [rax]
mov qword [rsp + 0x188], rsi
mov dword [rsp + 0x190], 0x4f7
mov qword [rsp + 0x198], rax
movaps xmmword [rsp + 0x2d0], xmm6
movups xmm0, xmmword [rsp + 0x188]
movaps xmmword [rsp + 0x310], xmm0
movsd xmm1, qword [rsp + 0x198]
movsd qword [rsp + 0x320], xmm1
mov qword [rsp + 0x28], r13
lea rax, [0x180230d90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2d0]
mov r8d, 1
lea rdx, [rsp + 0x310]
mov rcx, rdi
call fcn.1801025d0
nop
lea rcx, [rsp + 0x4b0]
call fcn.1800cffc0
nop
mov rdx, qword [rsp + 0x3e8]
cmp rdx, 0x10
jb 0x1801076b9
inc rdx
mov qword [rsp + 0x140], rdx
mov rcx, qword [rsp + 0x3d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801076b4
add rdx, 0x27
mov qword [rsp + 0x140], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180107a1d
call fcn.1801690e8
mov qword [rsp + 0x3e0], rbx
mov qword [rsp + 0x3e8], send
mov byte [rsp + 0x3d0], 0
mov dword [0x1802307b0], ebx
mov edi, dword [rsp + 0x30]
jmp 0x180107718
mov edi, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x150], r14
mov qword [rsp + 0x488], rbx
mov rax, qword [rsp + 0x150]
test rax, rax
je 0x180107755
mov qword [rsp + 0x450], r12
mov qword [rsp + 0x458], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x488], rax
lea r8, [rsp + 0x450]
mov edx, 0x1f4
mov ecx, 0xbb8
call fcn.18013b2f0
nop
mov rcx, qword [rsp + 0x488]
test rcx, rcx
je 0x180107796
mov rax, qword [rcx]
lea rdx, [rsp + 0x450]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x488], rbx
jmp 0x1801074f0
mov edx, 0x2710
lea rcx, [0x1801e8470]
call fcn.1801180f0
cmp dword [0x1802307b0], 0
jne 0x18010789f
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18010789f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
mov eax, dword [0x18051aeb8]
mov dword [rsp + 0x64], eax
mov eax, dword [0x18051aeb0]
mov dword [rsp + 0x68], eax
lea rax, [0x18051b1ac]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
lea r8, [rsp + 0x68]
lea rdx, str.errreghotkeyhwnd1:_2:_3:_4:
lea rcx, [rsp + 0x490]
call fcn.180101e00
nop
call fcn.18010f3a0
mov rcx, qword [rax + 0x1a0]
mov eax, dword [rcx + 0x40]
cmp eax, 2
jg 0x18010788d
call fcn.18010f3a0
lea rsi, [0x1801e4e9b]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], 0x515
mov qword [rsp + 0x48], rsi
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x330], xmm0
movsd xmm1, qword [rsp + 0x48]
movsd qword [rsp + 0x340], xmm1
lea r9, [rsp + 0x490]
mov r8d, 2
lea rdx, [rsp + 0x330]
mov rcx, qword [rax + 0x1a0]
call fcn.180102270
nop
jmp 0x180107891
lea rcx, [rsp + 0x490]
call fcn.1800cffc0
nop
jmp 0x1801078a3
mov dword [0x1802307b0], ebx
mov qword [rsp + 0x430], rbx
mov qword [rsp + 0x440], rbx
mov qword [rsp + 0x448], rbx
mov qword [rsp + 0x440], rbx
mov qword [rsp + 0x448], 0xf
mov byte [rsp + 0x430], 0
mov r8d, 0x31
lea rdx, str.g_IsLoadDllModule_zs__nil_meOnActionTheOne__nil
lea rcx, [rsp + 0x430]
call fcn.1800d0120
nop
xor r8d, r8d
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x358]
call fcn.180116580
lea rcx, [rsp + 0x358]
call fcn.1800ef9a0
nop
mov rdx, qword [rsp + 0x448]
cmp rdx, 0x10
jb 0x180107968
inc rdx
mov rcx, qword [rsp + 0x430]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180107963
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180107a23
jmp 0x180107963
call fcn.1801690e8
mov qword [rsp + 0x440], rbx
mov qword [rsp + 0x448], 0xf
mov byte [rsp + 0x430], 0
call fcn.180119ac0
call fcn.180110840
mov rcx, qword [0x18051b4f0]
test rcx, rcx
je 0x1801079b6
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x18051b4f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x18051b4f0], rbx
mov qword [0x18051b4e0], rbx
mov dword [0x18051b4d8], ebx
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.180169060
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.18019241c
nop
call fcn.18019241c
nop
call fcn.18019241c
nop
call fcn.18019241c
call fcn.18019241c
nop
call fcn.18019241c
nop
call fcn.18019241c
nop
call fcn.18019241c
int3
jmp 0x180106e00