Function at 0x140051010
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x78]
sub rsp, 0x160
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x14006d010]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rsi, rcx
mov qword [rbp - 0x38], rcx
mov rax, qword [0x14006dbe8]
mov qword [rax + 0x4114], rdx
mov dword [rax + 0x40f8], 1
or dword [rax + 0x40f0], 0x42
mov dword [rax + 0x4150], 0x3f800000
mov r8d, 0x12a
lea rdx, [rbp + 0xa0]
lea rcx, str.Kenemation_Launcher
call fcn.14000ee70
mov rbx, qword [0x14006dbe8]
mov rax, qword [rbx + 0x3fe0]
xor r14d, r14d
mov dword [rax + 0xa8], r14d
mov dword [rax + 0xb0], r14d
mov dword [rax + 0xb8], r14d
mov rax, qword [rbx + 0x3fe0]
mov dword [rax + 0xac], r14d
mov dword [rax + 0xb4], r14d
mov dword [rax + 0xbc], r14d
mov dword [rsp + 0x58], 0x43700000
mov dword [rsp + 0x5c], 0x420c0000
mov dword [rsp + 0x50], 0x42c80000
mov dword [rsp + 0x54], 0x438c0000
mov dword [rsp + 0x48], 0x42c80000
mov dword [rsp + 0x4c], 0x43aa0000
movaps xmm6, xmmword [0x140061d70]
mov dword [rbp - 0x30], socket
movups xmm0, xmmword [rbx + 0x3b20]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x3b20], xmm6
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], socket
movups xmm0, xmmword [rbx + 0x3b30]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x3b30], xmm6
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rbx + 0x3b40]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x3b40], xmm6
mov rcx, qword [0x14006dbe8]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
subss xmm0, dword [0x140061828]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
subss xmm2, dword [0x140061824]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x40], 0x43480000
mov dword [rsp + 0x44], 0x495bba00
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [0x14005bc1e]
call fcn.14003e860
xor ecx, ecx
call fcn.14002e9c0
movaps xmm6, xmmword [0x140061d20]
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], socket
movups xmm0, xmmword [rbx + 0x3b20]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x3b20], xmm6
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], socket
movups xmm0, xmmword [rbx + 0x3b30]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x3b30], xmm6
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rbx + 0x3b40]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x3b40], xmm6
lea rdi, [0x14006dc50]
mov rcx, rdi
cmp qword [0x14006dc68], 0x10
cmovae rcx, qword [0x14006dc50]
mov r8, qword [0x14006dc60]
cmp r8, 2
jne 0x140051312
lea rdx, [0x140061194]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140051312
movaps xmm6, xmmword [0x140061bb0]
movaps xmm7, xmmword [0x140061c70]
jmp 0x140051320
movaps xmm7, xmmword [0x140061bb0]
movaps xmm6, xmmword [0x140061c70]
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], r14d
movups xmm0, xmmword [rbx + 0x39d0]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x39d0], xmm6
mov rbx, qword [0x14006dbe8]
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x140061804]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, dword [0x140061840]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
movss xmm6, dword [rbx + 0x3948]
mov dword [rbx + 0x3948], r14d
mov qword [rsp + 0x40], r14
mov r8d, 0x8000
lea rdx, [rsp + 0x40]
lea rcx, [0x1400612a4]
call fcn.14003e860
movss dword [rbx + 0x3948], xmm6
test al, al
je 0x14005144b
mov rcx, qword [0x14006dc68]
cmp rcx, 2
jb 0x140051437
mov rax, rdi
cmp rcx, 0x10
cmovae rax, qword [0x14006dc50]
mov qword [0x14006dc60], 2
mov ecx, 0x7552
mov word [rax], cx
mov byte [rax + 2], r14b
jmp 0x14005144b
lea r9, [0x1400612ac]
mov edx, 2
mov rcx, rdi
call fcn.140056640
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], r14d
movups xmm0, xmmword [rbx + 0x39d0]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x39d0], xmm7
mov rbx, qword [0x14006dbe8]
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x140061804]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, dword [0x140061844]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
movss xmm6, dword [rbx + 0x3948]
mov dword [rbx + 0x3948], r14d
mov qword [rsp + 0x40], r14
mov r8d, 0x8000
lea rdx, [rsp + 0x40]
lea rcx, [0x1400612b0]
call fcn.14003e860
movss dword [rbx + 0x3948], xmm6
test al, al
je 0x140051573
mov rax, qword [0x14006dc68]
cmp rax, 2
jb 0x14005155f
cmp rax, 0x10
cmovae rdi, qword [0x14006dc50]
mov qword [0x14006dc60], 2
mov eax, 0x6e45
mov word [rdi], ax
mov byte [rdi + 2], r14b
jmp 0x140051573
lea r9, [0x140061194]
mov edx, 2
mov rcx, rdi
call fcn.140056640
xor ecx, ecx
call fcn.14002e9c0
mov rcx, qword [0x14006dbe8]
mov rax, qword [rcx + 0x3d48]
movss xmm6, dword [rax + 0x5c]
movaps xmm0, xmm6
addss xmm0, xmm6
movss dword [rax + 0x5c], xmm0
mov rcx, qword [rcx + 0x3d48]
call fcn.140012170
mov rcx, qword [0x14006dbe8]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x14006182c]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, dword [0x140061814]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov rcx, qword [rsi]
cmp qword [rcx + 0x18], 0x10
jb 0x140051630
mov rcx, qword [rcx]
call fcn.14003dfc0
mov rcx, qword [0x14006dbe8]
mov rax, qword [rcx + 0x3d48]
movss dword [rax + 0x5c], xmm6
mov rcx, qword [rcx + 0x3d48]
call fcn.140012170
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov qword [rbp + 8], r14
xor r8d, r8d
lea rdx, [0x14005bc1e]
lea rcx, [rbp - 0x10]
call fcn.140056010
nop
mov rbx, qword [0x14006dc20]
mov rdx, qword [rsi]
add rdx, 0x20
lea rcx, [rbp + 0x10]
call fcn.1400544f0
nop
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x28], rcx
mov r9, rbx
mov r8, rax
movss xmm6, dword [0x14006183c]
movaps xmm1, xmm6
mov rcx, qword [rsp + 0x50]
call fcn.140050200
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov qword [rbp + 8], r14
mov r8d, 1
lea rdx, [0x140060690]
lea rcx, [rbp - 0x10]
call fcn.140056010
nop
mov rbx, qword [0x14006dc18]
mov rdx, qword [rsi]
add rdx, 0x40
lea rcx, [rbp + 0x10]
call fcn.1400544f0
nop
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x28], rcx
mov r9, rbx
mov r8, rax
movaps xmm1, xmm6
mov rcx, qword [rsp + 0x48]
call fcn.140050640
movaps xmm6, xmmword [0x140061d20]
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], socket
movups xmm0, xmmword [rbx + 0x3b20]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x3b20], xmm6
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], socket
movups xmm0, xmmword [rbx + 0x3b30]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x3b30], xmm6
mov rbx, qword [0x14006dbe8]
mov dword [rbp - 0x30], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rbx + 0x3b40]
movups xmmword [rbp - 0x2c], xmm0
lea rcx, [rbx + 0x4180]
lea rdx, [rbp - 0x30]
call fcn.140026440
movups xmmword [rbx + 0x3b40], xmm6
mov edx, 0xff646464
call fcn.140003c90
mov rbx, qword [0x14006dbe8]
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rbx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x140061848]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, dword [0x140061838]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov rcx, qword [rsi]
add rcx, 0x60
cmp qword [rcx + 0x18], 0x10
jb 0x14005184f
mov rcx, qword [rcx]
movss xmm6, dword [rbx + 0x3948]
mov dword [rbx + 0x3948], r14d
mov qword [rsp + 0x48], 0
mov r8d, 0x8000
lea rdx, [rsp + 0x48]
call fcn.14003e860
movss dword [rbx + 0x3948], xmm6
test al, al
je 0x1400518a9
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.https:__vk.com_im_sel_201969421
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14002e9c0
call fcn.140013560
mov rcx, qword [0x14006dbe8]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x4c]
subss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x14006184c]
movss xmm2, dword [rax + 0x48]
subss xmm2, dword [rax + 0x98]
addss xmm2, dword [0x140061818]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov edx, 0xffffffff
call fcn.140003c90
mov rcx, qword [rsi]
sub rcx, 0xffffffffffffff80
cmp qword [rcx + 0x18], 0x10
jb 0x14005194e
mov rcx, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x58]
call fcn.14003e860
test al, al
jne 0x140051972
mov ecx, recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051c01
xor ecx, ecx
call fcn.14002e9c0
mov rdx, qword [0x14006dc20]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400519a0
lea rcx, [rbp - 0x10]
call fcn.140056010
nop
mov rdx, qword [0x14006dc18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
nop word [rax + rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400519d0
mov r8, rbx
lea rcx, [rbp - 0x30]
call fcn.140056010
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rdx, [0x14006dc30]
lea rcx, [rsp + 0x68]
call fcn.1400544f0
mov rdi, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x78]
call fcn.1400544f0
mov rbx, rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x58]
call fcn.1400544f0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14004e4a0
lea rcx, [rbp + 0x10]
mov rbx, qword [rbp + 0x10]
mov rdi, qword [rbp + 0x28]
cmp rdi, 0x10
cmovae rcx, rbx
mov r8, qword [rbp + 0x20]
cmp r8, 4
jne 0x140051b49
lea rdx, str.okay
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140051b49
mov byte [0x14006dbe1], 1
mov byte [0x14006d049], al
movzx r14d, byte [rbp + 0xa0]
cmp rdi, 0x10
jb 0x140051ac0
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140051ab7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051b74
mov rcx, rbx
call fcn.1400580a8
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140051afc
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051af6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051bb6
call fcn.1400580a8
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140051b38
inc rdx
mov rcx, qword [rbp - 0x10]
mov r8, rcx
cmp rdx, 0x1000
jb 0x140051b32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x140051bf5
call fcn.1400580a8
nop
mov rcx, rsi
call fcn.140054300
movzx eax, r14b
jmp 0x140051c24
cmp rdi, 0x10
jb 0x140051b84
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140051b7b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051b7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400580a8
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140051bc3
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051bbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051bbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400580a8
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140051c01
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051bfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051bfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400580a8
xor ecx, ecx
call fcn.14002e9c0
call fcn.140013690
call fcn.140011b50
movzx ebx, byte [rbp + 0xa0]
mov rcx, rsi
call fcn.140054300
movzx eax, bl
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140057b00
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret