Function at 0x140001150
Capabilities:
Enumerate process modules
Log keystrokes via polling
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x3f8]
sub rsp, 0x4e0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3b8], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea rdx, [rbp + 0x3a8]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8d, dword [rbp + 0x3ac]
mov r9d, 0x1db
mov edx, dword [rbp + 0x3a8]
mov rcx, rbx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0xaf
call qword [sym.imp.USER32.dll_MoveWindow]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.Notepad
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, 0xfffffff0
mov rcx, rbx
and eax, 0xfffaffff
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rdx, [rbp + 0x390]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [rbp + 0x39e]
mov rcx, rdi
sub ax, word [rbp + 0x39a]
inc ax
mov word [rbp + 0x384], ax
movzx eax, word [rbp + 0x3a0]
sub ax, word [rbp + 0x39c]
inc ax
mov word [rbp + 0x386], ax
mov edx, dword [rbp + 0x384]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
lea rcx, str.Press_Right_Control_To_Enable_Disable_Semi___GodMode_n_n
xor dil, dil
call fcn.140001010
movsd xmm7, qword [0x14001e6a0]
lea r15, str.GTA5.exe
xor r12d, r12d
xorps xmm6, xmm6
movzx r14d, dil
call fcn.140001070
mov edx, eax
mov ecx, 0x18
mov rsi, r12
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000130b
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000130b
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
nop
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x1400012f2
add rcx, 2
cmp rcx, 9
je 0x140001306
movzx eax, word [rdx + rcx*2]
cmp ax, word [r15 + rcx*2]
je 0x1400012d0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400012c2
jmp 0x14000130b
mov rsi, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001070
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rdx, [rsi + 0x1d70168]
mov byte [rbp + 0x380], r12b
mov rcx, rax
mov byte [rbp + 0x381], 1
mov r9d, 8
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x30]
lea r8, [rbp + 0x384]
add rdx, 0x280
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x30]
lea r8, [rbp + 0x388]
add rdx, 0x284
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x384]
mov ecx, 0xa3
cvtps2pd xmm0, xmm0
addsd xmm0, xmm7
cvtpd2ps xmm0, xmm0
movss dword [rbp + 0x38c], xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001409
test dil, dil
lea rcx, [0x14001e65c]
sete dil
call fcn.140005284
lea rcx, str.Press_Right_Control_To_Enable_Disable_Semi___GodMode_n_n
call fcn.140001010
lea rcx, str.e_32mSemi___GodMode:ONe_0m_n_n
test r14b, r14b
je 0x140001404
lea rcx, str.e_31mSemi___GodMode:OFFe_0m_n_n
call fcn.140001010
test dil, dil
je 0x1400014bc
movss xmm1, dword [rbp + 0x384]
comiss xmm1, xmm6
jbe 0x140001453
movss xmm0, dword [rbp + 0x388]
comiss xmm0, xmm1
jbe 0x140001453
mov rdx, qword [rsp + 0x30]
lea r8, [rbp + 0x38c]
add rdx, 0x280
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rsp + 0x30]
lea r8, [rbp + 0x381]
add rdx, 0x189
mov qword [rsp + 0x20], r12
mov r9d, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsp + 0x30]
lea r8, [rbp + 0x380]
add rdx, 0x189
mov qword [rsp + 0x20], r12
mov r9d, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001286
mov rdx, qword [rsp + 0x30]
lea r8, [rbp + 0x380]
add rdx, 0x189
mov qword [rsp + 0x20], r12
mov r9d, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140001286