Function at 0x1400789d0
Capabilities:
Create directory
Delete file
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
xor r12d, r12d
mov dword [rbp + 0x260], r12d
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, str.Nezur
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
xor edx, edx
lea rcx, str.C:Nezur
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rax, [0x140194f48]
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x260], 1
lea rcx, [rbp - 0x30]
call fcn.14004dbe0
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x40], rax
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x44], edx
lea rcx, [rbp - 0x30]
call fcn.14004f370
nop
lea r9d, [r12 + 0x40]
lea r8d, [r12 + 1]
lea rdx, str.C:Nezurconfig_counter.txt
lea rcx, [rbp - 0x30]
call fcn.14004f270
test rax, rax
jne 0x140078ae5
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r12 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
cmp qword [rbp + 0x50], 0
je 0x140078b27
lea rdx, reloc.WS2_32.dll_accept
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
lea rcx, [rbp - 0x30]
call fcn.14004f0e0
test rax, rax
jne 0x140078b27
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
call fcn.14000b500
test al, al
je 0x140078b4e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov edx, 0x50
mov r9d, 0x409
lea r8d, [rdx - 0x4f]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rcx, qword [0x1401f9690]
mov rax, qword [rcx + 0x3ee0]
cmp byte [rax + 0xb3], 0
jne 0x140078b7e
mov eax, dword [rax + 0x1ac]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.140037190
mov rcx, qword [0x1401f9690]
mov rax, qword [rcx + 0x3ee0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x382c]
movss xmm8, dword [0x140195650]
mulss xmm1, xmm8
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x260], xmm1
mov dword [rbp + 0x264], 0x420c0000
lea rdx, [rbp + 0x260]
lea rcx, str.Create
call fcn.140033e60
lea r15, [0x1401f9758]
test al, al
je 0x140078e12
mov edx, dword [reloc.WS2_32.dll_accept]
lea rcx, [rbp - 0x80]
call fcn.140052410
nop
mov r8, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
sub rax, r8
mov r14d, 6
lea rsi, str.config
cmp rax, r14
jb 0x140078c84
lea rax, [r8 + 6]
mov qword [rbp - 0x70], rax
lea rbx, [rbp - 0x80]
cmp rcx, 0x10
cmovae rbx, qword [rbp - 0x80]
lea rax, [0x14019549a]
cmp rax, rbx
jbe 0x140078c48
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x140078c48
cmp rbx, rsi
ja 0x140078c40
mov rdi, r12
jmp 0x140078c4b
mov rdi, rbx
sub rdi, rsi
jmp 0x140078c4b
mov rdi, r14
inc r8
lea rcx, [rbx + 6]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r14, rdi
lea rdx, [rsi + 6]
add rdx, rdi
lea rcx, [rdi + rbx]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x80]
jmp 0x140078ca5
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
xor r9d, r9d
movzx r8d, byte [rbp + 0x260]
mov rdx, r14
lea rcx, [rbp - 0x80]
call fcn.14003f670
movups xmm7, xmmword [rax]
movups xmmword [rbp - 0x60], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140078d01
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078cfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140078cfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140153cac
movdqa xmm0, xmmword [0x1401958e0]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
inc dword [reloc.WS2_32.dll_accept]
lea rcx, [rbp - 0x60]
movq rbx, xmm7
psrldq xmm6, 8
movq rdi, xmm6
cmp rdi, 0x10
cmovae rcx, rbx
mov r8, r15
sub r8, rcx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [r8 + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140078d40
call fcn.140078330
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, str.C:Nezurconfig_counter.txt
lea rcx, [rbp + 0xd0]
call fcn.14004a520
nop
cmp qword [rbp + 0x158], 0
je 0x140078dcb
mov edx, dword [reloc.WS2_32.dll_accept]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rcx, [rbp + 0xd8]
call fcn.14004f0e0
test rax, rax
jne 0x140078dcb
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xd0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0xd0]
call fcn.14004a400
nop
cmp rdi, 0x10
jb 0x140078e12
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140078e0a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140078e0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140153cac
movss xmm9, dword [0x140195850]
movaps xmm1, xmm9
xorps xmm10, xmm10
xorps xmm0, xmm0
call fcn.140016970
mov rdx, qword [0x1401f9690]
mov rax, qword [rdx + 0x3ee0]
movss xmm4, dword [rax + 0x20]
movss xmm0, dword [rdx + 0x382c]
mulss xmm4, xmm8
addss xmm0, xmm0
subss xmm4, xmm0
movss dword [rbp + 0x260], xmm4
mov dword [rbp + 0x264], 0x420c0000
lea rdx, [rbp + 0x260]
lea rcx, str.Delete
call fcn.140033e60
mov rbx, 0xffffffffffffffff
movabs rdi, 0x7fffffffffffffff
lea r14, str.C:Nezur_
lea rsi, [0x1401f9d68]
test al, al
je 0x140079083
mov rdx, qword [reloc.WS2_32.dll_htons]
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140078eb0
mov rax, rdi
sub rax, rdx
cmp rax, rcx
jb 0x140079553
mov r9, r14
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r9, qword [str.C:Nezur_]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x60]
call fcn.14003e140
nop
mov r8d, 4
lea rdx, str..ini
lea rcx, [rsp + 0x60]
call fcn.14003e3c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [0x1401f9d80]
cmp rdx, 0x10
jb 0x140078f60
mov rcx, qword [0x1401f9d68]
inc rdx
cmp rdx, 0x1000
jb 0x140078f5b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078fa9
mov rcx, r8
call fcn.140153cac
movups xmmword [0x1401f9d68], xmm6
movups xmmword [0x1401f9d78], xmm7
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140078fb5
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078fb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140078fb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140153cac
mov rcx, rsi
cmp qword [0x1401f9d80], 0x10
cmovae rcx, qword [0x1401f9d68]
mov qword [0x1401f9930], rcx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x60]
mov qword [rbp + 0x260], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r8, rbx
inc r8
cmp byte [r15 + r8], 0
jne 0x140078ff6
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.140032010
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140153948
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], Ordinal_27
mov qword [rsp + 0x58], Ordinal_33
movups xmm0, xmmword [str.C:NezurConfig_List.ini]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1401954b0]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140077ee0
xorps xmm0, xmm0
movups xmmword [0x1401f9758], xmm0
xorps xmm1, xmm1
movups xmmword [0x1401f9940], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140079270
mov rcx, qword [reloc.WS2_32.dll_htons]
mov rax, rbx
inc rax
cmp byte [r15 + rax], 0
jne 0x1400790a0
sub rdi, rcx
cmp rdi, rax
jb 0x14007954d
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r14, qword [str.C:Nezur_]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov r9, r14
lea rcx, [rsp + 0x40]
call fcn.14003e140
nop
mov r8d, 4
lea rdx, str..ini
lea rcx, [rsp + 0x40]
call fcn.14003e3c0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [0x1401f9d80]
cmp rdx, 0x10
jb 0x14007914d
mov rcx, qword [0x1401f9d68]
inc rdx
cmp rdx, 0x1000
jb 0x140079148
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140079196
mov rcx, r8
call fcn.140153cac
movups xmmword [0x1401f9d68], xmm6
movups xmmword [0x1401f9d78], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400791a2
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007919d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007919d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140153cac
cmp qword [0x1401f9d80], 0x10
cmovae rsi, qword [0x1401f9d68]
mov qword [0x1401f9930], rsi
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rsp + 0x60]
mov qword [rbp + 0x260], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
inc rbx
cmp byte [r15 + rbx], 0
jne 0x1400791e0
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.140032010
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140153948
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], Ordinal_27
mov qword [rsp + 0x58], Ordinal_33
movups xmm0, xmmword [str.C:NezurConfig_List.ini]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1401954b0]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140077ee0
xorps xmm0, xmm0
movups xmmword [0x1401f9758], xmm0
xorps xmm1, xmm1
movups xmmword [0x1401f9940], xmm1
mov rcx, qword [0x1401f9690]
mov rax, qword [rcx + 0x3ee0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x382c]
mulss xmm1, xmm8
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x260], xmm1
mov dword [rbp + 0x264], 0x420c0000
lea rdx, [rbp + 0x260]
lea rcx, str.Load
call fcn.140033e60
test al, al
je 0x1400792da
call fcn.140077510
xorps xmm0, xmm0
movups xmmword [0x1401f9758], xmm0
xorps xmm1, xmm1
movups xmmword [0x1401f9940], xmm1
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140079303
call fcn.140077510
xorps xmm2, xmm2
movups xmmword [0x1401f9758], xmm2
xorps xmm3, xmm3
movups xmmword [0x1401f9940], xmm3
movaps xmm1, xmm9
movaps xmm0, xmm10
call fcn.140016970
mov rdx, qword [0x1401f9690]
mov rax, qword [rdx + 0x3ee0]
movss xmm4, dword [rax + 0x20]
movss xmm0, dword [rdx + 0x382c]
mulss xmm4, xmm8
addss xmm0, xmm0
subss xmm4, xmm0
movss dword [rbp + 0x260], xmm4
mov dword [rbp + 0x264], 0x420c0000
lea rdx, [rbp + 0x260]
lea rcx, str.Save
call fcn.140033e60
test al, al
je 0x14007937a
call fcn.1400778e0
xorps xmm0, xmm0
movups xmmword [0x1401f9758], xmm0
xorps xmm1, xmm1
movups xmmword [0x1401f9940], xmm1
mov rcx, qword [0x1401f9690]
mov rax, qword [rcx + 0x3ee0]
cmp byte [rax + 0xb3], 0
jne 0x1400793aa
mov eax, dword [rax + 0x1ac]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.140037190
mov rcx, qword [0x1401f9690]
mov rax, qword [rcx + 0x3ee0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x37e8]
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x260], xmm1
mov dword [rbp + 0x264], 0x420c0000
lea rdx, [rbp + 0x260]
lea rcx, str.Reset
call fcn.140033e60
test al, al
je 0x14007950f
cmp byte [0x1401f9758], 0
je 0x14007950f
mov byte [0x1401f98ac], 0
mov byte [0x1401f9925], 0
mov byte [0x1401f9890], 0
mov dword [reloc.WS2_32.dll_accept], r12d
mov dword [reloc.WS2_32.dll_accept], r12d
mov dword [reloc.WS2_32.dll_accept], 0x64
mov dword [0x1401d2210], 0x7d
mov dword [0x1401d21e4], 0x3f000000
mov byte [0x1401f98a1], 0
movaps xmm0, xmmword [0x140195b00]
movups xmmword [0x1401d2238], xmm0
mov dword [reloc.WS2_32.dll_accept], 0
mov byte [reloc.WS2_32.dll_accept], 0
mov dword [0x1401f9894], r12d
mov dword [0x1401f98b0], r12d
mov dword [0x1401f98a4], r12d
mov dword [0x1401f988c], r12d
mov dword [0x1401f992c], r12d
mov dword [0x1401f98a8], r12d
mov dword [0x1401d21c8], 0x64
mov dword [0x1401b26e4], 0x64
mov byte [0x1401f98ad], 0
mov byte [0x1401f9891], 0
mov byte [0x1401f98a0], 0
mov byte [0x1401f9924], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1401f98c0], xmm0
movups xmmword [0x1401f98d0], xmm0
movups xmmword [0x1401f98e0], xmm0
movups xmmword [0x1401f98f0], xmm0
movups xmmword [0x1401f9900], xmm0
movups xmmword [0x1401f9910], xmm0
mov dword [0x1401f9920], eax
call fcn.1400778e0
xorps xmm0, xmm0
movups xmmword [0x1401f9758], xmm0
xorps xmm1, xmm1
movups xmmword [0x1401f9940], xmm1
lea rcx, [rbp - 0x40]
call fcn.14004a3c0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140031f60
nop
call fcn.140031f60
int3