Function at 0x4025db
Capabilities:
Execute command
Log keystrokes via polling
Manipulate console buffer

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
lea rcx, [0x006012dc]
call sub.msvcrt.dll_system
mov ecx, 0xfffffff5
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call rax
mov qword [0x0062d060], rax
mov qword [rbp - 0x18], 0
mov eax, dword [0x005fe010]
mov word [rbp - 0x14], ax
mov eax, dword [0x005fe014]
add eax, 3
mov word [rbp - 0x12], ax
mov rax, qword [0x0062d060]
lea rdx, [rbp - 0x18]
mov r8, rdx
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
call rax
mov dword [rbp - 0x20], 0xa
mov dword [rbp - 0x1c], 0
mov rax, qword [0x0062d060]
lea rdx, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
call rax
mov rax, qword [0x0062d060]
mov edx, 0xf
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call rax
mov dword [rbp - 4], 0
mov eax, dword [0x005fe010]
sub eax, 1
cmp dword [rbp - 4], eax
jge 0x4026ae
mov edx, 0x2d
mov rcx, qword [0x006064d0]
call fcn.004aeda0
add dword [rbp - 4], 1
jmp 0x402689
mov dword [rbp - 8], 0
mov eax, dword [0x005fe014]
sub eax, 1
cmp dword [rbp - 8], eax
jge 0x40271b
lea rdx, [0x006012e0]
mov rcx, qword [0x006064d0]
call fcn.004aecc0
mov dword [rbp - 0xc], 0
mov eax, dword [0x005fe010]
sub eax, 3
cmp dword [rbp - 0xc], eax
jge 0x402702
mov edx, 0x20
mov rcx, qword [0x006064d0]
call fcn.004aeda0
add dword [rbp - 0xc], 1
jmp 0x4026dd
lea rdx, [0x006012e3]
mov rcx, qword [0x006064d0]
call fcn.004aecc0
add dword [rbp - 8], 1
jmp 0x4026b5
mov edx, 0xa
mov rcx, qword [0x006064d0]
call fcn.004aeda0
mov dword [rbp - 0x10], 0
mov eax, dword [0x005fe010]
sub eax, 1
cmp dword [rbp - 0x10], eax
jge 0x402758
mov edx, 0x2d
mov rcx, qword [0x006064d0]
call fcn.004aeda0
add dword [rbp - 0x10], 1
jmp 0x402733
mov byte [rbp - 0x21], 0
mov eax, dword [0x005fe014]
lea edx, [rax - 2]
mov eax, dword [0x005fe010]
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
sar eax, 1
mov ecx, eax
lea rax, [rbp - 0x40]
mov r9d, 4
mov r8d, edx
mov edx, ecx
mov rcx, rax
call fcn.0041b410
mov eax, dword [0x005fe010]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov edx, eax
lea rax, [rbp - 0x60]
mov r9d, 4
mov r8d, 2
mov rcx, rax
call fcn.0041b410
mov eax, dword [0x005fe014]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [0x005fe010]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
lea edx, [rax - 1]
lea rax, [rbp - 0x80]
mov r8d, ecx
mov rcx, rax
call fcn.0041b580
mov dword [rbp - 0x84], 0
mov dword [rbp - 0x88], 0
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x55555556
shr rdx, 0x20
mov r8d, eax
sar r8d, 0x1f
mov ecx, edx
sub ecx, r8d
mov edx, ecx
add edx, edx
add edx, ecx
sub eax, edx
mov ecx, eax
pxor xmm0, xmm0
cvtsi2ss xmm0, ecx
movss xmm1, dword [0x00601334]
subss xmm0, xmm1
movss dword [rbp - 0x70], xmm0
movss xmm0, dword [0x00601338]
movss dword [rbp - 0x6c], xmm0
pxor xmm0, xmm0
movss dword [rbp - 0x4c], xmm0
movzx eax, byte [rbp - 0x21]
test al, al
je 0x402d09
mov ecx, 0x25
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
setne al
test al, al
je 0x402890
movss xmm0, dword [rbp - 0x40]
movss xmm1, dword [0x0060133c]
subss xmm0, xmm1
movss dword [rbp - 0x40], xmm0
jmp 0x4028be
mov ecx, 0x27
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
setne al
test al, al
je 0x4028be
movss xmm1, dword [rbp - 0x40]
movss xmm0, dword [0x0060133c]
addss xmm0, xmm1
movss dword [rbp - 0x40], xmm0
movss xmm0, dword [rbp - 0x4c]
movss xmm1, dword [rbp - 0x60]
movss xmm2, dword [rbp - 0x80]
subss xmm1, xmm2
movss xmm2, dword [0x00601340]
divss xmm1, xmm2
subss xmm0, xmm1
movss dword [rbp - 0x4c], xmm0
movss xmm1, dword [rbp - 0x4c]
movss xmm0, dword [0x00601344]
mulss xmm0, xmm1
movss dword [rbp - 0x4c], xmm0
movss xmm1, dword [rbp - 0x60]
movss xmm0, dword [rbp - 0x4c]
addss xmm0, xmm1
movss dword [rbp - 0x60], xmm0
movss xmm1, dword [rbp - 0x40]
mov eax, dword [rbp - 0x38]
add eax, 1
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
comiss xmm0, xmm1
jbe 0x40293c
mov eax, dword [rbp - 0x38]
add eax, 1
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
movss dword [rbp - 0x40], xmm0
jmp 0x402977
movss xmm0, dword [rbp - 0x40]
mov eax, dword [0x005fe010]
mov edx, dword [rbp - 0x38]
sub eax, edx
sub eax, 2
pxor xmm1, xmm1
cvtsi2ss xmm1, eax
comiss xmm0, xmm1
jbe 0x402977
mov eax, dword [0x005fe010]
mov edx, dword [rbp - 0x38]
sub eax, edx
sub eax, 2
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
movss dword [rbp - 0x40], xmm0
movss xmm1, dword [rbp - 0x60]
mov eax, dword [rbp - 0x58]
add eax, 1
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
comiss xmm0, xmm1
jbe 0x4029a4
mov eax, dword [rbp - 0x58]
add eax, 1
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
movss dword [rbp - 0x60], xmm0
jmp 0x4029df
movss xmm0, dword [rbp - 0x60]
mov eax, dword [0x005fe010]
mov edx, dword [rbp - 0x58]
sub eax, edx
sub eax, 2
pxor xmm1, xmm1
cvtsi2ss xmm1, eax
comiss xmm0, xmm1
jbe 0x4029df
mov eax, dword [0x005fe010]
mov edx, dword [rbp - 0x58]
sub eax, edx
sub eax, 2
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
movss dword [rbp - 0x60], xmm0
movss xmm1, dword [rbp - 0x70]
movss xmm0, dword [0x00601348]
comiss xmm0, xmm1
jbe 0x402a00
movss xmm0, dword [0x00601348]
movss dword [rbp - 0x70], xmm0
jmp 0x402a1b
movss xmm0, dword [rbp - 0x70]
comiss xmm0, dword [0x0060134c]
jbe 0x402a1b
movss xmm0, dword [0x0060134c]
movss dword [rbp - 0x70], xmm0
movss xmm1, dword [rbp - 0x80]
movss xmm0, dword [rbp - 0x70]
addss xmm0, xmm1
movss dword [rbp - 0x80], xmm0
movss xmm1, dword [rbp - 0x7c]
movss xmm0, dword [rbp - 0x6c]
addss xmm0, xmm1
movss dword [rbp - 0x7c], xmm0
movss xmm0, dword [rbp - 0x7c]
movss xmm1, dword [rbp - 0x3c]
movss xmm2, dword [0x00601338]
subss xmm1, xmm2
comiss xmm0, xmm1
jb 0x402b0e
movss xmm1, dword [rbp - 0x7c]
movss xmm2, dword [rbp - 0x3c]
movss xmm0, dword [0x00601338]
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x402b0e
movss xmm0, dword [rbp - 0x80]
movss xmm1, dword [rbp - 0x40]
mov eax, dword [rbp - 0x38]
pxor xmm2, xmm2
cvtsi2ss xmm2, eax
subss xmm1, xmm2
comiss xmm0, xmm1
jbe 0x402b0e
movss xmm1, dword [rbp - 0x80]
movss xmm2, dword [rbp - 0x40]
mov eax, dword [rbp - 0x38]
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
addss xmm0, xmm2
comiss xmm0, xmm1
jbe 0x402b0e
movss xmm0, dword [rbp - 0x6c]
movss xmm1, dword [0x00601350]
xorps xmm0, xmm1
movss dword [rbp - 0x6c], xmm0
movss xmm1, dword [rbp - 0x70]
movss xmm0, dword [rbp - 0x80]
movss xmm2, dword [rbp - 0x40]
subss xmm0, xmm2
movss xmm2, dword [0x00601360]
divss xmm0, xmm2
addss xmm0, xmm1
movss dword [rbp - 0x70], xmm0
movss xmm0, dword [rbp - 0x3c]
movss xmm1, dword [0x00601338]
subss xmm0, xmm1
movss dword [rbp - 0x7c], xmm0
movss xmm1, dword [rbp - 0x7c]
movss xmm2, dword [rbp - 0x5c]
movss xmm0, dword [0x00601338]
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x402bdb
movss xmm0, dword [rbp - 0x7c]
movss xmm1, dword [rbp - 0x5c]
movss xmm2, dword [0x00601338]
subss xmm1, xmm2
comiss xmm0, xmm1
jb 0x402bdb
movss xmm0, dword [rbp - 0x80]
movss xmm1, dword [rbp - 0x60]
mov eax, dword [rbp - 0x58]
pxor xmm2, xmm2
cvtsi2ss xmm2, eax
subss xmm1, xmm2
comiss xmm0, xmm1
jbe 0x402bdb
movss xmm1, dword [rbp - 0x80]
movss xmm2, dword [rbp - 0x60]
mov eax, dword [rbp - 0x58]
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
addss xmm0, xmm2
comiss xmm0, xmm1
jbe 0x402bdb
movss xmm0, dword [rbp - 0x6c]
movss xmm1, dword [0x00601350]
xorps xmm0, xmm1
movss dword [rbp - 0x6c], xmm0
movss xmm1, dword [rbp - 0x70]
movss xmm0, dword [rbp - 0x80]
movss xmm2, dword [rbp - 0x60]
subss xmm0, xmm2
movss xmm2, dword [0x00601360]
divss xmm0, xmm2
addss xmm0, xmm1
movss dword [rbp - 0x70], xmm0
movss xmm1, dword [rbp - 0x5c]
movss xmm0, dword [0x00601338]
addss xmm0, xmm1
movss dword [rbp - 0x7c], xmm0
movss xmm0, dword [rbp - 0x7c]
mov eax, dword [0x005fe014]
pxor xmm1, xmm1
cvtsi2ss xmm1, eax
comiss xmm0, xmm1
jb 0x402c34
mov eax, dword [rbp - 0x88]
add eax, 1
mov dword [rbp - 0x88], eax
lea r9, [rbp - 0x21]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x40]
lea rcx, [rbp - 0x88]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x84]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004024d0
jmp 0x402c81
movss xmm1, dword [rbp - 0x7c]
pxor xmm0, xmm0
comiss xmm0, xmm1
jb 0x402c81
mov eax, dword [rbp - 0x84]
add eax, 1
mov dword [rbp - 0x84], eax
lea r9, [rbp - 0x21]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x40]
lea rcx, [rbp - 0x88]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x84]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004024d0
movss xmm1, dword [rbp - 0x80]
movss xmm0, dword [0x00601338]
comiss xmm0, xmm1
jb 0x402cba
movss xmm0, dword [rbp - 0x70]
movss xmm1, dword [0x00601350]
xorps xmm0, xmm1
movss dword [rbp - 0x70], xmm0
movss xmm0, dword [0x00601338]
movss dword [rbp - 0x80], xmm0
jmp 0x402df9
movss xmm0, dword [rbp - 0x80]
mov eax, dword [0x005fe010]
sub eax, 3
pxor xmm1, xmm1
cvtsi2ss xmm1, eax
comiss xmm0, xmm1
jb 0x402df9
movss xmm0, dword [rbp - 0x70]
movss xmm1, dword [0x00601350]
xorps xmm0, xmm1
movss dword [rbp - 0x70], xmm0
mov eax, dword [0x005fe010]
sub eax, 3
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
movss dword [rbp - 0x80], xmm0
jmp 0x402df9
mov eax, dword [0x005fe010]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
sub eax, 0x10
mov word [rbp - 0x8c], ax
mov eax, dword [0x005fe014]
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
movss xmm1, dword [0x00601334]
divss xmm0, xmm1
cvttss2si eax, xmm0
mov word [rbp - 0x8a], ax
mov rax, qword [0x0062d060]
mov edx, dword [rbp - 0x8c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
call rax
lea rdx, str.Press_the_space_bar_to_start_._.
mov rcx, qword [0x006064d0]
call fcn.004aecc0
mov ecx, 0x20
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
setne al
test al, al
je 0x402df9
mov eax, dword [0x005fe010]
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
sub eax, 0x10
mov word [rbp - 0x90], ax
mov eax, dword [0x005fe014]
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
movss xmm1, dword [0x00601334]
divss xmm0, xmm1
cvttss2si eax, xmm0
mov word [rbp - 0x8e], ax
mov rax, qword [0x0062d060]
mov edx, dword [rbp - 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
call rax
lea rdx, [0x00601310]
mov rcx, qword [0x006064d0]
call fcn.004aecc0
mov byte [rbp - 0x21], 1
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.0041b2a0
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.0041b2a0
lea rax, [rbp - 0x80]
mov rcx, rax
call fcn.0041b480
mov ecx, 0x32
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x402854