Function at 0x140001830
Capabilities:
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rax
lea rbx, str.cs2.exe
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], 7
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 1]
call fcn.1400011c0
nop
lea rdx, str.Russian
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
cmp dword [rbp + 0xf], 0
jne 0x1400019ac
lea rdx, str.start_cs2_please__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002000
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], 7
movaps xmm6, xmmword [rbp - 0x69]
nop dword [rax + rax]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rax
movdqa xmmword [rbp - 0x49], xmm6
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.1400011c0
mov ebx, dword [rbp - 0x29]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x14000191c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400018e0
lea rdx, str.found__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002000
lea rdx, str.press_numpad_7_to_restart_and_enable_bhop__del_to_off.__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002000
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], 6
mov qword [rbp - 9], 0xf
mov eax, dword [str.start]
mov dword [rbp - 0x21], eax
movzx eax, word [0x140004564]
mov word [rbp - 0x1d], ax
mov byte [rbp - 0x1b], 0
mov ecx, 0x67
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001975
mov rdx, qword [rdi]
lea rcx, [rbp - 0x21]
call fcn.140001de0
lea rcx, [rbp - 0x21]
call fcn.140001dd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], 7
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.1400011c0
lea rax, str.client.dll
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], 0xa
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x49], xmm0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.140001490
lea r15, [rax + 0x1730118]
lea r14, [rax + 0x17294a0]
movabs rdi, 0x7ffffffffff0bdbe
movabs rbx, 0x7fffffffffffffff
movabs r13, 0x311cdad160000
movsd xmm6, qword [0x140004578]
nop dword [rax]
lea rcx, [rbp - 0x69]
call fcn.140001750
mov rax, qword [rbp - 0x69]
cmp rax, rdi
lea rdi, [rax + 0xf4240]
jle 0x140001a6c
mov rdi, rbx
movabs rsi, 0xb2f4fc0794908cf3
movabs r12, 0x112e0be826d694b3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140001aa1
imul rbx, rcx, 0x64
jmp 0x140001b15
cmp rbx, 0x16e3600
jne 0x140001af4
mov rax, rsi
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rsi
imul rcx
lea rbx, [rcx + rdx]
sar rbx, 0x18
mov rax, rbx
shr rax, 0x3f
add rbx, rax
imul rax, r8, 0x3b9aca00
jmp 0x140001b12
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rdi, rbx
je 0x140001b74
jl 0x140001b74
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
mov rax, rdi
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x140001b3f
add rcx, r13
jmp 0x140001b42
add rcx, rax
mov rax, r12
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp - 0x49], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rbp - 0x41], ecx
lea rcx, [rbp - 0x49]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140001a80
xor r12d, r12d
mov qword [rbp - 0x59], r12
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 8]
lea r8, [rbp - 0x59]
mov rdx, r15
mov rsi, qword [rbp - 0x31]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x51], r12d
mov rdx, qword [rbp - 0x59]
add rdx, 0x3d4
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 4]
lea r8, [rbp - 0x51]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [r12 + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov dword [rbp - 0x59], r12d
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 4]
lea r8, [rbp - 0x59]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test bx, bx
je 0x140001c45
cmp dword [rbp - 0x51], 0x10081
jne 0x140001c17
cmp dword [rbp - 0x59], 0x100
jne 0x140001c17
lea ecx, [r12 + 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x59], 0x10001
jmp 0x140001c1f
mov qword [rbp - 0x59], pe_nt_image_headers64
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp - 0x59]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
movabs rbx, 0x7fffffffffffffff
movabs rdi, 0x7ffffffffff0bdbe
je 0x140001a50
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3