Function at 0x14005a5ac
Capabilities:
Execute command
Get common file path
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1400b8040]
xor rax, rsp
mov qword [rbp + 0xb0], rax
lea rcx, [0x1400ad8f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rbx, [0x1400b8250]
test eax, eax
js 0x14005a68e
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea rax, [rbp - 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14005a627
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x38]
call fcn.140011cfc
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14000aba0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14005a6a9
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a687
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005a687
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005ed48
jmp 0x14005a6a9
lea rdx, str._cheat_:_Cant_get_documents_path
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400106f8
mov rcx, rax
call fcn.140010868
call fcn.1400046f0
mov esi, 1
test al, al
jne 0x14005a6bb
xor al, al
jmp 0x14005a6d7
call fcn.1400051cc
test al, al
je 0x14005a6b7
mov rcx, rbx
call fcn.1400056e8
mov rcx, rbx
call fcn.140006258
mov al, sil
lea rdx, str._cheat_:_Failed_to_initialize_configs_n
lea rcx, str._cheat_:_Succesfly_initialized_configs_n
test al, al
cmove rcx, rdx
call fcn.14001d830
call fcn.1400048bc
test al, al
je 0x14005a95d
lea rdx, str._cheat_:_Succesfly_downloaded_offsets
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400106f8
mov rcx, rax
call fcn.140010868
call fcn.14005ab34
test al, al
je 0x14005a951
lea rcx, str._cheat_:_Succesfly_initialized_offsets_n
call fcn.14001d830
lea rcx, [0x1400b82c0]
call fcn.14005bde0
test al, al
je 0x14005a948
lea rcx, str._cheat_:_Succesfly_created_overlay_n
call fcn.14001d830
mov rbx, qword [0x1400b9398]
mov ecx, 0x6270
call fcn.140022834
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14005a786
xor edx, edx
mov rcx, rax
call fcn.14001d938
nop
mov qword [0x1400b9398], rax
call fcn.140021134
test rbx, rbx
je 0x14005a79e
mov qword [0x1400b9398], rbx
call fcn.14001bc0c
call fcn.14001b670
lea rcx, [0x1400b82c0]
call fcn.14005bf4c
lea rcx, str._cheat_:_Starting_main_loop_n_n
call fcn.14001d830
cmp byte [0x1400b8310], 0
jne 0x14005a938
mov ebx, 0xffffffec
jmp 0x14005a7f1
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [rsp + 0x78], 0x12
je 0x14005a80e
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14005a7d4
jmp 0x14005a815
mov byte [0x1400b8310], sil
cmp byte [0x1400b8310], sil
je 0x14005a938
movzx ecx, word [0x1400b818c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test sil, al
jne 0x14005a938
movzx ecx, word [0x1400b8190]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test sil, al
je 0x14005a858
cmp byte [0x1400b8240], 0
sete byte [0x1400b8240]
mov rax, qword [0x1400b9398]
test rax, rax
je 0x14005a86d
mov rcx, qword [rax + 0x98]
jmp 0x14005a86f
xor ecx, ecx
cmp qword [rcx + 0x48], 0
jne 0x14005a87b
call fcn.140043afc
call fcn.140044744
call fcn.140023214
cmp byte [0x1400b8240], 0
je 0x14005a89b
call fcn.14001bd94
mov r8d, 8
jmp 0x14005a8a1
mov r8d, 0x80028
mov edx, ebx
mov rcx, qword [0x1400b8338]
call qword [sym.imp.USER32.dll_SetWindowLongW]
call fcn.140001d04
call fcn.140024d98
mov rcx, qword [0x1400b8348]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1400b8360]
mov edx, esi
call qword [rax + 0x108]
mov rcx, qword [0x1400b8348]
mov rax, qword [rcx]
lea r8, [0x1400b8324]
mov rdx, qword [0x1400b8360]
call qword [rax + 0x190]
mov rax, qword [0x1400b9398]
mov rcx, qword [rax + 0x4b28]
mov rdx, qword [rcx]
add rdx, 0x48
mov al, byte [rdx]
neg al
sbb rcx, rcx
and rcx, rdx
call fcn.140042f30
mov rcx, qword [0x1400b8350]
mov r9, qword [rcx]
xor r8d, r8d
mov edx, esi
call qword [r9 + 0x40]
cmp byte [0x1400b8310], 0
je 0x14005a7f1
lea rcx, [0x1400b82c0]
call fcn.14005c098
mov eax, esi
jmp 0x14005a95f
lea rcx, str._cheat_:_Failed_to_create_overlay_n
jmp 0x14005a958
lea rcx, str._cheat_:_Failed_to_initialize_offsets_n
call fcn.14001d830
xor eax, eax
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14005e8f0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret