Function at 0x18000d310
Capabilities:
Create directory
Delete file
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
xor edi, edi
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, str.Russian
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
xor edx, edx
lea rcx, str.C:VISION
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.18001d320
movss xmm6, dword [rax + 8]
call fcn.18001d530
addss xmm6, xmm6
subss xmm0, xmm6
movss dword [rbp + 0x67], xmm0
mov dword [rbp + 0x6b], 0x41f00000
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 0x10]
lea r8, [0x18043f618]
lea rdx, str.Search_Config
lea rcx, [0x1800c1c60]
call fcn.1800548d0
xor ecx, ecx
call fcn.18001e8c0
test al, al
je 0x18000d3de
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea edx, [rdi + 0x50]
mov r9d, 0x409
lea r8d, [rdi + 1]
call qword [sym.imp.USER32.dll_PostMessageA]
call fcn.18001d320
movss xmm6, dword [rax + 8]
call fcn.18001d530
addss xmm6, xmm6
subss xmm0, xmm6
movss dword [rbp + 0x67], xmm0
mov dword [rbp + 0x6b], 0x41f00000
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r14, [0x18043f5f8]
mov r8, r14
lea rdx, str.Config_Name
lea rcx, [0x1800c1c74]
call fcn.1800548d0
xor ecx, ecx
call fcn.18001e8c0
test al, al
je 0x18000d464
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov edx, 0x50
mov r9d, 0x409
lea r8d, [rdx - 0x4f]
call qword [sym.imp.USER32.dll_PostMessageA]
call fcn.18001d320
movss xmm6, dword [rax + 8]
call fcn.18001d530
addss xmm6, xmm6
subss xmm0, xmm6
movss dword [rbp + 0x67], xmm0
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Create
call fcn.18004ef10
test al, al
je 0x18000d4a0
call fcn.18000dc40
call fcn.18001d320
movss xmm6, dword [rax + 8]
call fcn.18001d530
addss xmm6, xmm6
subss xmm0, xmm6
movss dword [rbp + 0x67], xmm0
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Delete
call fcn.18004ef10
mov rbx, 0xffffffffffffffff
movabs rcx, 0x7fffffffffffffff
lea rsi, str.C:VISION_
movabs rdx, 0x8000000000000000
lea r8d, [rbx + 0x17]
lea r13, [0x18043f940]
test al, al
je 0x18000d7e1
mov r12, qword [0x18043e888]
mov rdi, rbx
inc rdi
cmp byte [r14 + rdi], 0
jne 0x18000d512
mov rax, rcx
sub rax, r12
cmp rax, rdi
jb 0x18000dc37
mov r13, rsi
cmp qword [0x18043e890], 0xf
cmova r13, qword [str.C:VISION_]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x39], xmm1
lea r15, [rdi + r12]
mov esi, 0xf
lea r14, [rbp - 0x49]
cmp r15, rsi
jbe 0x18000d5ca
mov rsi, r15
or rsi, 0xf
cmp rsi, rcx
jbe 0x18000d591
mov rsi, rcx
lea rax, [rdx + 0x27]
mov rcx, rax
call fcn.18005e95c
test rax, rax
je 0x18000d6fa
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x18000d5c6
cmp rsi, r8
cmovb rsi, r8
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18000d5b4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000dc2b
jmp 0x18000d572
test rcx, rcx
je 0x18000d5c3
call fcn.18005e95c
mov r14, rax
jmp 0x18000d5c6
xor r14d, r14d
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x31], rsi
mov r8, r12
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r14 + r12]
mov r8, rdi
lea rdx, [0x18043f5f8]
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + r15], 0
mov rcx, qword [rbp - 0x39]
mov rdx, qword [rbp - 0x31]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x18000d633
lea rax, [rcx + 4]
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x49]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x49]
mov dword [rax + rcx], 0x696e692e
mov byte [rax + rcx + 4], 0
lea rax, [rbp - 0x49]
jmp 0x18000d656
mov qword [rsp + 0x20], 4
lea r9, str..ini
movzx r8d, byte [rbp + 0x67]
mov edx, 4
lea rcx, [rbp - 0x49]
call fcn.180001720
movups xmm0, xmmword [rax]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 7], xmm1
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
lea rdx, [rbp - 9]
lea r13, [0x18043f940]
mov rcx, r13
call fcn.180004970
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x18000d6c8
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d6c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d6c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005e998
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x18000d706
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d701
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d701
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005e998
mov rcx, r13
cmp qword [0x18043f958], 0xf
cmova rcx, qword [0x18043f940]
mov qword [0x18043f5f0], rcx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rbp - 0x49]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov r8, rbx
lea r14, [0x18043f5f8]
nop word [rax + rax]
inc r8
cmp byte [r14 + r8], 0
jne 0x18000d750
mov rdx, r14
lea rcx, [rbp - 0x49]
call fcn.180001610
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rdi
mov ecx, 0x20
call fcn.18005e95c
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], 0x19
mov qword [rbp - 0x11], 0x1f
movups xmm0, xmmword [str.C:VISIONConfig_List.ini]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1800c1c18]
movsd qword [rax + 0x10], xmm0
movzx ecx, byte [0x1800c1c20]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], 0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x29]
call fcn.18000e700
xorps xmm0, xmm0
movups xmmword [0x18043f5f8], xmm0
xorps xmm1, xmm1
movups xmmword [0x18043f618], xmm1
lea rsi, str.C:VISION_
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18000dad2
mov r12, qword [0x18043e888]
mov rdi, rbx
nop
inc rdi
cmp byte [r14 + rdi], 0
jne 0x18000d800
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r12
cmp rax, rdi
jb 0x18000dc25
cmp qword [0x18043e890], 0xf
cmova rsi, qword [str.C:VISION_]
mov qword [rbp + 0x67], rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
lea r15, [r12 + rdi]
mov esi, 0xf
lea r14, [rbp - 0x29]
cmp r15, rsi
jbe 0x18000d8d6
mov rsi, r15
or rsi, 0xf
cmp rsi, rcx
jbe 0x18000d890
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18005e95c
test rax, rax
je 0x18000d8b9
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x18000d8d2
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18000d8c0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000dc31
jmp 0x18000d875
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x18000d8cf
call fcn.18005e95c
mov r14, rax
jmp 0x18000d8d2
xor r14d, r14d
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], rsi
mov r8, r12
mov rdx, qword [rbp + 0x67]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r14 + r12]
mov r8, rdi
lea rdi, [0x18043f5f8]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + r15], 0
mov rcx, qword [rbp - 0x19]
mov rdx, qword [rbp - 0x11]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x18000d943
lea rax, [rcx + 4]
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x29]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x29]
mov dword [rax + rcx], 0x696e692e
mov byte [rax + rcx + 4], 0
lea rax, [rbp - 0x29]
jmp 0x18000d966
mov qword [rsp + 0x20], 4
lea r9, str..ini
movzx r8d, byte [rbp + 0x67]
mov edx, 4
lea rcx, [rbp - 0x29]
call fcn.180001720
movups xmm0, xmmword [rax]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 7], xmm1
xor esi, esi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea rdx, [rbp - 9]
mov rcx, r13
call fcn.180004970
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x18000d9d1
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d9cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d9cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005e998
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x18000da0f
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000da0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000da0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005e998
cmp qword [0x18043f958], 0xf
cmova r13, qword [0x18043f940]
mov qword [0x18043f5f0], r13
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rbp - 0x49]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], rsi
inc rbx
cmp byte [rdi + rbx], 0
jne 0x18000da46
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x49]
call fcn.180001610
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], rsi
mov ecx, 0x20
call fcn.18005e95c
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], 0x19
mov qword [rbp - 0x11], 0x1f
movups xmm0, xmmword [str.C:VISIONConfig_List.ini]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1800c1c18]
movsd qword [rax + 0x10], xmm0
movzx ecx, byte [0x1800c1c20]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], 0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x29]
call fcn.18000e700
xorps xmm0, xmm0
movups xmmword [0x18043f5f8], xmm0
xorps xmm1, xmm1
movups xmmword [0x18043f618], xmm1
call fcn.18001d320
movss xmm6, dword [rax + 8]
call fcn.18001d530
addss xmm6, xmm6
subss xmm0, xmm6
movss dword [rbp + 0x67], xmm0
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Load
call fcn.18004ef10
test al, al
je 0x18000db22
call fcn.18000f410
xorps xmm0, xmm0
movups xmmword [0x18043f5f8], xmm0
xorps xmm1, xmm1
movups xmmword [0x18043f618], xmm1
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18000db4b
call fcn.18000f410
xorps xmm0, xmm0
movups xmmword [0x18043f5f8], xmm0
xorps xmm1, xmm1
movups xmmword [0x18043f618], xmm1
call fcn.18001d320
movss xmm6, dword [rax + 8]
call fcn.18001d530
addss xmm6, xmm6
subss xmm0, xmm6
movss dword [rbp + 0x67], xmm0
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Save
call fcn.18004ef10
test al, al
je 0x18000db9b
call fcn.18000c8e0
xorps xmm0, xmm0
movups xmmword [0x18043f5f8], xmm0
xorps xmm1, xmm1
movups xmmword [0x18043f618], xmm1
call fcn.18001d320
movss xmm6, dword [rax + 8]
call fcn.18001d530
addss xmm6, xmm6
subss xmm0, xmm6
movss dword [rbp + 0x67], xmm0
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Reset
call fcn.18004ef10
test al, al
je 0x18000dc02
cmp byte [0x18043f5f8], 0
je 0x18000dc02
movaps xmm0, xmmword [0x1800c24b0]
movups xmmword [0x1801425b8], xmm0
call fcn.18000c8e0
xorps xmm0, xmm0
movups xmmword [0x18043f5f8], xmm0
xorps xmm1, xmm1
movups xmmword [0x18043f618], xmm1
mov rbx, qword [rsp + 0x100]
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180001e50
int3
call fcn.180001e30
int3
call fcn.180001e30
int3
call fcn.180001e50
int3