Function at 0x14001148d
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
jmp 0x1400190b0
push rbp
push rdi
sub rsp, 0x568
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xf2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140029028]
xor rax, rbp
mov qword [rbp + 0x530], rax
lea rcx, [0x14002f0e4]
call fcn.14001169f
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
lea r8, [0x140024877]
lea rdx, str.Waru_Program_Running_Blackroud_Start_Key_Tab_Exit_Key_End
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea r8, [0x140029478]
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_
lea rcx, [rbp + 0x1c8]
call fcn.14001104b
mov qword [rbp + 0x4f8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x500], rax
lea r8, [0x1400248c0]
mov rdx, qword [rbp + 0x500]
lea rcx, [rbp + 8]
call fcn.14001162c
nop
lea rcx, [rbp + 0x1c8]
call fcn.14001113b
lea rcx, [rbp + 8]
call fcn.1400110a5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [0x140029004]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x1400194ae
mov ecx, dword [section..data]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140019484
mov edx, 0xc8
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Beep]
lea r8, [0x140029478]
lea rdx, str.netsh_advfirewall_firewall_add_rule_name__
lea rcx, [rbp + 0x208]
call fcn.14001104b
mov qword [rbp + 0x4f8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x500], rax
lea r8, str.__dirout_actionblock_program_
mov rdx, qword [rbp + 0x500]
lea rcx, [rbp + 0x248]
call fcn.14001162c
mov qword [rbp + 0x508], rax
mov rax, qword [rbp + 0x508]
mov qword [rbp + 0x510], rax
lea r8, [0x140029450]
mov rdx, qword [rbp + 0x510]
lea rcx, [rbp + 0x288]
call fcn.140011221
mov qword [rbp + 0x518], rax
mov rax, qword [rbp + 0x518]
mov qword [rbp + 0x520], rax
lea r8, [0x1400248c0]
mov rdx, qword [rbp + 0x520]
lea rcx, [rbp + 0x2c8]
call fcn.14001162c
mov qword [rbp + 0x528], rax
mov rdx, qword [rbp + 0x528]
lea rcx, [rbp + 8]
call fcn.1400111c7
lea rcx, [rbp + 0x2c8]
call fcn.14001113b
nop
lea rcx, [rbp + 0x288]
call fcn.14001113b
nop
lea rcx, [rbp + 0x248]
call fcn.14001113b
nop
lea rcx, [rbp + 0x208]
call fcn.14001113b
lea rcx, [rbp + 8]
call fcn.1400110a5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WinExec]
lea r8, [0x140029478]
lea rdx, str.netsh_advfirewall_firewall_add_rule_name__
lea rcx, [rbp + 0x308]
call fcn.14001104b
mov qword [rbp + 0x4f8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x500], rax
lea r8, str.__dirin_actionblock_program_
mov rdx, qword [rbp + 0x500]
lea rcx, [rbp + 0x348]
call fcn.14001162c
mov qword [rbp + 0x508], rax
mov rax, qword [rbp + 0x508]
mov qword [rbp + 0x510], rax
lea r8, [0x140029450]
mov rdx, qword [rbp + 0x510]
lea rcx, [rbp + 0x388]
call fcn.140011221
mov qword [rbp + 0x518], rax
mov rax, qword [rbp + 0x518]
mov qword [rbp + 0x520], rax
lea r8, [0x1400248c0]
mov rdx, qword [rbp + 0x520]
lea rcx, [rbp + 0x3c8]
call fcn.14001162c
mov qword [rbp + 0x528], rax
mov rdx, qword [rbp + 0x528]
lea rcx, [rbp + 8]
call fcn.1400111c7
lea rcx, [rbp + 0x3c8]
call fcn.14001113b
nop
lea rcx, [rbp + 0x388]
call fcn.14001113b
nop
lea rcx, [rbp + 0x348]
call fcn.14001113b
nop
lea rcx, [rbp + 0x308]
call fcn.14001113b
lea rcx, [rbp + 8]
call fcn.1400110a5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, [0x140029008]
lea rcx, [rbp + 0x408]
call fcn.1400114e2
mov rcx, rax
call fcn.140011582
lea r8, [0x140029478]
lea rdx, str.netsh_advfirewall_firewall_delete_rule_name_
lea rcx, [rbp + 0x428]
call fcn.14001104b
mov qword [rbp + 0x4f8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x500], rax
lea r8, [0x1400248c0]
mov rdx, qword [rbp + 0x500]
lea rcx, [rbp + 0x468]
call fcn.14001162c
mov qword [rbp + 0x508], rax
mov rdx, qword [rbp + 0x508]
lea rcx, [rbp + 8]
call fcn.1400111c7
lea rcx, [rbp + 0x468]
call fcn.14001113b
nop
lea rcx, [rbp + 0x428]
call fcn.14001113b
lea rcx, [rbp + 8]
call fcn.1400110a5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WinExec]
mov edx, 0xc8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
mov dword [rbp + 0x4c4], 5
lea rdx, [rbp + 0x4c4]
lea rcx, [rbp + 0x4a8]
call fcn.1400114e2
mov rcx, rax
call fcn.140011582
jmp 0x14001917e
mov edx, 0xc8
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Beep]
mov dword [rbp + 0x4e4], 0
lea rcx, [rbp + 8]
call fcn.14001113b
mov eax, dword [rbp + 0x4e4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400240c0]
call fcn.140011596
mov eax, edi
mov rcx, qword [rbp + 0x530]
xor rcx, rbp
call fcn.14001132a
lea rsp, [rbp + 0x548]
pop rdi
pop rbp
ret