Function at 0x140001000
Capabilities:
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rdi, str.Enabled
xor ebx, ebx
lea rsi, str.H.o.l.o
nop
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001042
cmp byte [0x14000562a], bl
mov byte [0x140005629], bl
sete byte [0x14000562a]
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000106a
mov eax, dword [0x140005630]
cmp eax, 3
jge 0x14000106a
inc eax
mov byte [0x140005629], bl
mov dword [0x140005630], eax
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001091
mov eax, dword [0x140005630]
test eax, eax
jle 0x140001091
dec eax
mov byte [0x140005629], bl
mov dword [0x140005630], eax
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400010b5
cmp byte [0x140005628], bl
mov byte [0x140005629], bl
sete byte [0x140005628]
jmp 0x1400010c1
cmp byte [0x140005629], bl
jne 0x1400011de
lea rcx, [0x1400032e0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x14000562a], bl
lea rdx, str.Disabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmovne rdx, rdi
call fcn.140001910
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [0x140005628], bl
lea rdx, str.No_H.o.l.o
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmovne rdx, rsi
call fcn.140001910
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [0x140005630], ebx
jne 0x140001153
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.mode:_A.K
call fcn.140001910
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [0x140005630], 1
jne 0x14000117f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.mode:_M.P.5
call fcn.140001910
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [0x140005630], 2
jne 0x1400011ab
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.mode:_S.A.R
call fcn.140001910
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [0x140005630], 3
jne 0x1400011d7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.mode:_P.H.Y.T.H.O.N
call fcn.140001910
mov rcx, rax
lea rdx, [0x140001ae0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov byte [0x140005629], 1
cmp dword [0x140005630], ebx
jne 0x140001482
cmp byte [0x140005628], bl
mov ecx, 1
je 0x14000134f
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001342
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001342
cmp byte [0x14000562a], bl
je 0x140001342
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x1400012e5
cmp dword [0x14000562c], 0xa
jge 0x14000126b
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 5]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14000562c]
add eax, 0xfffffff5
cmp eax, 0x21
ja 0x14000129f
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov edx, 0xffffffff
lea r8d, [r9 + 5]
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14000562c], 0x2d
jle 0x14000132f
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov edx, 0xfffffffd
lea r8d, [r9 + 5]
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14000562c]
inc eax
mov dword [0x14000562c], eax
jmp 0x140001482
xor r9d, r9d
mov qword [rsp + 0x20], rbx
cmp dword [0x14000562c], 0xa
lea ecx, [r9 + 1]
jge 0x140001313
xor edx, edx
lea r8d, [r9 + 4]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001324
mov edx, 0xffffffff
mov r8d, 2
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14000562c]
inc eax
mov dword [0x14000562c], eax
jmp 0x140001482
mov eax, ebx
mov dword [0x14000562c], ebx
jmp 0x140001482
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000147c
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000147c
cmp byte [0x14000562a], bl
je 0x14000147c
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x14000142a
cmp dword [0x14000562c], 0xa
jge 0x1400013bf
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 4]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14000562c]
add eax, 0xfffffff5
cmp eax, 0x21
ja 0x1400013f3
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov edx, 0xffffffff
lea r8d, [r9 + 5]
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14000562c], 0x2d
jle 0x140001474
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov edx, 0xfffffffd
lea r8d, [r9 + 4]
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x14000562c]
jmp 0x140001482
xor r9d, r9d
mov qword [rsp + 0x20], rbx
cmp dword [0x14000562c], 0xa
lea ecx, [r9 + 1]
jge 0x140001458
xor edx, edx
lea r8d, [r9 + 4]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001469
mov edx, 0xffffffff
mov r8d, 2
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x14000562c]
jmp 0x140001482
mov dword [0x14000562c], ebx
cmp dword [0x140005630], 1
jne 0x1400015cf
cmp byte [0x140005628], bl
mov ecx, 1
je 0x14000155f
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001555
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001555
cmp byte [0x14000562a], bl
je 0x140001555
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x140001521
cmp dword [0x14000562c], 0xa
jge 0x140001513
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 2]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14000562c], 0xa
jle 0x140001545
mov r8d, 3
lea ecx, [r8 - 2]
jmp 0x14000152a
mov r8d, 1
mov ecx, r8d
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14000562c]
inc eax
mov dword [0x14000562c], eax
jmp 0x1400015cf
mov eax, ebx
mov dword [0x14000562c], ebx
jmp 0x1400015cf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400015c9
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400015c9
cmp byte [0x14000562a], bl
je 0x1400015c9
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
shr eax, 0xf
xor edx, edx
test al, 1
jne 0x1400015a7
lea r8d, [r9 + 2]
lea ecx, [rdx + 1]
jmp 0x1400015b0
mov r8d, 1
mov ecx, r8d
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x14000562c]
jmp 0x1400015cf
mov dword [0x14000562c], ebx
cmp dword [0x140005630], 2
jne 0x1400016c7
cmp byte [0x140005628], bl
mov ecx, 1
je 0x14000165e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001654
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001654
cmp byte [0x14000562a], bl
je 0x140001654
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
shr eax, 0xf
lea ecx, [rdx + 1]
lea r8d, [r9 + 4]
test cl, al
je 0x140001633
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14000562c]
inc eax
mov dword [0x14000562c], eax
jmp 0x1400016c7
mov eax, ebx
mov dword [0x14000562c], ebx
jmp 0x1400016c7
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400016c1
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400016c1
cmp byte [0x14000562a], bl
je 0x1400016c1
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
shr eax, 0xf
lea ecx, [rdx + 1]
lea r8d, [r9 + 3]
test cl, al
je 0x1400016a8
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x14000562c]
jmp 0x1400016c7
mov dword [0x14000562c], ebx
cmp dword [0x140005630], 3
jne 0x140001020
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001905
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001905
cmp byte [0x14000562a], bl
je 0x140001905
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edx, edx
mov qword [rsp + 0x20], rbx
shr eax, 0xf
xor r9d, r9d
lea ecx, [rdx + 1]
test cl, al
jne 0x1400018c1
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 9]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x14000562c]
jmp 0x140001020
mov r8d, 0xa
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea r8d, [r9 + 0xa]
lea ecx, [rdx + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x14000562c]
jmp 0x140001020
mov dword [0x14000562c], ebx
jmp 0x140001020