Function at 0x140002d30
Capabilities:
Encode data using xor
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x27], rax
movups xmm0, xmmword [0x140006630]
movups xmmword [rbp - 0x21], xmm0
mov eax, dword [0x140006640]
mov dword [rbp - 0x11], eax
cmp word [0x140006642], 0
je 0x140002db6
mov eax, 0x67
mov word [rbp - 0x21], ax
xor word [rbp - 0x1f], 0x34
xor word [rbp - 0x1d], 0x35
xor word [rbp - 0x1b], 0x36
xor word [rbp - 0x19], 0x37
xor word [rbp - 0x17], 0x38
xor word [rbp - 0x15], 0x39
xor word [rbp - 0x13], 0x3a
xor word [rbp - 0x11], 0x3b
xor word [rbp - 0xf], 0x3c
xor edx, edx
lea rcx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140002ded
lea r9d, [rax + 0x10]
lea r8, str.An_error_occurred
lea rdx, str._Please_open_FiveM
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp - 0x59], 0xdf0fdf23
mov dword [rbp - 0x55], 0xdf0ddf11
mov dword [rbp - 0x51], 0xdf35df24
mov dword [rbp - 0x4d], 0xdf5edf09
mov dword [rbp - 0x49], 0xdf5adf54
mov dword [rbp - 0x45], 0xdf2fdf5b
mov dword [rbp - 0x41], 0xdf26df36
mov dword [rbp - 0x3d], 0xdf24df32
mov dword [rbp - 0x39], 0xdf19df07
mov dword [rbp - 0x35], 0xdf1ddf14
mov dword [rbp - 0x31], 0xdf09df0a
mov dword [rbp - 0x2d], 0xdf19df55
mov dword [rbp - 0x29], 0xdf1bdf05
xor r14d, r14d
mov word [rbp - 0x25], r14w
mov byte [rbp - 0x23], 1
mov ecx, r14d
mov ebx, 0x209b
nop dword [rax]
movzx eax, cx
sub ax, bx
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002e60
mov byte [rbp - 0x23], r14b
lea rcx, [rbp - 0x59]
call fcn.140001aa0
mov r12d, eax
test eax, eax
jne 0x140003158
mov dword [rbp - 0x59], 0xdf0fdf23
mov dword [rbp - 0x55], 0xdf0ddf11
mov dword [rbp - 0x51], 0xdf35df24
mov dword [rbp - 0x4d], 0xdf5edf09
mov dword [rbp - 0x49], 0xdf5edf55
mov dword [rbp - 0x45], 0xdf2fdf5d
mov dword [rbp - 0x41], 0xdf26df36
mov dword [rbp - 0x3d], 0xdf24df32
mov dword [rbp - 0x39], 0xdf19df07
mov dword [rbp - 0x35], 0xdf1ddf14
mov dword [rbp - 0x31], 0xdf09df0a
mov dword [rbp - 0x2d], 0xdf19df55
mov dword [rbp - 0x29], 0xdf1bdf05
mov word [rbp - 0x25], r14w
mov byte [rbp - 0x23], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, cx
sub ax, bx
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002f00
mov byte [rbp - 0x23], r14b
lea rcx, [rbp - 0x59]
call fcn.140001aa0
mov r12d, eax
test eax, eax
jne 0x140003158
mov dword [rbp - 0x59], 0xdf0fdf23
mov dword [rbp - 0x55], 0xdf0ddf11
mov dword [rbp - 0x51], 0xdf35df24
mov dword [rbp - 0x4d], 0xdf5edf09
mov dword [rbp - 0x49], 0xdf57df5b
mov dword [rbp - 0x45], 0xdf2fdf56
mov dword [rbp - 0x41], 0xdf26df36
mov dword [rbp - 0x3d], 0xdf24df32
mov dword [rbp - 0x39], 0xdf19df07
mov dword [rbp - 0x35], 0xdf1ddf14
mov dword [rbp - 0x31], 0xdf09df0a
mov dword [rbp - 0x2d], 0xdf19df55
mov dword [rbp - 0x29], 0xdf1bdf05
mov word [rbp - 0x25], r14w
mov byte [rbp - 0x23], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, cx
sub ax, bx
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x1a
jb 0x140002fa0
mov byte [rbp - 0x23], r14b
lea rcx, [rbp - 0x59]
call fcn.140001aa0
mov r12d, eax
test eax, eax
jne 0x140003158
mov dword [rbp - 0x59], 0xdf0fdf23
mov dword [rbp - 0x55], 0xdf0ddf11
mov dword [rbp - 0x51], 0xdf35df24
mov dword [rbp - 0x4d], 0xdf5edf09
mov dword [rbp - 0x49], 0xdf5edf55
mov dword [rbp - 0x45], 0xdf2fdf5d
mov dword [rbp - 0x41], 0xdf26df36
mov dword [rbp - 0x3d], 0xdf24df32
mov dword [rbp - 0x39], 0xdf19df07
mov dword [rbp - 0x35], 0xdf1ddf14
mov dword [rbp - 0x31], 0xdf09df0a
mov dword [rbp - 0x2d], 0xdf19df55
mov dword [rbp - 0x29], 0xdf1bdf05
mov word [rbp - 0x25], r14w
mov byte [rbp - 0x23], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, cx
sub ax, bx
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x1a
jb 0x140003040
mov byte [rbp - 0x23], r14b
lea rcx, [rbp - 0x59]
call fcn.140001aa0
mov r12d, eax
test eax, eax
jne 0x140003158
mov dword [rbp - 0x59], 0xdf0fdf23
mov dword [rbp - 0x55], 0xdf0ddf11
mov dword [rbp - 0x51], 0xdf35df24
mov dword [rbp - 0x4d], 0xdf38df2c
mov dword [rbp - 0x49], 0xdf3edf2c
mov dword [rbp - 0x45], 0xdf1fdf1d
mov dword [rbp - 0x41], 0xdf17df12
mov dword [rbp - 0x3d], 0xdf07df00
mov dword [rbp - 0x39], 0xdf13df5b
mov dword [rbp - 0x35], 0xdf1ddf0f
mov word [rbp - 0x31], r14w
mov byte [rbp - 0x2f], 1
mov rcx, r14
nop
movzx eax, cx
sub ax, bx
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x14
jb 0x1400030c0
mov byte [rbp - 0x2f], r14b
lea rcx, [rbp - 0x59]
call fcn.140001aa0
mov r12d, eax
test eax, eax
jne 0x140003158
lea rdx, str._e_31m____Process_Not_found__0x_lX__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003be0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140006570]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003be0
lea rdx, str._e_31m____Pls_Open_FiveM_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003be0
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp - 1], 0x140a06
mov byte [rbp + 3], 1
lea rcx, [rbp - 1]
call fcn.140003590
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str._e_31m___Have_fun_playing.__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003be0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp - 0x59], 0xdf0fdf23
mov dword [rbp - 0x55], 0xdf0ddf11
mov dword [rbp - 0x51], 0xdf35df24
mov dword [rbp - 0x4d], 0xdf38df2c
mov dword [rbp - 0x49], 0xdf3edf2c
mov dword [rbp - 0x45], 0xdf1fdf1d
mov dword [rbp - 0x41], 0xdf17df12
mov dword [rbp - 0x3d], 0xdf07df00
mov dword [rbp - 0x39], 0xdf13df5b
mov dword [rbp - 0x35], 0xdf1ddf0f
mov word [rbp - 0x31], r14w
mov byte [rbp - 0x2f], 1
mov rcx, r14
nop dword [rax]
movzx eax, cx
sub ax, bx
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x14
jb 0x1400031e0
mov byte [rbp - 0x2f], r14b
lea rcx, [rbp - 0x59]
call fcn.140001aa0
mov dword [rbp - 0x59], 0xdf0fdf23
mov dword [rbp - 0x55], 0xdf0ddf11
mov dword [rbp - 0x51], 0xdf35df24
mov dword [rbp - 0x4d], 0xdf5edf09
mov dword [rbp - 0x49], 0xdf57df5b
mov dword [rbp - 0x45], 0xdf2fdf56
mov dword [rbp - 0x41], 0xdf26df36
mov dword [rbp - 0x3d], 0xdf24df32
mov dword [rbp - 0x39], 0xdf19df07
mov dword [rbp - 0x35], 0xdf1ddf14
mov dword [rbp - 0x31], 0xdf09df0a
mov dword [rbp - 0x2d], 0xdf19df55
mov dword [rbp - 0x29], 0xdf1bdf05
mov word [rbp - 0x25], r14w
mov byte [rbp - 0x23], 1
mov rcx, r14
nop dword [rax + rax]
movzx eax, cx
sub ax, bx
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x1a
jb 0x140003270
mov byte [rbp - 0x23], r14b
lea rcx, [rbp - 0x59]
call fcn.140001aa0
cmp r12d, eax
jne 0x14000340d
mov edx, 0x64
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140002770
mov ebx, eax
mov ecx, eax
call fcn.140001b60
mov rdi, rax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov dword [rbp - 0x59], 0x80
mov dword [rbp - 0x55], 8
mov dword [rbp - 0x51], 0x18
mov dword [rbp - 0x4d], 8
mov qword [rbp - 0x49], 0x10
mov dword [rbp - 0x41], 0x3cc
mov ecx, 0x1c
call fcn.1400041a0
mov r13, rax
mov qword [rbp + 0xf], rax
lea r15, [rax + 0x1c]
mov qword [rbp + 0x1f], r15
mov r8d, 0x1c
lea rdx, [rbp - 0x59]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x17], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov ecx, 0x1c
call fcn.1400041a0
mov qword [rbp - 0x21], rax
lea rbx, [rax + 0x1c]
mov qword [rbp - 0x11], rbx
mov r8d, 0x1c
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x19], rbx
lea r8, [rbp - 0x21]
lea rdx, [rdi + 0x1eb17a8]
mov rcx, rsi
call fcn.140001c10
mov rbx, rax
mov dword [rbp + 7], 0
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp + 7]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 1], 0
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rbp - 1]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.1400029d0
call fcn.140002b80
call fcn.140002820
nop
test r13, r13
je 0x140003408
sub r15, r13
and r15, 0xfffffffffffffffc
cmp r15, 0x1000
jb 0x1400033fd
add r15, 0x27
mov rcx, qword [r13 - 8]
sub r13, rcx
lea rax, [r13 - 8]
cmp rax, 0x1f
ja 0x14000354d
mov r13, rcx
mov rdx, r15
mov rcx, r13
call fcn.14000441c
mov ebx, 0x209b
mov dword [rbp - 0x59], 0xdf0fdf23
mov dword [rbp - 0x55], 0xdf0ddf11
mov dword [rbp - 0x51], 0xdf35df24
mov dword [rbp - 0x4d], 0xdf5edf09
mov dword [rbp - 0x49], 0xdf5adf54
mov dword [rbp - 0x45], 0xdf2fdf5b
mov dword [rbp - 0x41], 0xdf26df36
mov dword [rbp - 0x3d], 0xdf24df32
mov dword [rbp - 0x39], 0xdf19df07
mov dword [rbp - 0x35], 0xdf1ddf14
mov dword [rbp - 0x31], 0xdf09df0a
mov dword [rbp - 0x2d], 0xdf19df55
mov dword [rbp - 0x29], 0xdf1bdf05
mov word [rbp - 0x25], r14w
mov byte [rbp - 0x23], 1
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
sub ax, bx
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x1a
jb 0x140003480
mov byte [rbp - 0x23], 0
lea rcx, [rbp - 0x59]
call fcn.140001aa0
mov dword [rbp - 0x59], 0xdf0fdf23
mov dword [rbp - 0x55], 0xdf0ddf11
mov dword [rbp - 0x51], 0xdf35df24
mov dword [rbp - 0x4d], 0xdf5edf09
mov dword [rbp - 0x49], 0xdf5edf55
mov dword [rbp - 0x45], 0xdf2fdf5d
mov dword [rbp - 0x41], 0xdf26df36
mov dword [rbp - 0x3d], 0xdf24df32
mov dword [rbp - 0x39], 0xdf19df07
mov dword [rbp - 0x35], 0xdf1ddf14
mov dword [rbp - 0x31], 0xdf09df0a
mov dword [rbp - 0x2d], 0xdf19df55
mov dword [rbp - 0x29], 0xdf1bdf05
mov word [rbp - 0x25], r14w
mov byte [rbp - 0x23], 1
nop word [rax + rax]
movzx eax, r14w
sub ax, bx
xor word [rbp + r14*2 - 0x59], ax
inc r14
cmp r14, 0x1a
jb 0x140003510
mov byte [rbp - 0x23], 0
lea rcx, [rbp - 0x59]
call fcn.140001aa0
cmp r12d, eax
jne 0x140003554
nop dword [rax + rax]
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x140003540
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140004180
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret