Function at 0x1400362f0
Capabilities:
Create thread
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x108]
sub rsp, 0x200
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x1400d8040]
xor rax, rsp
mov qword [rbp + 0xd8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea r8d, [rdi + 0x35]
lea rdx, str.Debugging_is_disabled_after_compilation_is_completed.
lea rcx, [rsp + 0x30]
call fcn.1400cb110
nop
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400363be
lea rdx, [0x1400cef56]
lea rcx, [rsp + 0x30]
call fcn.140039d10
test al, al
je 0x1400363a4
lea r8, str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140039a50
mov rcx, rax
call fcn.1400386d0
mov rcx, rax
call fcn.140003640
lea rcx, [rsp + 0x50]
call fcn.140038980
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400363ff
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400363f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400363f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cc370
nop
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
and dword [rbp + 0x10], 0xffffffbf
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, dword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x1400cef64]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov edx, 0xa
mov r9d, 0x258
mov r8d, edx
call qword [sym.imp.USER32.dll_MoveWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r8d, 0x13
lea rdx, str.Load_Thread:_main__
lea rcx, [rsp + 0x30]
call fcn.1400cb110
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140008490
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400d9060]
lea rcx, [rsp + 0x50]
call fcn.140038a20
mov rcx, rax
call fcn.140007b80
test eax, eax
jne 0x140036510
lea rdx, [0x1400d9118]
lea rcx, [rsp + 0x50]
call fcn.140038a20
mov rbx, rax
lea rdx, [0x1400d9060]
lea rcx, [rsp + 0x30]
call fcn.140038a20
mov rcx, rax
mov rdx, rbx
call fcn.140007c10
call fcn.140008340
int3
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x140018280]
mov qword [rax], rcx
lea rcx, [rbp + 0xd0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xc8], rax
test rax, rax
je 0x140036b8d
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x140026550]
mov qword [rax], rcx
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xb8], rax
test rax, rax
je 0x140036b7b
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x14002afd0]
mov qword [rax], rcx
lea rcx, [rbp + 0xb0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xa8], rax
test rax, rax
je 0x140036b69
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x14002b1c0]
mov qword [rax], rcx
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x98], rax
test rax, rax
je 0x140036b57
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x14002be70]
mov qword [rax], rcx
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x88], rax
test rax, rax
je 0x140036b45
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x14002c5c0]
mov qword [rax], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x78], rax
test rax, rax
je 0x140036b33
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x14002c940]
mov qword [rax], rcx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x68], rax
test rax, rax
je 0x140036b24
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x14002d580]
mov qword [rax], rcx
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x58], rax
test rax, rax
je 0x140036b15
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x14002d810]
mov qword [rax], rcx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140036b06
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x140032600]
mov qword [rax], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x38], rax
test rax, rax
je 0x140036af7
mov ecx, 8
call fcn.1400cc45c
lea rdx, [0x140034310]
mov qword [rax], rdx
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x28], rax
test rax, rax
je 0x140036ae8
mov ecx, 8
call fcn.1400cc45c
lea rcx, [0x140036010]
mov qword [rax], rcx
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400cc270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x18], rax
test rax, rax
je 0x140036ad9
mov esi, 0xff
lea r14, [0x1400d9028]
movsd xmm7, qword [0x1400d1528]
movsd xmm6, qword [0x1400d1508]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140036894
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140036aa9
mov ecx, dword [0x1400d8f1c]
movsx eax, word [0x1400d8b78]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x1400d8e54]
cmp dword [0x1400d80d4], 0
je 0x1400368ce
cvtps2pd xmm2, xmm0
divsd xmm2, xmm7
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm2, xmm0
jmp 0x1400368e1
movd xmm2, eax
cvtdq2pd xmm2, xmm2
cvtps2pd xmm1, xmm0
divsd xmm1, xmm6
subsd xmm2, xmm1
cvttsd2si ebx, xmm2
mov word [0x1400d8b78], bx
movsx eax, bx
cmp eax, ecx
jl 0x1400368ff
movzx ebx, cx
mov word [0x1400d8b78], cx
jmp 0x14003690e
test bx, bx
jg 0x14003690e
movzx ebx, di
mov word [0x1400d8b78], bx
cmp bx, si
jl 0x140036918
movzx ebx, si
jmp 0x140036920
test bx, bx
jg 0x140036920
movzx ebx, di
mov r9d, 2
movzx r8d, bl
xor edx, edx
mov rcx, qword [0x1400d8fa8]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movsx eax, bx
mov dword [0x1400d8fa0], eax
mov ebx, dword [0x1400d8ff0]
cmp dword [0x1400d8c68], 0
jne 0x140036973
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003696a
mov dword [0x1400d8c68], 1
jmp 0x140036986
cmp dword [0x1400d8c68], 0
je 0x1400369a1
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140036998
mov dword [0x1400d8c68], edi
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
cmp dword [0x1400d8c68], 0
jne 0x1400369c7
mov rcx, qword [0x1400d8fa8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov rcx, qword [0x1400d8fa8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x1400369e2
cmp word [0x1400d8b78], 0
jne 0x1400369e0
xor edx, edx
mov rcx, qword [0x1400d8fa8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, edi
mov dword [0x1400d80d4], eax
lea rdx, [rsp + 0x70]
call fcn.14000ab80
mov rdx, rax
lea rcx, [0x1400d8d80]
call fcn.140036ba0
lea rcx, [rsp + 0x70]
call fcn.1400122e0
cmp dword [0x1400d8d64], 0
jne 0x140036a3e
mov rax, qword [0x1400d8e08]
mov ecx, dword [rax + 0xc]
mov edx, dword [rax + 0x10]
mov r8d, dword [rax + 0x14]
mov dword [0x1400d8dbc], ecx
mov dword [0x1400d8dc0], edx
mov dword [0x1400d8dc4], r8d
mov dword [0x1400d8dc8], esi
cmp qword [0x1400d9038], 0
jne 0x140036a78
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r8d, 7
lea rdx, str.Verdana
lea rcx, [rsp + 0x30]
call fcn.1400cb110
lea rdx, [rsp + 0x30]
jmp 0x140036a88
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140038a20
mov rdx, rax
call fcn.140009fe0
mov eax, dword [0x1400d90a8]
mov dword [0x1400d8f90], eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140036870
mov edx, gethostbyname
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.140003df0
lea edx, [r8 + 1]
mov rcx, qword [rax]
call fcn.140007010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0x20], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x30], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x40], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x50], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x60], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x70], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x80], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x90], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0xa0], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0xb0], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0xc0], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0xd0], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3