Function at 0x140051430
Capabilities:
Get token membership
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140096fc0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov word [rbp + 0x1b], 0x500
lea rax, [rbp + 0x1f]
mov dword [rbp + 0x2f], edi
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x17]
mov dword [rsp + 0x48], edi
mov r9d, 0x220
mov dword [rsp + 0x40], edi
mov r8d, 0x20
mov dword [rsp + 0x38], edi
mov dl, 2
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rbp + 0x1f], rdi
mov dword [rbp + 0x17], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400514b9
mov rdx, qword [rbp + 0x1f]
lea r8, [rbp + 0x2f]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp dword [rbp + 0x2f], edi
jne 0x1400514f1
lea rdx, str.This_program_must_be_run_as_an_administrator_
call fcn.14000d150
lea rdx, [0x14000d330]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov eax, 1
jmp 0x1400518e7
lea rdx, str.Insert:_Toggle_Menu
mov qword [rsp + 0xb0], rbx
call fcn.14000d150
lea rdx, [0x14000d330]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Delete:_Exit
call fcn.14000d150
lea rdx, [0x14000d330]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Counter_Strike_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
mov qword [0x14009b090], rax
lea rdx, [rbp + 0x37]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rbp + 0x1f]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp + 0x27]
mov r9d, dword [rbp + 0x37]
mov r8d, dword [rbp + 0x23]
mov eax, dword [rbp + 0x1f]
sub eax, ecx
sub ecx, dword [rbp + 0x1f]
sub eax, r9d
mov dword [0x1400972cc], ecx
add eax, dword [rbp + 0x3f]
mov ecx, dword [rbp + 0x2b]
cdq
sub ecx, r8d
sub eax, edx
sub r8d, dword [rbp + 0x2b]
sar eax, 1
sub r8d, eax
mov dword [0x1400972c8], ecx
add r8d, dword [rbp + 0x43]
mov dword [0x14009b07c], r8d
lea ecx, [r9 + rax]
mov dword [0x14009b078], ecx
call fcn.1400560d0
mov edx, 1
mov ecx, 0x2000d
call fcn.140054e60
mov edx, 1
mov ecx, 0x2000a
call fcn.140054e60
xor edx, edx
mov ecx, 0x20005
call fcn.140054e60
mov edx, 1
mov ecx, 0x20001
call fcn.140054e60
mov edx, 1
mov ecx, 0x2200c
call fcn.140054e60
mov edx, 1
mov ecx, 0x20007
call fcn.140054e60
mov edx, dword [0x1400972c8]
lea r8, str.CS2External
mov ecx, dword [0x1400972cc]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
call fcn.140054510
mov rcx, rax
mov qword [0x14009b088], rax
call fcn.14005b6f0
call fcn.140051280
call fcn.14005b6c0
mov rcx, rax
call fcn.1400551c0
test eax, eax
jne 0x14005181c
nop dword [rax]
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14005181c
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400516ca
cmp byte [0x14009adfd], dil
jne 0x1400516d1
cmp byte [0x1400972df], dil
mov rcx, qword [0x14009ae88]
sete al
mov byte [0x14009adfd], 1
mov byte [0x1400972df], al
mov byte [rcx + 0xe2], al
movzx eax, byte [0x1400972df]
mov byte [rcx + 0xe3], al
movzx eax, byte [0x1400972df]
mov byte [rcx + 0x58], al
jmp 0x1400516d1
mov byte [0x14009adfd], dil
cmp byte [0x1400972df], dil
mov r8d, edi
mov rcx, qword [0x14009b088]
mov edx, 0x2000d
sete r8b
call fcn.140054ce0
mov rbx, qword [0x14009b090]
lea rdx, [rbp + 0x37]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rbp + 0x1f]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp + 0x27]
mov r10d, dword [rbp + 0x37]
mov r8d, dword [rbp + 0x23]
mov eax, dword [rbp + 0x1f]
sub eax, ecx
sub ecx, dword [rbp + 0x1f]
sub eax, r10d
mov dword [0x1400972cc], ecx
add eax, dword [rbp + 0x3f]
mov ecx, dword [rbp + 0x2b]
cdq
sub ecx, r8d
sub eax, edx
sub r8d, dword [rbp + 0x2b]
sar eax, 1
sub r8d, eax
mov dword [0x1400972c8], ecx
add r8d, dword [rbp + 0x43]
mov rcx, qword [0x14009b088]
lea edx, [r10 + rax]
mov dword [0x14009b07c], r8d
mov dword [0x14009b078], edx
call fcn.140054e00
mov r8d, dword [0x1400972c8]
mov edx, dword [0x1400972cc]
mov rcx, qword [0x14009b088]
call fcn.140054e30
call fcn.140054cc0
mov ecx, 0x4000
call qword [sym.imp.OPENGL32.dll_glClear]
mov rbx, qword [0x14009ae88]
test rbx, rbx
je 0x1400517a7
mov rbx, qword [rbx + 0xa0]
jmp 0x1400517aa
mov rbx, rdi
cmp dword [rbx + 0x30], edi
jne 0x1400517b4
call fcn.140040860
cmp dword [rbx + 0x2c], edi
jne 0x1400517be
call fcn.140040310
call fcn.14003f1d0
call fcn.1400172b0
call fcn.1400520c0
call fcn.14000b0d0
call fcn.140019100
mov rax, qword [0x14009ae88]
mov rcx, qword [rax + 0x4ba0]
mov rax, qword [rcx]
mov rcx, rdi
add rax, 0x50
cmp byte [rax], dil
cmovne rcx, rax
call fcn.14003fca0
mov rcx, qword [0x14009b088]
call fcn.14005b790
call fcn.14005b6c0
mov rcx, rax
call fcn.1400551c0
test eax, eax
je 0x140051660
call fcn.14003f840
call fcn.14003ea60
mov rbx, qword [0x14009ae88]
mov qword [0x14009ae88], rbx
call fcn.140014ee0
mov qword [0x14009ae88], rdi
test rbx, rbx
je 0x1400518c1
mov rcx, rbx
call fcn.14002d070
mov r8, qword [0x14009ae88]
test r8, r8
je 0x1400518b8
movsx rdx, word [r8 + 0x6228]
lea rcx, [r8 + 0x622c]
mov r9d, dword [r8 + 0x3fc0]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x1400518ad
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6228], cx
movsx rax, cx
lea rcx, [r8 + 0x622c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], edi
inc word [rcx + 6]
inc dword [r8 + 0x6224]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.140056260
mov rcx, qword [0x14009b088]
call fcn.140054990
call fcn.140056260
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov rbx, qword [rsp + 0xb0]
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140063a30
mov rdi, qword [rsp + 0xb8]
add rsp, 0xa0
pop rbp
ret