Function at 0x140035540
Capabilities:
Enumerate processes
Log keystrokes via application hook
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor dil, dil
cmp ecx, 1
jle 0x1400355b5
add rdx, 8
dec ecx
mov rax, qword [rdx]
cmp byte [rax], 0x2d
jne 0x1400355ab
cmp byte [rax + 1], 0x69
jne 0x140035596
cmp byte [rax + 2], 0
je 0x1400355a8
cmp byte [rax], 0x2d
jne 0x1400355ab
cmp byte ds:[rax + 1], 0x49
jne 0x1400355ab
cmp byte [rax + 2], 0
jne 0x1400355ab
mov dil, 1
add rdx, 8
sub rcx, 1
jne 0x140035582
call fcn.1400351a0
test dil, dil
jne 0x140035606
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Virtual_Machine_Scanner__Running_checks_to_detect_virtual_machines..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400053a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140034fe0
lea rdx, [0x140046020]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rdx, str.DO_NOT_CLICK_INSIDE_THE_CONSOLE_DURING_THE_SCAN__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400053a0
lea rdx, str.If_you_press_Enter__the_console_will_continue_but_will_skip_the_current_check._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax + rax]
call fcn.1400053a0
movzx ecx, dil
call fcn.140013da0
test dil, dil
jne 0x140035698
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Running_checks_to_detect_executed_files_in_memory..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400053a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.PlugPlay
mov qword [rbp + 0x30], rax
lea rax, str.PcaSvc
mov qword [rbp + 0x38], rax
lea rax, str.Winmgmt
mov qword [rbp + 0x40], rax
lea rax, str.DiagTrack
mov qword [rbp + 0x48], rax
xor r15d, r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x30], r15
lea rbx, [rbp + 0x30]
nop word [rax + rax]
mov rsi, qword [rbx]
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140037720
lea r8, [rbp - 0x28]
mov rdx, rsi
mov rcx, qword [rsp + 0x30]
call fcn.140037960
test eax, eax
js 0x140035777
cmp word [rbp - 0x28], 3
jne 0x140035727
mov ecx, dword ds:[rbp - 0x20]
call fcn.140025780
jmp 0x140035757
lfence
lea rdx, str.____The_following_service_is_not_running:_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140003020
mov rcx, rax
mov rdx, rsi
call fcn.140003020
mov rcx, rax
lea rdx, str.._Ban_the_user._n
call fcn.140003020
lea rcx, ds:[rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
add rbx, 8
lea rax, [rbp + 0x50]
cmp rbx, rax
jne 0x1400356e0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
mov rbx, qword [rsp + 0x50]
je 0x140035793
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14003ebc0]
test rbx, rbx
je 0x1400357a8
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [0x14003ebc0]
call qword [sym.imp.ole32.dll_CoUninitialize]
test dil, dil
jne 0x1400357f8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Device_Scanner__Running_checks_for_unplugged_devices..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400053a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov r8d, 0x1d
lea rdx, str.SYSTEMControlSet001EnumUSB
lea rcx, [rbp - 0x28]
call fcn.140003500
nop
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
lea rcx, [rbp - 8]
call fcn.140003fe0
mov r8d, 1
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.140004480
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14003588c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035887
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035887
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140038e10
movdqa xmm0, xmmword [0x140049850]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r15w
movzx ecx, dil
call fcn.140006520
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Control_PanelAccessibilityMouseKeys
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003595d
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Flags
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140035947
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
cmp eax, 0x3f
jne 0x140035952
lea rcx, str.____MouseKeys_detected._Ban_the_user_if_the_attack_control_is_binded_to_a_keyboard_key_instead_of_a__Button_key_._n
call fcn.140001dc0
lea rcx, str.____To_do_so__go_to_the_minecraft_window_and_check_Options___Controls_and_check__Attack_._n
call fcn.140001dc0
jmp 0x140035952
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax]
test dil, dil
jne 0x1400359aa
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._NTFS_Scanner__Running_checks_to_detect_usn_journal_cleared..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400053a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 8]
call fcn.1400324c0
nop
mov rsi, qword [rbp]
mov rbx, qword [rbp - 8]
cmp rbx, rsi
je 0x1400359de
mov rcx, rbx
call fcn.1400326a0
add rbx, 0x20
cmp rbx, rsi
jne 0x1400359c5
mov rsi, qword [rbp]
mov rbx, qword [rbp - 8]
nop
test rbx, rbx
je 0x140035a4f
cmp rbx, rsi
je 0x140035a09
nop word [rax + rax]
mov rcx, rbx
call fcn.140002b80
add rbx, 0x20
cmp rbx, rsi
jne 0x1400359f0
mov rbx, qword [rbp - 8]
mov rdx, qword ds:[rbp + 8]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140035a47
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035a47
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140038e10
test dil, dil
jne 0x140035a9e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Eventlog_Scanner__Running_checks_to_detect_if_the_system_time_was_changed..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax + rax]
call fcn.1400053a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x48], r15d
mov r9d, 0x201
lea r8, str._System__EventID22__and_Provider__NameMicrosoft_Windows_Kernel_General___
lea rdx, str.System
xor ecx, ecx
call qword [sym.imp.wevtapi.dll_EvtQuery]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, ds:[rsp + 0x78]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
imul rcx, rbx, 0x2710
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
mov qword [rbp - 0x80], rdx
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9d, 0xffffffff
lea r8, [rsp + 0x70]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.wevtapi.dll_EvtNext]
test eax, eax
je 0x140035b50
lea rdx, ds:[rbp + 0x10]
mov rcx, qword [rsp + 0x70]
call fcn.140009a00
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.wevtapi.dll_EvtClose]
mov rcx, rsi
call qword [sym.imp.wevtapi.dll_EvtClose]
test dil, dil
jne 0x140035ba6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._System_Scanner__Running_checks_to_detect_if_certain_string_cleaners_were_executed..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400053a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
imul rax, rbx, 0x2710
mov rcx, qword [rbp - 0x78]
sub rcx, rax
mov qword [rbp - 0x70], rcx
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov r8d, 0x13
lea rdx, str.C:WindowsPrefetch
lea rcx, [rbp - 0x28]
call fcn.140003500
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x28]
call fcn.14002c860
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x140035c5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035c5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035c5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140038e10
movdqa xmm0, xmmword [0x140049850]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r15w
movzx ecx, dil
call fcn.14002cfe0
movzx ecx, dil
call fcn.1400097e0
call fcn.14002c560
test dil, dil
jne 0x140035cd4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._BAM_Scanner__Running_checks_to_detect_executed_files_with_BAM..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003020
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.SYSTEMCurrentControlSetServices_bamStateUserSettings
mov rcx, 0xffffffff80000002
call fcn.140002480
lea rcx, str.javaw.exe
call fcn.140028900
lea rcx, str.Minecraft.Windows.exe
call fcn.140028900
movzx ecx, dil
call fcn.1400081a0
test dil, dil
jne 0x140035d54
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Code_Import_Scanner__Running_checks_to_detect_Import_code_bypasses..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003020
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x38], r15
lea rax, str.diagtrack
mov qword [rbp - 0x68], rax
lea r14, str.eventlog
mov qword [rbp - 0x60], r14
lea rbx, [rbp - 0x68]
nop dword [rax + rax]
mov rsi, qword [rbx]
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140037720
lea r8, [rbp - 0x28]
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call fcn.140037960
test eax, eax
js 0x140035dde
cmp word [rbp - 0x28], 3
jne 0x140035dc5
mov ecx, dword ds:[rbp - 0x20]
call fcn.14000fa00
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
add rbx, 8
lea rax, [rbp - 0x58]
cmp rbx, rax
jne 0x140035d80
jmp 0x140035e27
lfence
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
movzx eax, word [rsi + rcx*2 + 2]
cmp ax, word [r14 + rcx*2 + 2]
jne 0x140035e27
add rcx, 2
cmp rcx, 9
je 0x140035e14
movzx eax, word [rsi + rcx*2]
cmp ax, word [r14 + rcx*2]
je 0x140035df0
jmp 0x140035e27
lea rdx, str.____The_eventlog_service_is_not_running._Ban_the_user._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400053a0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
mov rbx, qword [rsp + 0x60]
je 0x140035e46
mov rax, qword ds:[rcx]
mov rax, qword [rax + 0x10]
call qword [0x14003ebc0]
test rbx, rbx
je 0x140035e5b
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [0x14003ebc0]
nop dword [rax + rax]
call qword [sym.imp.ole32.dll_CoUninitialize]
test dil, dil
jne 0x140035eb4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Task_Scheduler_Scanner__Running_checks_to_detect_executed_files_with_task_scheduler_in_memory..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400053a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x40], r15
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140037720
lea r8, [rbp - 0x28]
lea rdx, str.Schedule
mov rcx, qword [rsp + 0x40]
call fcn.140037960
test eax, eax
js 0x140035f30
cmp word [rbp - 0x28], 3
jne 0x140035f02
mov ecx, dword [rbp - 0x20]
call fcn.14002d260
nop
jmp 0x140035f26
lea rdx, str.____Scheduler_process_is_not_running._Ban_the_user.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140003020
lea rdx, [0x140005660]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
mov rbx, qword [rsp + 0x68]
je 0x140035f4c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14003ebc0]
test rbx, rbx
je 0x140035f66
mov rax, qword ds:[rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [0x14003ebc0]
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx ecx, dil
call fcn.14000be60
movzx ecx, dil
call fcn.14000f2a0
movzx ecx, dil
call fcn.140009e60
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x54]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x50], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140035fd0
lea ecx, [rax + 3]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Error_creating_process_snapshot._n
call fcn.14001b570
jmp 0x140036073
mov ebx, r15d
lea rdx, [rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14003606a
nop
lea rdx, [0x140043eb0]
lea rcx, ds:[rbp + 0x7c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14003601d
lea rdx, [0x140043ec0]
lea rcx, [rbp + 0x7c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140036053
inc ebx
cmp ebx, 1
jle 0x140036031
lea rcx, str.___Multiple_processes_detected._The_scan_might_take_a_while._n
call fcn.140001dc0
mov r8d, dword ds:[rbp + 0x58]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140036053
mov rcx, rax
call fcn.14001b5c0
lea rdx, ds:[rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140035ff0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, dil
call fcn.14001c1e0
movzx ecx, dil
call fcn.140031dc0
movzx ecx, dil
call fcn.140029ec0
call fcn.1400109e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
xor r9d, r9d
lea rdx, [0x14002c020]
lea ecx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x140056b10], rax
nop dword [rax]
test rax, rax
je 0x14003625f
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Onboard_Memory_Macro_Scanner__Running_onboard_memory_macro_checks..._n
call fcn.14002bed0
lea rcx, str._Onboard_Memory_Macro_Scanner__Press_the_DELETE_key_to_stop_the_checks_for_onboard_macros_at_any_time._Since_this_is_the_final_check__the_program_will_close_if_you_press_this_key._n
call fcn.14002bed0
lea rcx, str._Onboard_Memory_Macro_Scanner__If_you_click_on_the_console__the_hook_may_freeze_and_clicks_WILL_NOT_be_detected._Click_outside_the_console._n
call fcn.14002bed0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Ask_the_user_to_click_ONLY_ONE_TIME_every_button_key_of_their_mice_and_keyboard._You_have_to_see_in_the_console_the_left_click__middle_click__right_click_and_extended_button_click_being_detected._n
call fcn.14002bed0
lea rcx, str.If_you_see_that_the_console_spams_a_lot_of_messages_when_the_user_only_clicked_a_button_one_time__ban_the_user._n
call fcn.14002bed0
lea rcx, str.If_you_see__Autoclicker_detected__message_in_the_console__ban_the_user._n
call fcn.14002bed0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
xor r9d, r9d
lea rdx, [0x14002bf40]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x140056b20], rax
test rax, rax
je 0x14003625f
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400361fa
nop dword [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400361ea
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, ds:[rbp - 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageA]
mov dword ss:[rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x58]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x1400361b0
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140036190
mov rcx, qword [0x140056b10]
test rcx, rcx
je 0x14003622c
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
jne 0x140036225
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_uninstalling_mouse_hook._Error_code:__d_n
call fcn.14002bed0
mov qword [0x140056b10], r15
mov rcx, qword [0x140056b20]
test rcx, rcx
je 0x14003625f
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop
test eax, eax
jne 0x140036258
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_uninstalling_keyboard_hook_to_detect_onboard_memory_macros_in_keyboards._Error_code:__d_n
call fcn.14002bed0
mov qword [0x140056b20], r15
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140038df0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret