Function at 0x140091210
Capabilities:
Create thread
Enumerate gui resources
Log keystrokes via polling
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0xe68
mov rax, qword [0x14014b040]
xor rax, rsp
mov qword [rsp + 0xe50], rax
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 0
lea rax, [rsp + 0x250]
lea rcx, str.Drives.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x266]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ea
rep stosb byte [rdi], al
lea rax, [rsp + 0x450]
lea rcx, [0x14011e740]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x468]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e8
rep stosb byte [rdi], al
lea rax, [rsp + 0x650]
lea rcx, str.drives.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x666]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ea
rep stosb byte [rdi], al
lea rax, [rsp + 0x850]
lea rcx, [0x14011e770]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x868]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e8
rep stosb byte [rdi], al
lea rcx, [rsp + 0x250]
call fcn.140092690
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140091325
lea rcx, [rsp + 0x450]
call fcn.140092690
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x14009133d
lea rcx, [rsp + 0x650]
call fcn.140092690
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140091355
lea rcx, [rsp + 0x850]
call fcn.140092690
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140091364
mov dword [rsp + 0x50], 1
lea rdx, str.quyengabon0676
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
jne 0x1400913a5
lea rdx, str._n_quyengabon0676
lea rcx, [0x14019a630]
call fcn.140011040
lea rcx, [0x14011e7cc]
call fcn.1400ad764
cmp qword [rsp + 0x88], 0
je 0x1400913b8
mov dword [rsp + 0x54], 1
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011e7c8]
lea rcx, [0x14019a630]
call fcn.140011040
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011e7d8]
lea rcx, [0x14019a630]
call fcn.140011040
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011e7d4]
lea rcx, [0x14019a630]
call fcn.140011040
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0xc50]
lea rcx, str.BloodStrike.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xc70]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e0
rep stosb byte [rdi], al
lea rax, [rsp + 0xa50]
lea rcx, [0x14011e7e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa70]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e0
rep stosb byte [rdi], al
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011e824]
lea rcx, [0x14019a630]
call fcn.140011040
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011e820]
lea rcx, [0x14019a630]
call fcn.140011040
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011e838]
lea rcx, [0x14019a630]
call fcn.140011040
lea rcx, [rsp + 0xa50]
call fcn.140092690
mov dword [0x14019ce1c], eax
mov r8d, dword [0x14019ce1c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14019ce20], rax
xor edx, edx
lea rcx, [0x140091df0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [0x14019ce28]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x140091537
mov edx, 5
mov rcx, qword [0x14019ce28]
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x14019ce1c]
call fcn.1400910b0
mov qword [0x14019ce28], rax
cmp qword [0x14019ce28], 0
jne 0x14009158f
mov rcx, qword [0x14019ce38]
call fcn.140090d00
mov r9d, 1
lea r8, [0x14011e828]
lea rdx, str.Cant_Find_Game_Window
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.pause__nul
call fcn.1400ad764
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x90], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x94], eax
lea rdx, [rsp + 0xa8]
mov rcx, qword [0x14019ce28]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, str.__nGAME_PID:_0x
lea rcx, [0x14019a630]
call fcn.140011040
lea rdx, [0x140090c70]
mov rcx, rax
call fcn.140091fc0
lea rdx, [0x140090cd0]
mov rcx, rax
call fcn.140091fc0
mov edx, dword [0x14019ce1c]
mov rcx, rax
call fcn.140008060
lea rdx, [0x14011e890]
mov rcx, rax
call fcn.140011040
lea rdx, [0x140090ca0]
mov rcx, rax
call fcn.140091fc0
mov edx, dword [0x14019ce1c]
mov rcx, rax
call fcn.140008060
lea rdx, [0x14000cc70]
mov rcx, rax
call fcn.1400082b0
lea rdx, str.C:WindowsFonts_tahoma.ttf
lea rcx, [rsp + 0xd8]
call fcn.140008920
nop
lea rdx, str.quyengabon.ttf
lea rcx, [rsp + 0xb8]
call fcn.140008920
nop
mov eax, dword [rsp + 0xac]
mov ecx, dword [rsp + 0xb4]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xa8]
mov edx, dword [rsp + 0xb0]
sub edx, ecx
mov ecx, edx
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0xac]
mov ecx, dword [rsp + 0xa8]
call fcn.1400113f0
mov r8d, dword [0x14019c110]
mov edx, dword [0x14019c114]
mov rcx, qword [0x14019c130]
call fcn.140010700
xor ecx, ecx
call fcn.14002e7a0
call fcn.14002e900
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov byte [rax + 0x394], 1
lea rcx, [rsp + 0x130]
call fcn.14005c8f0
mov byte [rsp + 0x178], 1
mov byte [rsp + 0x150], 1
mov dword [rsp + 0x148], 2
mov dword [rsp + 0x14c], 2
movss xmm0, dword [0x14013d9e4]
movss dword [rsp + 0x170], xmm0
lea rcx, [rsp + 0x1c0]
call fcn.14005c8f0
mov byte [rsp + 0x1cc], 0
lea rcx, [rsp + 0xd8]
call fcn.1400086f0
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x14013d9ec]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.14005d370
lea rax, [0x14013d6e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x14013d9f0]
mov r8d, 0x1e695
lea rdx, [0x14011e9e0]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.14005d740
call fcn.140090fc0
mov rcx, qword [0x14019c130]
call fcn.140066e10
mov rcx, qword [0x14019c0f8]
call fcn.140066790
lea rcx, [rsp + 0xb8]
call fcn.1400086f0
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x14013da10]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.14005d370
mov qword [0x14019c0d0], rax
lea rcx, [rsp + 0xd8]
call fcn.1400086f0
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x14013d9ec]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.14005d370
mov qword [0x14019c0d8], rax
lea rcx, [rsp + 0xb8]
call fcn.1400086f0
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x14013d9ec]
mov rdx, rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.14005d370
mov qword [0x14019c0c0], rax
lea rax, [0x14013d6e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x14013d9f0]
mov r8d, 0x1e695
lea rdx, [0x14011e9e0]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0xa0]
call fcn.14005d740
mov qword [0x14019c0e0], rax
cmp dword [rsp + 0x50], 1
jne 0x14009194c
cmp dword [rsp + 0x54], 1
jne 0x14009194c
movzx eax, byte [0x14019c06d]
test eax, eax
jne 0x14009194c
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140007b50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140007980]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140018a10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
cmp eax, 1
je 0x140091da5
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0xf8]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xf8]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400919b4
lea rcx, [rsp + 0xf8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xf8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [rsp + 0x100], 0x12
jne 0x1400919c5
xor ecx, ecx
call fcn.1400a1fc0
lea rax, [rsp + 0xa8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0xa8]
mov rcx, qword [0x14019ce28]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0xa8]
mov dword [0x14019c138], eax
mov eax, dword [rsp + 0xac]
mov dword [0x14019c118], eax
mov eax, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0xb0]
sub ecx, eax
mov eax, ecx
mov dword [0x14019c114], eax
mov eax, dword [rsp + 0xac]
mov ecx, dword [rsp + 0xb4]
sub ecx, eax
mov eax, ecx
mov dword [0x14019c110], eax
mov dword [rsp + 0x28], 1
mov eax, dword [0x14019c110]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x14019c114]
mov r8d, dword [0x14019c118]
mov edx, dword [0x14019c138]
mov rcx, qword [0x14019c130]
call qword [sym.imp.USER32.dll_MoveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x98], rax
mov edx, 3
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [0x14019c130]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14019c130]
call qword [sym.imp.USER32.dll_UpdateWindow]
movzx eax, byte [0x14014bce9]
test eax, eax
je 0x140091aec
mov rcx, qword [0x14019c130]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140091b4f
movzx eax, byte [0x14019c13c]
test eax, eax
jne 0x140091b14
mov dword [rsp + 0x58], 1
jmp 0x140091b1c
mov dword [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov byte [0x14019c13c], al
movzx eax, byte [0x14019c06f]
test eax, eax
jne 0x140091b3c
mov dword [rsp + 0x5c], 1
jmp 0x140091b44
mov dword [rsp + 0x5c], 0
movzx eax, byte [rsp + 0x5c]
mov byte [0x14019c06f], al
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140091bc0
movzx eax, byte [0x14014bcd6]
cmp eax, 1
jne 0x140091b98
movzx eax, byte [0x14014bce9]
test eax, eax
jne 0x140091b83
mov dword [rsp + 0x60], 1
jmp 0x140091b8b
mov dword [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
mov byte [0x14014bce9], al
jmp 0x140091bc0
movzx eax, byte [0x14014bce9]
test eax, eax
jne 0x140091bad
mov dword [rsp + 0x64], 1
jmp 0x140091bb5
mov dword [rsp + 0x64], 0
movzx eax, byte [rsp + 0x64]
mov byte [0x14014bce9], al
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140091bfb
movzx eax, byte [0x14019c13d]
test eax, eax
jne 0x140091be8
mov dword [rsp + 0x68], 1
jmp 0x140091bf0
mov dword [rsp + 0x68], 0
movzx eax, byte [rsp + 0x68]
mov byte [0x14019c13d], al
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140091c5e
movzx eax, byte [0x14019c13e]
test eax, eax
jne 0x140091c23
mov dword [rsp + 0x6c], 1
jmp 0x140091c2b
mov dword [rsp + 0x6c], 0
movzx eax, byte [rsp + 0x6c]
mov byte [0x14019c13e], al
movzx eax, byte [0x14019c11e]
test eax, eax
jne 0x140091c4b
mov dword [rsp + 0x70], 1
jmp 0x140091c53
mov dword [rsp + 0x70], 0
movzx eax, byte [rsp + 0x70]
mov byte [0x14019c11e], al
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140091c99
movzx eax, byte [0x14014bcd7]
test eax, eax
jne 0x140091c86
mov dword [rsp + 0x74], 1
jmp 0x140091c8e
mov dword [rsp + 0x74], 0
movzx eax, byte [rsp + 0x74]
mov byte [0x14014bcd7], al
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140091cfc
movzx eax, byte [0x14019c11f]
test eax, eax
jne 0x140091cc1
mov dword [rsp + 0x78], 1
jmp 0x140091cc9
mov dword [rsp + 0x78], 0
movzx eax, byte [rsp + 0x78]
mov byte [0x14019c11f], al
movzx eax, byte [0x140199a4e]
test eax, eax
jne 0x140091ce9
mov dword [rsp + 0x7c], 1
jmp 0x140091cf1
mov dword [rsp + 0x7c], 0
movzx eax, byte [rsp + 0x7c]
mov byte [0x140199a4e], al
mov ecx, 0x54
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140091d50
cmp dword [0x14019ce48], 0
jne 0x140091d28
mov eax, dword [0x14019ce48]
inc eax
mov dword [0x14019ce48], eax
jmp 0x140091d50
cmp dword [0x14019ce48], 1
jne 0x140091d3d
mov dword [0x14019ce48], 2
jmp 0x140091d50
cmp dword [0x14019ce48], 2
jne 0x140091d50
mov dword [0x14019ce48], 0
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140091da0
movzx eax, byte [0x14019c13e]
test eax, eax
je 0x140091d7e
movzx eax, byte [0x14019c06e]
test eax, eax
jne 0x140091d7e
call fcn.1400920e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14019ce38]
call fcn.140090d00
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x14009194c
mov dword [rsp + 0x80], 0
lea rcx, [rsp + 0xb8]
call fcn.1400087c0
nop
lea rcx, [rsp + 0xd8]
call fcn.1400087c0
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0xe50]
xor rcx, rsp
call fcn.140094ec0
add rsp, 0xe68
pop rdi
pop rsi
ret