Function at 0x140001390
Capabilities:
Allocate or change rwx memory
Connect socket
Initialize winsock library
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov ecx, 0x202
lea rdx, [rbp - 0x70]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400016cc
xor r8d, r8d
lea edx, [rax + 1]
mov r14d, 2
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001421
mov word [rsp + 0x40], r14w
mov ecx, 0x1f96
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x42], ax
lea rcx, str.185.195.27.78
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x44], eax
lea r8d, [r14 + 0xe]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, rbx
test eax, eax
je 0x140001437
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add rsp, 0x4d0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], dil
lea r8d, [rdi + 0xe]
lea rdx, str.stalcraftw.exe
lea rcx, [rsp + 0x70]
call fcn.140001820
nop
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], socket
mov r8d, 0xe
lea rdx, str.stalcraftw.exe
lea rcx, [rsp + 0x50]
call fcn.140001820
lea rcx, [rsp + 0x50]
call fcn.140001290
test eax, eax
sete bl
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400014e7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400016dc
call fcn.140001c2c
test bl, bl
je 0x140001581
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], socket
mov r8d, 0xd
lea rdx, str.stalcraft.exe
lea rcx, [rsp + 0x50]
call fcn.140001820
lea rcx, [rsp + 0x50]
call fcn.140001290
mov ebx, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001562
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000155d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400016dc
call fcn.140001c2c
test ebx, ebx
je 0x140001471
mov r8d, 0xd
lea rdx, str.stalcraft.exe
lea rcx, [rsp + 0x70]
call fcn.140001820
lea rcx, [rsp + 0x70]
call fcn.140001290
mov edi, eax
test eax, eax
je 0x14000176c
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000176c
mov word [rbp + 0x400], 0x48eb
mov dword [rsp + 0x30], 0x207b9
mov dword [rsp + 0x34], 0xebd98b00
mov byte [rsp + 0x38], 0xaf
mov dword [rsp + 0x40], 0x201b9
mov dword [rsp + 0x44], 0xebd98b00
mov byte [rsp + 0x48], 0xaf
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
lea r8d, [rdx + 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140001624
lea rcx, str.YES___n
call fcn.140001070
mov rdx, rsi
lea rcx, str.pTargetBase__p
call fcn.140001070
mov edx, edi
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp - 0x6c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x70], 0x438
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
je 0x140001686
nop dword [rax]
lea rdx, str.opengl32.dll
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rdi
test eax, eax
je 0x1400016e3
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140001660
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400016cc
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017ab
call fcn.140001c2c
xor eax, eax
add rsp, 0x4d0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x140001690
lea rdi, [rdx + 0x27710]
add rdx, 0x276c6
mov r9, r14
lea r8, [rbp + 0x400]
mov rcx, rbx
lea rax, [rbp + 0x408]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001740
cmp byte [0x1400051bc], 0
sete al
mov byte [0x1400051bc], al
jmp 0x140001747
movzx eax, byte [0x1400051bc]
mov r9d, 9
mov rdx, rdi
mov rcx, rbx
test al, al
je 0x14000175e
lea r8, [rsp + 0x30]
jmp 0x14000170d
lea rax, [rbp + 0x410]
lea r8, [rsp + 0x40]
jmp 0x140001714
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400016cc
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3