Function at 0x140002510
Capabilities:
Execute command
Log keystrokes via polling
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x230
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
movabs rax, 0x41bb323e9832e19
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x2125c8544cc7c881
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs r13, 0x7177f11282ed4f4b
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs r12, 0x2125a337238be8e4
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movdqa xmm0, xmmword [rbp + 0x140]
xorps xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x140], xmm0
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movabs rax, 0x3f38b232c7a90006
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x11109e646fc4abc4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xf3fd68d1e1e5faad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0x31be9a940faed5d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs r14, 0xc2c03b94afacb68d
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs r15, 0x31be9a940faed6e
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x120], ymm1
lea rcx, [rbp + 0x120]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x7f45ff5b8cf44160
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x2f3cad052dc2e6f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xcc823580a19db885
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xd29e7a84ed9e375
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x5b9f30e2fe72f6e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x54f2b4f2abfdc3af
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xf71953e4e50af23c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x9fb6577d41ef01c9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x49cfb8c352883710
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xc08074ee0be74bdb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x33bbce2efe15d5ec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x72c5f351ed75c3fe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rsi, 0xb93fd4e21a1216f
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rdi, 0x5ab3baf3a5d0cd98
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rbx, 0xf95a5de0eb4dfc11
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs r11, 0x9f9659354fe20fe2
mov qword [rbp], r11
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs r10, 0x47eeb68a5cb13933
mov qword [rbp], r10
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs r9, 0xceb17aef05ca45ec
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs r8, 0x3d82c00cf038dbf5
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rdx, 0x72c5fd61e36ccdb6
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x80], ymm1
movabs rax, 0x7f70ff3f8ca4415e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x2f66ad142db9e6e5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xccdf3bb4a1e5b887
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0xd2ae7a34efde35f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x586fd6e2fb82f27
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x54b7b4d1abfdc3d0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xf71253d7e560f208
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x91a457214fc201fb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x49aab88252903773
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xc0b374af0b824bcd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x33a1ce27fe0ad5bc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x7ce4f325ed41c381
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x3f11cc8639f10d3f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rcx, 0x33cd498b25dd6520
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], r11
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], r10
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x3f11cc8639f10377
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x100]
vxorps xmm0, xmm0, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x100], xmm0
mov r9d, 0x31
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0xa0]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ebx, ebx
cmp eax, 1
jne 0x140002e17
movabs rax, 0x517ef81888e74541
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x5540f0174ebbb3ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xf8e042f1c4d8d9e5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0x31b849873a1f64e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x120], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 8], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x18], xmm1
lea rax, [rbp + 0x120]
mov rdi, 0xffffffffffffffff
vzeroupper
nop dword [rax]
inc rdi
cmp byte [rax + rdi], bl
jne 0x140002ca0
movabs r14, 0x7fffffffffffffff
cmp rdi, r14
jbe 0x140002cbd
call fcn.1400011a0
int3
cmp rdi, 0xf
ja 0x140002cf7
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], 0xf
mov r8, rdi
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi + 8], bl
mov r14, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x18]
mov rsi, qword [rbp + 8]
jmp 0x140002d8e
mov rax, rdi
or rax, 0xf
cmp rax, r14
jbe 0x140002d30
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003450
test rax, rax
je 0x140002e04
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002d6d
mov r14, rax
mov ecx, 0x16
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
test rcx, rcx
jne 0x140002d4d
mov rsi, rbx
jmp 0x140002d6d
cmp rcx, 0x1000
jb 0x140002d65
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x140002d11
call fcn.140001100
int3
call fcn.140003450
mov rsi, rax
mov qword [rbp + 8], rsi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], r14
mov r8, rdi
lea rdx, [rbp + 0x120]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], bl
lea rbx, [rbp + 8]
cmp r14, 0xf
cmova rbx, rsi
lea rax, [rbp + 8]
cmova rax, rsi
add rdi, rax
cmp rbx, rdi
je 0x140002dd2
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400030d0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, rdi
jne 0x140002db0
call fcn.1400011c0
mov ebx, eax
cmp r14, 0xf
jbe 0x140002e13
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140002e0b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140003494
test ebx, ebx
jmp 0x140002e1a
cmp eax, 2
je 0x140002fff
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x12c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
movabs rax, 0x7177f112829e2328
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movdqa xmm0, xmmword [rbp + 0x140]
xorps xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x140], xmm0
lea rcx, [rbp + 0x140]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140002fff
movabs rdi, 0x7120f171829f4f2c
movabs rsi, 0x214aa35323e5e88d
movabs r14, 0xc2c03b94afacb6fa
nop word [rax + rax]
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xc2c03b94afacb68d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqu ymmword [rbp + 0x120], ymm1
xor edx, edx
lea rcx, [rbp + 0x120]
vzeroupper
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140002fa8
mov ecx, 0x7d0
jmp 0x140002fe6
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002fcc
cmp byte [0x14000770c], 0
jne 0x140002fe1
call fcn.140001f40
mov byte [0x14000770c], 1
jmp 0x140002fe1
cmp byte [0x14000770c], 0
je 0x140002fe1
call fcn.140001970
mov byte [0x14000770c], 0
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140002ef0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3