Function at 0x401638
Capabilities:
Check for foreground window switch
Execute command
Log keystrokes via polling
Set console window title

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
call fcn.0040c1c0
lea rcx, str.AnyDesk.exe
call fcn.00401560
test al, al
je 0x401665
mov eax, 0
jmp 0x40197c
lea rcx, str.TeamViewer.exe
call fcn.00401560
test al, al
je 0x40167f
mov eax, 0
jmp 0x40197c
lea rcx, [0x004b801c]
call sub.msvcrt.dll_system
lea rcx, [0x004b8020]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call rax
mov dword [rbp - 0x38], 0x1c
mov dword [rbp - 0x3c], 0x1c
mov byte [rbp - 0x31], 0
mov byte [rbp - 0x32], 0
mov eax, 0x7d0
cdq
idiv dword [rbp - 0x38]
mov dword [rbp - 0x40], eax
mov eax, 0x7d0
cdq
idiv dword [rbp - 0x3c]
mov dword [rbp - 0x44], eax
mov ecx, 0x31
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x4016f5
mov byte [rbp - 0x31], 1
mov byte [rbp - 0x32], 0
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0x32
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x401721
mov byte [rbp - 0x32], 1
mov byte [rbp - 0x31], 0
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0x33
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x40173f
mov byte [rbp - 0x32], 0
mov byte [rbp - 0x31], 0
mov ecx, 0x34
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x40175d
mov byte [rbp - 0x32], 0
mov byte [rbp - 0x31], 0
mov ecx, 0x35
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x40177b
mov byte [rbp - 0x32], 0
mov byte [rbp - 0x31], 0
mov ecx, 0x36
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x401799
mov byte [rbp - 0x32], 0
mov byte [rbp - 0x31], 0
mov ecx, 0x37
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x4017b7
mov byte [rbp - 0x32], 0
mov byte [rbp - 0x31], 0
mov ecx, 0x38
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x4017d5
mov byte [rbp - 0x32], 0
mov byte [rbp - 0x31], 0
mov ecx, 0x47
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
test al, al
je 0x4017f3
mov byte [rbp - 0x32], 0
mov byte [rbp - 0x31], 0
cmp byte [rbp - 0x31], 0
je 0x4018b3
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
setne al
test al, al
je 0x4018b3
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov qword [rbp - 0x50], rax
mov edx, 0
lea rcx, str.LWJGL
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov rbx, rax
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
cmp rbx, rax
sete al
test al, al
je 0x4018b3
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov r9d, 0
mov r8d, 1
mov edx, 0x201
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SendMessageW]
call rax
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov r9d, 0
mov r8d, 1
mov edx, 0x202
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SendMessageW]
call rax
call sub.msvcrt.dll_rand
cdq
idiv dword [rbp - 0x40]
mov eax, edx
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
cmp byte [rbp - 0x32], 0
je 0x4016b1
mov ecx, 2
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
setne al
test al, al
je 0x4016b1
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov qword [rbp - 0x58], rax
mov edx, 0
lea rcx, str.LWJGL
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov rbx, rax
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
cmp rbx, rax
sete al
test al, al
je 0x4016b1
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov r9d, 0
mov r8d, 2
mov edx, 0x204
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SendMessageW]
call rax
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov r9d, 0
mov r8d, 2
mov edx, 0x205
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SendMessageW]
call rax
call sub.msvcrt.dll_rand
cdq
idiv dword [rbp - 0x44]
mov eax, edx
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x4016b1
add rsp, 0x58
pop rbx
pop rbp
ret