Function at 0x1400366c0
Capabilities:
Create thread
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x108]
sub rsp, 0x200
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140096040]
xor rax, rsp
mov qword [rbp + 0xd8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea r8d, [rsi + 0x35]
lea rdx, str.Debugging_is_disabled_after_compilation_is_completed.
lea rcx, [rsp + 0x30]
call fcn.140088e70
nop
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14003678e
lea rdx, [0x14008cf46]
lea rcx, [rsp + 0x30]
call fcn.14003a130
test al, al
je 0x140036774
lea r8, str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140039d10
mov rcx, rax
call fcn.140038930
mov rcx, rax
call fcn.140007230
lea rcx, [rsp + 0x50]
call fcn.140038b50
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400367cf
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400367c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400367c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a0d0
nop
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
and dword [rbp + 0x10], 0xffffffbf
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, dword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x14008cf58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov edx, 0xa
mov r9d, 0x258
mov r8d, edx
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str.Umbrellasense_for_Counter_Strike_2__External_._nBy_Coslly_Base___ToOl_UmbRelLa_n__n
call fcn.140007230
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov r8d, 8
lea rdx, [0x14008ece8]
lea rcx, [rsp + 0x30]
call fcn.140088e70
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000ba80
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400970a0]
lea rcx, [rsp + 0x50]
call fcn.140038c80
mov rbx, rax
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400368ba
mov rcx, qword [rax]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
mov edi, eax
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400368fa
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400368f5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140036944
mov rcx, r8
call fcn.14008a0d0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
cmp edi, 0xffffffff
jne 0x14003694b
lea rdx, [0x140097158]
lea rcx, [rsp + 0x50]
call fcn.140038c80
mov rbx, rax
lea rdx, [0x1400970a0]
lea rcx, [rsp + 0x30]
call fcn.140038c80
mov rcx, rax
mov rdx, rbx
call fcn.14000b2d0
call fcn.14000b930
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x14001e9a0]
mov qword [rax], rcx
lea rcx, [rbp + 0xd0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xc8], rax
test rax, rax
je 0x140036fc9
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x140026470]
mov qword [rax], rcx
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xb8], rax
test rax, rax
je 0x140036fb7
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x14002b000]
mov qword [rax], rcx
lea rcx, [rbp + 0xb0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xa8], rax
test rax, rax
je 0x140036fa5
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x14002b1a0]
mov qword [rax], rcx
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x98], rax
test rax, rax
je 0x140036f93
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x14002c1b0]
mov qword [rax], rcx
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x88], rax
test rax, rax
je 0x140036f81
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x14002c910]
mov qword [rax], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x78], rax
test rax, rax
je 0x140036f6f
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x14002cc90]
mov qword [rax], rcx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x68], rax
test rax, rax
je 0x140036f60
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x14002d780]
mov qword [rax], rcx
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x58], rax
test rax, rax
je 0x140036f51
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x14002da10]
mov qword [rax], rcx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140036f42
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x1400329d0]
mov qword [rax], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x38], rax
test rax, rax
je 0x140036f33
mov ecx, 8
call fcn.14008a1bc
lea rdx, [0x1400346d0]
mov qword [rax], rdx
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x28], rax
test rax, rax
je 0x140036f24
mov ecx, 8
call fcn.14008a1bc
lea rcx, [0x1400363d0]
mov qword [rax], rcx
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140089fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x18], rax
test rax, rax
je 0x140036f15
mov edi, 0xff
lea r14, [0x140097070]
movsd xmm7, qword [0x14008f2b8]
movsd xmm6, qword [0x14008f290]
nop dword [rax + rax]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140036cd4
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140036ee9
mov ecx, dword [0x140096f7c]
movsx eax, word [0x140096c3c]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x140096eb8]
cmp dword [0x1400961a4], 0
je 0x140036d0e
cvtps2pd xmm2, xmm0
divsd xmm2, xmm7
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm2, xmm0
jmp 0x140036d21
movd xmm2, eax
cvtdq2pd xmm2, xmm2
cvtps2pd xmm1, xmm0
divsd xmm1, xmm6
subsd xmm2, xmm1
cvttsd2si ebx, xmm2
mov word [0x140096c3c], bx
movsx eax, bx
cmp eax, ecx
jl 0x140036d3f
movzx ebx, cx
mov word [0x140096c3c], cx
jmp 0x140036d4e
test bx, bx
jg 0x140036d4e
movzx ebx, si
mov word [0x140096c3c], bx
cmp bx, di
jl 0x140036d58
movzx ebx, di
jmp 0x140036d60
test bx, bx
jg 0x140036d60
movzx ebx, si
mov r9d, 2
movzx r8d, bl
xor edx, edx
mov rcx, qword [0x140096fe8]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movsx eax, bx
mov dword [0x140096fe0], eax
mov ebx, dword [0x140097034]
cmp dword [0x140097230], 0
jne 0x140036db3
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140036daa
mov dword [0x140097230], 1
jmp 0x140036dc6
cmp dword [0x140097230], 0
je 0x140036de1
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140036dd8
mov dword [0x140097230], esi
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
cmp dword [0x140097230], 0
jne 0x140036e07
mov rcx, qword [0x140096fe8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov rcx, qword [0x140096fe8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x140036e22
cmp word [0x140096c3c], 0
jne 0x140036e20
xor edx, edx
mov rcx, qword [0x140096fe8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
mov dword [0x1400961a4], eax
lea rdx, [rsp + 0x70]
call fcn.14000e640
mov rdx, rax
lea rcx, [0x140096de0]
call fcn.140036fe0
lea rcx, [rsp + 0x70]
call fcn.140015d30
cmp dword [0x140096dc8], 0
jne 0x140036e7e
mov rax, qword [0x140096e68]
mov ecx, dword [rax + 0xc]
mov edx, dword [rax + 0x10]
mov r8d, dword [rax + 0x14]
mov dword [0x140096e1c], ecx
mov dword [0x140096e20], edx
mov dword [0x140096e24], r8d
mov dword [0x140096e28], edi
cmp qword [0x140097080], 0
jne 0x140036eb8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov r8d, 7
lea rdx, str.Verdana
lea rcx, [rsp + 0x30]
call fcn.140088e70
lea rdx, [rsp + 0x30]
jmp 0x140036ec8
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140038c80
mov rdx, rax
call fcn.14000dba0
mov eax, dword [0x1400970d4]
mov dword [0x140096fd0], eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140036cb0
mov edx, gethostbyname
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.140007af0
mov rcx, qword [rax]
call fcn.14000a9f0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0x20], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x30], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x40], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x50], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x60], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x70], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x80], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0x90], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0xa0], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0xb0], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0xc0], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov dword [rbp + 0xd0], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3