Function at 0x1400516d0
Capabilities:
Create directory
Delete file
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, str.Russian
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
xor edx, edx
lea rcx, str.C:VISION
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [0x1404268b8]
mov rax, qword [rcx + 0x3ed0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x37e8]
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x67], xmm1
mov dword [rbp + 0x6b], 0x41f00000
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 0x10]
lea r8, [0x140426910]
lea rdx, str.Search_Config
lea rcx, [0x1400686c0]
call fcn.140041e40
call fcn.14000b0a0
test al, al
je 0x1400517ac
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea edx, [r15 + 0x50]
mov r9d, 0x409
lea r8d, [r15 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [0x1404268b8]
mov rax, qword [rcx + 0x3ed0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x37e8]
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x67], xmm1
mov dword [rbp + 0x6b], 0x41f00000
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r14, [0x140426940]
mov r8, r14
lea rdx, str.Config_Name
lea rcx, [0x1400686d4]
call fcn.140041e40
call fcn.14000b0a0
test al, al
je 0x14005183d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov edx, 0x50
mov r9d, 0x409
lea r8d, [rdx - 0x4f]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [0x1404268b8]
mov rax, qword [rcx + 0x3ed0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x37e8]
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x67], xmm1
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Create
call fcn.140037320
test al, al
je 0x140051885
call fcn.140050d00
mov rcx, qword [0x1404268b8]
mov rax, qword [rcx + 0x3ed0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x37e8]
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x67], xmm1
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Delete
call fcn.140037320
mov rbx, 0xffffffffffffffff
movabs rcx, 0x7fffffffffffffff
lea rsi, [0x1404263c8]
lea edx, [rbx + 0x17]
movabs r13, 0x8000000000000027
test al, al
je 0x140051ba0
mov r12, qword [0x1404263d8]
mov rdi, rbx
nop dword [rax + rax]
inc rdi
cmp byte [r14 + rdi], r15b
jne 0x140051900
mov rax, rcx
sub rax, r12
cmp rax, rdi
jb 0x140051fe5
mov r13, rsi
cmp qword [0x1404263e0], 0x10
cmovae r13, qword [0x1404263c8]
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
lea r15, [rdi + r12]
mov esi, 0xf
lea r14, [rbp - 0x39]
cmp r15, rsi
jbe 0x1400519ba
mov rsi, r15
or rsi, 0xf
cmp rsi, rcx
jbe 0x140051981
mov rsi, rcx
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.140056f6c
test rax, rax
je 0x140051ad7
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400519b6
cmp rsi, rdx
cmovb rsi, rdx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400519a4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140051fd9
jmp 0x140051962
test rcx, rcx
je 0x1400519b3
call fcn.140056f6c
mov r14, rax
jmp 0x1400519b6
xor r14d, r14d
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], rsi
mov r8, r12
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r14 + r12]
mov r8, rdi
lea rdx, [0x140426940]
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + r15], 0
mov rcx, qword [rbp - 0x29]
mov rdx, qword [rbp - 0x21]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140051a23
lea rax, [rcx + 4]
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x39]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x39]
mov dword [rax + rcx], 0x696e692e
mov byte [rax + rcx + 4], 0
lea rax, [rbp - 0x39]
jmp 0x140051a41
mov qword [rsp + 0x20], 4
lea r9, str..ini
mov edx, 4
lea rcx, [rbp - 0x39]
call fcn.14004b0e0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rdx, qword [0x140426980]
cmp rdx, 0x10
jb 0x140051a97
mov rcx, qword [0x140426968]
inc rdx
cmp rdx, 0x1000
jb 0x140051a92
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140051ade
mov rcx, r8
call fcn.140056c5c
movups xmmword [0x140426968], xmm6
movups xmmword [0x140426978], xmm7
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x140051aea
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051ae5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051ae5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140056c5c
lea rcx, [0x140426968]
cmp qword [0x140426980], 0x10
cmovae rcx, qword [0x140426968]
mov qword [0x140426908], rcx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rbp - 0x39]
mov qword [rbp + 0x67], rax
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], 0xf
mov r8, rbx
lea r14, [0x140426940]
inc r8
cmp byte [r14 + r8], 0
jne 0x140051b30
mov rdx, r14
lea rcx, [rbp - 0x39]
call fcn.1400493b0
nop
mov qword [rbp - 0x19], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], 0xf
mov r8d, 0x19
lea rdx, str.C:VISIONConfig_List.ini
lea rcx, [rbp - 0x19]
call fcn.1400493b0
nop
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.140050880
xorps xmm0, xmm0
movups xmmword [0x140426940], xmm0
xorps xmm1, xmm1
movups xmmword [0x140426910], xmm1
movabs r13, 0x8000000000000027
lea rsi, [0x1404263c8]
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140051e58
mov r12, qword [0x1404263d8]
mov rdi, rbx
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x140051bc0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r12
cmp rax, rdi
jb 0x140051fd3
cmp qword [0x1404263e0], 0x10
cmovae rsi, qword [0x1404263c8]
mov qword [rbp + 0x67], rsi
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
lea r15, [rdi + r12]
mov esi, 0xf
lea r14, [rbp - 0x39]
cmp r15, rsi
jbe 0x140051c85
mov rsi, r15
or rsi, 0xf
cmp rsi, rcx
jbe 0x140051c3f
mov rsi, rcx
mov rcx, r13
call fcn.140056f6c
test rax, rax
je 0x140051c68
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140051c81
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140051c6f
lea r13, [rcx + 0x27]
cmp r13, rcx
jbe 0x140051fdf
jmp 0x140051c24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140051c7e
call fcn.140056f6c
mov r14, rax
jmp 0x140051c81
xor r14d, r14d
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], rsi
mov r8, r12
mov rdx, qword [rbp + 0x67]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r14 + r12]
mov r8, rdi
lea rdi, [0x140426940]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + r15], 0
mov rcx, qword [rbp - 0x29]
mov rdx, qword [rbp - 0x21]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140051cf2
lea rax, [rcx + 4]
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x39]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x39]
mov dword [rax + rcx], 0x696e692e
mov byte [rax + rcx + 4], 0
lea rax, [rbp - 0x39]
jmp 0x140051d10
mov qword [rsp + 0x20], 4
lea r9, str..ini
mov edx, 4
lea rcx, [rbp - 0x39]
call fcn.14004b0e0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
xor esi, esi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov rdx, qword [0x140426980]
cmp rdx, 0x10
jb 0x140051d65
mov rcx, qword [0x140426968]
inc rdx
cmp rdx, 0x1000
jb 0x140051d60
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140051dac
mov rcx, r8
call fcn.140056c5c
movups xmmword [0x140426968], xmm6
movups xmmword [0x140426978], xmm7
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x140051db8
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051db3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051db3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140056c5c
cmp qword [0x140426980], 0x10
lea rax, [0x140426968]
cmovae rax, qword [0x140426968]
mov qword [0x140426908], rax
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rax, [rbp - 0x19]
mov qword [rbp + 0x67], rax
mov qword [rbp - 0x19], rsi
mov qword [rbp - 9], rsi
mov qword [rbp - 1], 0xf
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140051df7
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x19]
call fcn.1400493b0
nop
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], 0xf
mov r8d, 0x19
lea rdx, str.C:VISIONConfig_List.ini
lea rcx, [rbp - 0x39]
call fcn.1400493b0
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140050880
xorps xmm0, xmm0
movups xmmword [0x140426940], xmm0
xorps xmm1, xmm1
movups xmmword [0x140426910], xmm1
mov rcx, qword [0x1404268b8]
mov rax, qword [rcx + 0x3ed0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x37e8]
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x67], xmm1
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Load
call fcn.140037320
test al, al
je 0x140051eb4
call fcn.1400500d0
xorps xmm0, xmm0
movups xmmword [0x140426940], xmm0
xorps xmm1, xmm1
movups xmmword [0x140426910], xmm1
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140051edf
call fcn.1400500d0
xorps xmm0, xmm0
movups xmmword [0x140426940], xmm0
xorps xmm1, xmm1
movups xmmword [0x140426910], xmm1
mov rcx, qword [0x1404268b8]
mov rax, qword [rcx + 0x3ed0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x37e8]
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x67], xmm1
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Save
call fcn.140037320
test al, al
je 0x140051f3b
call fcn.140050430
xorps xmm0, xmm0
movups xmmword [0x140426940], xmm0
xorps xmm1, xmm1
movups xmmword [0x140426910], xmm1
mov rcx, qword [0x1404268b8]
mov rax, qword [rcx + 0x3ed0]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rcx + 0x37e8]
addss xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp + 0x67], xmm1
mov dword [rbp + 0x6b], 0x41f00000
lea rdx, [rbp + 0x67]
lea rcx, str.Reset
call fcn.140037320
test al, al
je 0x140051fae
cmp byte [0x140426940], 0
je 0x140051fae
movaps xmm0, xmmword [0x140069140]
movups xmmword [0x14038b658], xmm0
call fcn.140050430
xorps xmm0, xmm0
movups xmmword [0x140426940], xmm0
xorps xmm1, xmm1
movups xmmword [0x140426910], xmm1
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140036270
int3
call fcn.1400361b0
int3
call fcn.1400361b0
int3
call fcn.140036270
int3