Function at 0x1400011c0
Capabilities:
Log keystrokes via polling
Move file
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
lea rcx, str.mylove
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
mov r14, qword [rbx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor r13d, r13d
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], r13b
jne 0x140001227
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x14000170f
mov qword [rbp - 0x18], 0xf
cmp rbx, 0xf
ja 0x14000126e
mov qword [rbp - 0x20], rbx
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x30], r13b
jmp 0x140001305
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x1400012a3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001bc0
test rax, rax
je 0x1400012ce
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400012e7
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400012d5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001715
jmp 0x140001288
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400012e4
call fcn.140001bc0
mov rsi, rax
jmp 0x1400012e7
mov rsi, r13
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r13b
lea rbx, [rbp - 0x30]
mov r15, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x18]
cmp rdi, 0xf
cmova rbx, r15
mov rsi, qword [rbp - 0x20]
cmp rsi, 4
jb 0x14000136f
lea r14, [rsi + rbx]
lea r8, [r14 - 3]
sub r8, rbx
mov edx, 0x2e
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14000136f
cmp dword [rax], 0x6578652e
je 0x140001366
inc rax
lea r8, [r14 - 3]
sub r8, rax
mov edx, 0x2e
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140001340
jmp 0x14000136f
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x1400013bc
mov rax, rdi
sub rax, rsi
cmp rax, 4
jb 0x14000139d
lea rax, [rsi + 4]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x30]
cmp rdi, 0xf
cmova rax, r15
mov dword [rax + rsi], 0x6578652e
mov byte [rax + rsi + 4], 0
jmp 0x1400013b4
mov qword [rsp + 0x20], 4
mov edx, 4
lea rcx, [rbp - 0x30]
call fcn.140001990
mov r15, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x18]
lea rcx, [rbp - 0x30]
cmp rdi, 0xf
cmova rcx, r15
lea rdx, str.v0.92_Defender__Project_Beast_.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov dword [rbp - 0x3c], r13d
lea rdx, str.Project_Beast__Gepard_Shield_3.0______
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov r15, rax
lea rdx, [rbp - 0x3c]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x38], r13d
xor sil, sil
mov r8d, dword [rbp - 0x3c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
cmp dword [rbp - 0x3c], 0
je 0x140001560
mov edx, 0xf
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Server_Found_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001780
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xe
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Loading_._._.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001780
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xd
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Server
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001780
mov edx, 0xa
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Injected_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001780
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xe
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.F6__Defender_Skill
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001780
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.F7__Pause_Autodefender
call fcn.140001780
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.4__Unpause_Autodefender
call fcn.140001780
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r12d, 1
cmp sil, r12b
je 0x1400016c5
nop
xor bl, bl
mov edi, r13d
nop word [rax + rax]
lea edx, [rdi*4 + 0x10dd284]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx ebx, bl
cmp dword [rbp - 0x38], 0x3e
cmove ebx, r12d
inc edi
cmp edi, 0x1d
jle 0x140001580
test bl, bl
jne 0x1400015ea
xor r9d, r9d
mov edx, pe_nt_image_headers64
lea r8d, [r9 + 0x75]
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
mov edx, 0x101
lea r8d, [r9 + 0x75]
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x76
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140001611
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp sil, r12b
jne 0x140001570
jmp 0x1400016c5
lea rdx, str.PAUSED
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001780
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, r13d
lea edx, [rdi*4 + 0x10dd284]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp - 0x38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx ebx, bl
cmp dword [rbp - 0x38], 0x3e
cmove ebx, r12d
inc edi
cmp edi, 0x1d
jle 0x140001642
cmp bl, r12b
jne 0x1400016ad
xor r9d, r9d
mov edx, pe_nt_image_headers64
lea r8d, [r9 + 0x75]
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
mov edx, 0x101
lea r8d, [r9 + 0x75]
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx esi, r12b
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x34
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001566
lea rdx, str.Defender_ON_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001780
mov rcx, rax
lea rdx, [0x140001950]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor sil, sil
jmp 0x140001566
call fcn.1400011a0
int3
call fcn.140001100
int3