Function at 0x140091830
Capabilities:
Create thread
Enumerate gui resources
Log keystrokes via polling
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0xe78
mov rax, qword [0x14014a040]
xor rax, rsp
mov qword [rsp + 0xe60], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
lea rax, [rsp + 0x260]
lea rcx, [0x14011dc90]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x276]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ea
rep stosb byte [rdi], al
lea rax, [rsp + 0x460]
lea rcx, str.Drives.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x478]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e8
rep stosb byte [rdi], al
lea rax, [rsp + 0x660]
lea rcx, [0x14011dca8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x676]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ea
rep stosb byte [rdi], al
lea rax, [rsp + 0x860]
lea rcx, str.drives.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x878]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e8
rep stosb byte [rdi], al
lea rcx, [rsp + 0x260]
call fcn.140092d20
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140091945
lea rcx, [rsp + 0x460]
call fcn.140092d20
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14009195d
lea rcx, [rsp + 0x660]
call fcn.140092d20
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140091975
lea rcx, [rsp + 0x860]
call fcn.140092d20
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140091984
mov dword [rsp + 0x40], 1
lea rdx, str.quyengabon0676
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x1400919c5
lea rdx, str._n_quyengabon0676
lea rcx, [0x140199640]
call fcn.140011510
lea rcx, [0x14011dd00]
call fcn.1400ade74
cmp qword [rsp + 0x80], 0
je 0x1400919d8
mov dword [rsp + 0x44], 1
lea rcx, str.Color_F
call fcn.1400ade74
lea rcx, str.MODE_Con_Cols56_lines16
call fcn.1400ade74
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011dd4c]
lea rcx, [0x140199640]
call fcn.140011510
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011dd48]
lea rcx, [0x140199640]
call fcn.140011510
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011dd70]
lea rcx, [0x140199640]
call fcn.140011510
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0xc60]
lea rcx, [0x14011dd50]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xc80]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e0
rep stosb byte [rdi], al
lea rax, [rsp + 0xa60]
lea rcx, [0x14011dd78]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa80]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e0
rep stosb byte [rdi], al
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011dd74]
lea rcx, [0x140199640]
call fcn.140011510
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011dd9c]
lea rcx, [0x140199640]
call fcn.140011510
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14011dd98]
lea rcx, [0x140199640]
call fcn.140011510
lea rcx, [rsp + 0xa60]
call fcn.140092d20
mov dword [0x14019b96c], eax
mov r8d, dword [0x14019b96c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14019b970], rax
xor edx, edx
lea rcx, [0x1400923a0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [0x14019b978]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x140091b6f
mov edx, 9
mov rcx, qword [0x14019b978]
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x14019b96c]
call fcn.1400916d0
mov qword [0x14019b978], rax
cmp qword [0x14019b978], 0
jne 0x140091bc7
mov rcx, qword [0x14019b988]
call fcn.140091320
mov r9d, 1
lea r8, str.Unicorn
lea rdx, [0x14011dda0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.pause__nul
call fcn.1400ade74
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x88], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x8c], eax
lea rdx, [rsp + 0x98]
mov rcx, qword [0x14019b978]
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
call fcn.140012490
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0xe8]
call fcn.1400912e0
nop
lea rdx, str.__nGAME_PID:_0x
lea rcx, [0x140199640]
call fcn.140011510
lea rdx, [0x140091250]
mov rcx, rax
call fcn.140092570
lea rdx, [0x1400912b0]
mov rcx, rax
call fcn.140092570
mov edx, dword [0x14019b96c]
mov rcx, rax
call fcn.140007fe0
lea rdx, [0x14011dde0]
mov rcx, rax
call fcn.140011510
lea rdx, [0x140091280]
mov rcx, rax
call fcn.140092570
mov edx, dword [0x14019b96c]
mov rcx, rax
call fcn.140007fe0
lea rdx, [0x14000cbf0]
mov rcx, rax
call fcn.140008230
lea rdx, str.C:WindowsFonts_tahoma.ttf
lea rcx, [rsp + 0xc8]
call fcn.1400088a0
nop
lea rdx, str.arial_unicode_ms.ttf
lea rcx, [rsp + 0xa8]
call fcn.1400088a0
nop
mov eax, dword [rsp + 0x9c]
mov ecx, dword [rsp + 0xa4]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x98]
mov edx, dword [rsp + 0xa0]
sub edx, ecx
mov ecx, edx
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x9c]
mov ecx, dword [rsp + 0x98]
call fcn.1400118c0
mov r8d, dword [0x14019b120]
mov edx, dword [0x14019b124]
mov rcx, qword [0x14019b140]
call fcn.140010680
xor ecx, ecx
call fcn.14002ed80
call fcn.14002eee0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x394], 1
lea rcx, [rsp + 0x140]
call fcn.14005ced0
mov byte [rsp + 0x188], 1
mov byte [rsp + 0x160], 1
mov dword [rsp + 0x158], 2
mov dword [rsp + 0x15c], 2
movss xmm0, dword [0x14013cf54]
movss dword [rsp + 0x180], xmm0
lea rcx, [rsp + 0x1d0]
call fcn.14005ced0
mov byte [rsp + 0x1dc], 0
lea rcx, [rsp + 0xc8]
call fcn.140008670
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x14013cf5c]
mov rdx, rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0xa0]
call fcn.14005d950
lea rax, [0x14013cc50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x14013cf60]
mov r8d, 0x1e695
lea rdx, [0x14011df60]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0xa0]
call fcn.14005dd20
call fcn.1400915e0
mov rcx, qword [0x14019b140]
call fcn.1400673f0
mov rcx, qword [0x14019b108]
call fcn.140066d70
lea rcx, [rsp + 0xa8]
call fcn.140008670
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x14013cf80]
mov rdx, rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0xa0]
call fcn.14005d950
mov qword [0x14019b0e0], rax
lea rcx, [rsp + 0xc8]
call fcn.140008670
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x14013cf5c]
mov rdx, rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0xa0]
call fcn.14005d950
mov qword [0x14019b0e8], rax
lea rcx, [rsp + 0xa8]
call fcn.140008670
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x14013cf5c]
mov rdx, rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0xa0]
call fcn.14005d950
mov qword [0x14019b0d0], rax
lea rax, [0x14013cc50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
movss xmm3, dword [0x14013cf60]
mov r8d, 0x1e695
lea rdx, [0x14011df60]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0xa0]
call fcn.14005dd20
mov qword [0x14019b0f0], rax
cmp dword [rsp + 0x40], 1
jne 0x140091fa9
cmp dword [rsp + 0x44], 1
jne 0x140091fa9
movzx eax, byte [0x14019b07d]
test eax, eax
jne 0x140091fa9
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140007b50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140007980]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140018ee0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
cmp eax, 1
je 0x140092346
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x14019b140]
lea rcx, [rsp + 0x108]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140092002
lea rcx, [rsp + 0x108]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x108]
call qword [sym.imp.USER32.dll_DispatchMessageW]
movzx eax, byte [0x14014ace9]
test eax, eax
je 0x14009201a
mov rcx, qword [0x14019b140]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14009207d
movzx eax, byte [0x14019b14c]
test eax, eax
jne 0x140092042
mov dword [rsp + 0x48], 1
jmp 0x14009204a
mov dword [rsp + 0x48], 0
movzx eax, byte [rsp + 0x48]
mov byte [0x14019b14c], al
movzx eax, byte [0x14019b07f]
test eax, eax
jne 0x14009206a
mov dword [rsp + 0x4c], 1
jmp 0x140092072
mov dword [rsp + 0x4c], 0
movzx eax, byte [rsp + 0x4c]
mov byte [0x14019b07f], al
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140092161
movzx eax, byte [0x14014acd6]
cmp eax, 1
jne 0x140092100
mov rdx, qword [0x14019b140]
xor ecx, ecx
call fcn.140093680
movzx eax, byte [0x14014acd6]
test eax, eax
jne 0x1400920c3
mov dword [rsp + 0x50], 1
jmp 0x1400920cb
mov dword [rsp + 0x50], 0
movzx eax, byte [rsp + 0x50]
mov byte [0x14014acd6], al
movzx eax, byte [0x14014ace9]
test eax, eax
jne 0x1400920eb
mov dword [rsp + 0x54], 1
jmp 0x1400920f3
mov dword [rsp + 0x54], 0
movzx eax, byte [rsp + 0x54]
mov byte [0x14014ace9], al
jmp 0x140092161
mov rdx, qword [0x14019b140]
mov ecx, 1
call fcn.140093680
movzx eax, byte [0x14014acd6]
test eax, eax
jne 0x140092126
mov dword [rsp + 0x58], 1
jmp 0x14009212e
mov dword [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov byte [0x14014acd6], al
movzx eax, byte [0x14014ace9]
test eax, eax
jne 0x14009214e
mov dword [rsp + 0x5c], 1
jmp 0x140092156
mov dword [rsp + 0x5c], 0
movzx eax, byte [rsp + 0x5c]
mov byte [0x14014ace9], al
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14009219c
movzx eax, byte [0x14019b14d]
test eax, eax
jne 0x140092189
mov dword [rsp + 0x60], 1
jmp 0x140092191
mov dword [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
mov byte [0x14019b14d], al
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400921ff
movzx eax, byte [0x14019b14e]
test eax, eax
jne 0x1400921c4
mov dword [rsp + 0x64], 1
jmp 0x1400921cc
mov dword [rsp + 0x64], 0
movzx eax, byte [rsp + 0x64]
mov byte [0x14019b14e], al
movzx eax, byte [0x14019b12e]
test eax, eax
jne 0x1400921ec
mov dword [rsp + 0x68], 1
jmp 0x1400921f4
mov dword [rsp + 0x68], 0
movzx eax, byte [rsp + 0x68]
mov byte [0x14019b12e], al
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14009223a
movzx eax, byte [0x14014acd7]
test eax, eax
jne 0x140092227
mov dword [rsp + 0x6c], 1
jmp 0x14009222f
mov dword [rsp + 0x6c], 0
movzx eax, byte [rsp + 0x6c]
mov byte [0x14014acd7], al
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14009229d
movzx eax, byte [0x14019b12f]
test eax, eax
jne 0x140092262
mov dword [rsp + 0x70], 1
jmp 0x14009226a
mov dword [rsp + 0x70], 0
movzx eax, byte [rsp + 0x70]
mov byte [0x14019b12f], al
movzx eax, byte [0x140198a4e]
test eax, eax
jne 0x14009228a
mov dword [rsp + 0x74], 1
jmp 0x140092292
mov dword [rsp + 0x74], 0
movzx eax, byte [rsp + 0x74]
mov byte [0x140198a4e], al
mov ecx, 0x54
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400922f1
cmp dword [0x14019b998], 0
jne 0x1400922c9
mov eax, dword [0x14019b998]
inc eax
mov dword [0x14019b998], eax
jmp 0x1400922f1
cmp dword [0x14019b998], 1
jne 0x1400922de
mov dword [0x14019b998], 2
jmp 0x1400922f1
cmp dword [0x14019b998], 2
jne 0x1400922f1
mov dword [0x14019b998], 0
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x140092341
movzx eax, byte [0x14019b14e]
test eax, eax
je 0x14009231f
movzx eax, byte [0x14019b07e]
test eax, eax
jne 0x14009231f
call fcn.140092770
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14019b988]
call fcn.140091320
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x140091fa9
mov dword [rsp + 0x78], 0
lea rcx, [rsp + 0xa8]
call fcn.140008740
nop
lea rcx, [rsp + 0xc8]
call fcn.140008740
nop
lea rcx, [rsp + 0xe8]
call fcn.140008740
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0xe60]
xor rcx, rsp
call fcn.1400955d0
add rsp, 0xe78
pop rdi
pop rsi
ret