Function at 0x1400035b0
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14000d008]
xor rax, rsp
mov qword [rbp], rax
xor r13d, r13d
lea rdx, str._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400053d0
lea rdx, str.cobalt.solutions_auto_login:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400053d0
lea rdx, [0x140005780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400053d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea r8d, [r13 + 0x13]
lea rdx, str.C:cobalt.solutions
lea rcx, [rbp - 0x60]
call fcn.140005a20
nop
mov rdi, qword [rbp - 0x50]
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rbx, qword [rbp - 0x60]
call fcn.14000663c
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.140001920
nop
lea rcx, [rbp - 0x80]
call fcn.140002410
test al, al
sete bl
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1400036d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006c2c
test bl, bl
je 0x140003777
mov rdi, qword [rbp - 0x50]
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rbx, qword [rbp - 0x60]
call fcn.14000663c
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001920
nop
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call fcn.140006778
shr rax, 0x20
test eax, eax
jne 0x140003ec8
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003777
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003772
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003772
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006c2c
mov ebx, 0xb
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Please_place_the_client.exe_file_inside_the_directory__C:cobalt.solutions__.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400053d0
mov r15, qword [rbp - 0x50]
movabs r8, 0x7fffffffffffffff
mov rax, r8
sub rax, r15
cmp rax, rbx
jb 0x140003eb6
mov rcx, r15
mov rdx, r15
lea esi, [rbx + 4]
mov r9d, 0x16
movabs rax, 0x8000000000000000
lea r12, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
jb 0x1400037ee
mov r12, qword [rbp - 0x60]
mov rcx, rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea r14, [rcx + 0xb]
mov rbx, rsi
lea rdi, [rsp + 0x30]
cmp r14, rbx
jbe 0x14000387e
mov rbx, r14
or rbx, 0xf
cmp rbx, r8
jbe 0x140003826
mov rbx, r8
add rax, 0x27
jmp 0x140003848
cmp rbx, 0x16
cmovb rbx, r9
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003867
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003ed5
mov rcx, rax
call fcn.140006bf0
test rax, rax
je 0x1400039cf
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003879
test rcx, rcx
je 0x140003876
call fcn.140006bf0
mov rdi, rax
jmp 0x140003879
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, r15
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.client.exe]
movsd qword [rdi + r15], xmm0
movzx eax, word [0x1400088b8]
mov word [rdi + r15 + 8], ax
movzx eax, byte [0x1400088ba]
mov byte [rdi + r15 + 0xa], al
mov byte [rdi + r14], 0
mov rdi, qword [rsp + 0x40]
lea rbx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rbx, qword [rsp + 0x30]
call fcn.14000663c
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.140001920
nop
lea rcx, [rbp - 0x80]
call fcn.140002410
test al, al
sete bl
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140003946
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003941
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039c8
call fcn.140006c2c
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140003990
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000398b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039cf
call fcn.140006c2c
test bl, bl
je 0x1400039d6
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r15, qword [rbp - 0x50]
mov rcx, r15
mov rdx, r15
movabs r8, 0x7fffffffffffffff
mov rax, r8
sub rax, r15
cmp rax, 0xb
jb 0x140003eb6
jmp 0x1400037cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ebx, 2
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._nGood__the_client.exe_file_has_been_added._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400053d0
mov r15, qword [rbp - 0x50]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xb
jb 0x140003edb
lea r12, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r12, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r14, [r15 + 0xb]
mov rbx, rsi
lea rdi, [rsp + 0x30]
cmp r14, rbx
jbe 0x140003ad2
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140003a8b
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006bf0
test rax, rax
je 0x140003ab4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003acd
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003abb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003ebc
jmp 0x140003a70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140003aca
call fcn.140006bf0
mov rdi, rax
jmp 0x140003acd
mov rdi, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, r15
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.cobalt.txt]
movsd qword [rdi + r15], xmm0
movzx eax, word [0x1400087f0]
mov word [rdi + r15 + 8], ax
movzx eax, byte [0x1400087f2]
mov byte [rdi + r15 + 0xa], al
mov byte [rdi + r14], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.140002780
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140003b65
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006c2c
movdqa xmm0, xmmword [0x140008b50]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
cmp qword [rbp - 0x30], 0
je 0x140003bc7
cmp qword [rbp - 0x10], 0
je 0x140003bc7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Login_information_found_successfully._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400053d0
lea rdx, str.Press_INS_to_type_the_username_and_HOME_to_type_the_password__Press_ESC_to_finish_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400053d0
jmp 0x140003bd0
lea rcx, [rbp - 0x60]
call fcn.140003010
mov rdi, qword [rbp - 0x50]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdi
cmp rax, 0xb
jb 0x140003eb0
lea r15, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r15, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r14, [rdi + 0xb]
lea rbx, [rsp + 0x60]
cmp r14, 0xf
jbe 0x140003c98
mov rsi, r14
or rsi, 0xf
cmp rsi, rcx
jbe 0x140003c58
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006bf0
test rax, rax
je 0x140003d3d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140003c93
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140003c81
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003ec2
jmp 0x140003c39
test rcx, rcx
je 0x140003c90
call fcn.140006bf0
mov rbx, rax
jmp 0x140003c93
mov rbx, r13
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rsi
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.client.exe]
movsd qword [rbx + rdi], xmm0
movzx eax, word [0x1400088b8]
mov word [rbx + rdi + 8], ax
movzx eax, byte [0x1400088ba]
mov byte [rbx + rdi + 0xa], al
mov byte [rbx + r14], 0
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140003d49
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006c2c
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140003d6a
lea rcx, [rbp - 0x40]
jmp 0x140003d7e
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140003d95
lea rcx, [rbp - 0x20]
call fcn.140002620
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x32
jmp 0x140003d4e
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140003dac
mov ecx, 0x32
jmp 0x140003d4e
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003de3
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003dde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e26
call fcn.140006c2c
movdqa xmm0, xmmword [0x140008b50]
movdqa xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140003e32
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006c2c
movdqa xmm0, xmmword [0x140008b50]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140003e81
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e7c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006c2c
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140006bd0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.1400011b0
int3
call fcn.140001110
nop
call fcn.140001110
nop
lea r8, [rsp + 0x30]
mov edx, eax
call fcn.140002340
nop
call fcn.140001110
int3
call fcn.1400011b0
int3