Function at 0x140001670
Capabilities:
Enumerate processes
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
xor r15d, r15d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001714
mov dword [rbp - 0x50], 0x238
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000170b
nop dword [rax]
lea rdx, [0x1400065a8]
lea rcx, [rbp - 0x24]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rbx
test rax, rax
jne 0x1400017a9
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400016e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1400065a0]
lea rcx, [rbp - 0x70]
call fcn.140002c30
nop
call fcn.140001390
test eax, eax
je 0x140001ddb
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001dd2
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov qword [rbp - 0x78], r15
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], r15
lea r8, [0x1400067b8]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400014c0
lea rcx, [rsp + 0x78]
cmp rcx, rax
je 0x1400017b8
mov r12, qword [rax]
mov qword [rsp + 0x78], r12
mov r14, qword [rax + 8]
mov qword [rbp - 0x80], r14
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x78], rcx
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
jmp 0x1400017c1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x24]
jmp 0x14000171b
mov r14, qword [rbp - 0x80]
mov r12, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000180c
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001807
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001807
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003f50
lea r8, [0x140006790]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1400014c0
lea rcx, [rsp + 0x60]
cmp rcx, rax
je 0x140001851
mov r13, qword [rax]
mov qword [rsp + 0x60], r13
mov rsi, qword [rax + 8]
mov qword [rsp + 0x68], rsi
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
jmp 0x14000185b
mov rsi, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400018a6
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003f50
lea rcx, [0x1400065d0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400065d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003000
lea rdx, [0x1400065d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003000
lea rdx, [0x1400065d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003000
lea rdx, [0x1400065d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003000
lea rdx, [0x1400065d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003000
lea rdx, [0x1400065d4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003000
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400031e0
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
mov rcx, rax
call fcn.140003900
lea rdx, [0x1400033b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.e_90m___________________Setting_Hotkey_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003000
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400033f0
movsx ecx, byte [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov dword [rsp + 0x34], eax
lea rdx, str.e_32m___________________Enjoy_Your_Game_Used_My_e_33mCheat.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003000
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov r9, rax
cmp rbx, 0x989680
jne 0x1400019c2
imul rcx, r9, 0x64
jmp 0x140001a3b
cmp rbx, 0x16e3600
jne 0x140001a20
movabs r10, 0xb2f4fc0794908cf3
mov rax, r10
imul r9
add rdx, r9
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
imul r8, rdx, 0x3b9aca00
imul rcx, rdx, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
mov rax, r10
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
add rcx, r8
jmp 0x140001a3b
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rcx, rax
movabs rax, 0x7fffffff4d2fa1ff
movabs rdx, 0x7fffffffffffffff
cmp rcx, rax
jge 0x140001a63
mov eax, 0xb2d05e00
add rax, rcx
mov qword [rsp + 0x38], rax
jmp 0x140001a68
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x38]
call fcn.140003ad0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r15b, r15b
mov byte [rsp + 0x31], r15b
xor bl, bl
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140001c96
call fcn.140001390
test eax, eax
je 0x140001cfd
movsx ecx, byte [rsp + 0x34]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001c3b
test bl, bl
jne 0x140001c3d
cmp byte [rsp + 0x31], bl
sete al
mov byte [rsp + 0x31], al
mov byte [rsp + 0x30], 1
mov rbx, r12
cmp r12, r14
je 0x140001ba4
test r15b, r15b
jne 0x140001b20
nop dword [rax + rax]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, str.zVw_
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r14
jne 0x140001af0
jmp 0x140001ba9
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [0x1400067c8]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, r14
jne 0x140001b20
movzx eax, byte [0x14000977c]
test al, al
je 0x140001b5e
xor al, al
mov byte [0x14000977c], al
mov rbx, r13
cmp r13, rsi
je 0x140001c14
test r15b, r15b
jne 0x140001bc0
nop
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [0x1400067a0]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, rsi
jne 0x140001b70
movzx eax, byte [0x14000977c]
jmp 0x140001c19
test r15b, r15b
jne 0x140001b4b
movzx eax, byte [0x14000977c]
test al, al
jne 0x140001b5e
mov al, 1
jmp 0x140001b58
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [0x1400067d8]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, rsi
jne 0x140001bc0
movzx eax, byte [0x14000977c]
test al, al
je 0x140001bfd
mov byte [0x14000977c], 0
mov edx, 0x1f4
mov ecx, 0x55
call qword [sym.imp.KERNEL32.dll_Beep]
movzx ebx, byte [rsp + 0x30]
jmp 0x140001c3d
test r15b, r15b
jne 0x140001bf2
test al, al
jne 0x140001c24
mov byte [0x14000977c], 1
mov edx, 0x258
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Beep]
movzx ebx, byte [rsp + 0x30]
jmp 0x140001c3d
xor bl, bl
lea rcx, [rsp + 0x40]
call fcn.140001290
mov rax, qword [rsp + 0x40]
movabs rcx, 0x7ffffffffa0a1eff
cmp rax, rcx
jge 0x140001c63
add rax, 0x5f5e100
jmp 0x140001c6d
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.140003ad0
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
movzx r15d, byte [rsp + 0x31]
jns 0x140001aa1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xc8
mov ecx, 0x82
call qword [sym.imp.KERNEL32.dll_Beep]
nop
test r13, r13
je 0x140001d91
mov rax, qword [rsp + 0x70]
sub rax, r13
sar rax, 3
lea rdx, [rax*8]
mov rax, r13
cmp rdx, 0x1000
jb 0x140001d88
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test r13, r13
je 0x140001d40
mov rax, qword [rsp + 0x70]
sub rax, r13
sar rax, 3
lea rdx, [rax*8]
mov rax, r13
cmp rdx, 0x1000
jb 0x140001d37
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001cf6
mov rcx, r13
call fcn.140003f50
nop
test r12, r12
je 0x140001df8
mov rax, qword [rbp - 0x78]
sub rax, r12
sar rax, 3
lea rdx, [rax*8]
mov rax, r12
cmp rdx, 0x1000
jb 0x140001d7e
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dcb
mov rcx, r12
call fcn.140003f50
jmp 0x140001df8
mov rcx, r13
call fcn.140003f50
nop
test r12, r12
je 0x140001df8
mov rax, qword [rbp - 0x78]
sub rax, r12
sar rax, 3
lea rdx, [rax*8]
mov rax, r12
cmp rdx, 0x1000
jb 0x140001d7e
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.Failed_To_Process
jmp 0x140001de2
lea rdx, str.Process_Not_Found
mov r9d, 0x10
lea r8, [0x140006554]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140001e3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e36
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003f50
xor eax, eax
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140003f30
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret