Function at 0x1400010f0
Capabilities:
Enumerate processes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor esi, esi
mov dword [rsp + 0x40], 0x130
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000117b
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000117b
nop word [rax + rax]
lea rdx, [rsp + 0x6c]
lea rcx, str.WorldOfTanks.exe
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rbx
test eax, eax
je 0x140001448
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Process_not_found
call fcn.140001460
mov rcx, rax
lea rdx, [0x140001640]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, esi
mov edx, ebx
lea rcx, str.WorldOfTanks.exe
call section..text
mov edx, ebx
lea rcx, str.python27.dll
mov rdi, rax
call section..text
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.working
mov rbx, rax
call fcn.140001460
mov rcx, rax
lea rdx, [0x1400033a4]
call fcn.140001460
mov rcx, rax
lea rdx, str.F1_close
call fcn.140001460
mov rcx, rax
lea rdx, [0x1400033a4]
call fcn.140001460
mov rcx, rax
lea rdx, str.F2_reload
call fcn.140001460
mov rcx, rax
lea rdx, [0x140001640]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140003358]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400013f5
cmp rbx, 0xffffffffffffffff
je 0x1400012dd
lea rdx, [rdi + 0x36620ac]
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rdi + 0x550045]
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rdi + 0x3108b08]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rsp + 0x30]
test al, al
jne 0x140001325
cmp dword [rsp + 0x34], 6
jne 0x140001363
lea rdx, [rdi + 0x550045]
mov dword [rsp + 0x34], 2
mov r9d, 1
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rsp + 0x30]
cmp al, 1
jne 0x140001363
cmp dword [rsp + 0x34], 2
jne 0x140001363
lea rdx, [rdi + 0x550045]
mov dword [rsp + 0x34], 6
mov r9d, 1
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x38], 0x1c
jne 0x1400013cd
lea rdx, [rdi + 0x550045]
mov dword [rsp + 0x34], 6
mov r9d, 1
mov byte [rsp + 0x30], 1
lea r8, [rsp + 0x34]
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rdi + 0x36620ac]
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400013fe
lea rdx, [0x140003358]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140001252
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.closed
call fcn.140001460
lea rdx, [0x140001640]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140001700
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x48]
jmp 0x1400011a9