Function at 0x7ff6989f7580
Capabilities:
Create directory
Create thread
Encode data using xor
Enumerate gui resources
Enumerate process modules
Enumerate processes
Execute command
Hide graphical window
Log keystrokes via polling
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x7ff698a89018]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
xor esi, esi
mov r12d, 0xa
mov edx, r12d
lea rcx, [rbp + 0x40]
call fcn.7ff6989f5240
nop
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rcx, qword [rbp + 0x40]
call qword [sym.imp.kernel32.dll_SetConsoleTitleA]
call qword [sym.imp.kernel32.dll_AllocConsole]
xor edx, edx
lea rcx, [0x7ff698a67728]
call qword [sym.imp.user32.dll_FindWindowA]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.user32.dll_ShowWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.7ff6989f1ff0
cmp byte [0x7ff698a8967d], sil
jne 0x7ff6989f7d0c
mov rcx, qword [0x7ff698a89de8]
sub rcx, qword [0x7ff698a89de0]
sar rcx, 6
test rcx, rcx
jne 0x7ff6989f7d0c
lea ecx, [rsi + 3]
call qword [sym.imp.kernel32.dll_SetErrorMode]
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
je 0x7ff6989f7654
call qword [sym.imp.kernel32.dll_DebugBreak]
mov edx, 5
mov rcx, rbx
call qword [sym.imp.user32.dll_ShowWindow]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x7ff6989eec30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
cmp qword [0x7ff698a897b0], 0
jne 0x7ff6989f7d0c
mov r15d, 0xb
lea r14, [0x7ff698a67620]
lea r13, [0x7ff6989f1f40]
call qword [sym.imp.kernel32.dll_GetLastError]
mov qword [rbp - 0x78], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ecx, 0x3300
call qword [sym.imp.kernel32.dll_FormatMessageA]
mov ecx, 0xfffffff5
call qword [sym.imp.kernel32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.kernel32.dll_SetConsoleTextAttribute]
lea rcx, [0x7ff698a6773c]
call qword [sym.imp.ucrtbase.dll_system]
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rdx + 2]
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp + 0x70], 0x238
lea rdx, [rbp + 0x70]
mov rcx, rax
call sub.kernel32.dll_Process32FirstW
test eax, eax
je 0x7ff6989f775b
lea rdx, [0x7ff698a67740]
lea rcx, [rbp + 0x9c]
call qword [sym.imp.kernel32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x7ff6989f7750
lea rdx, [rbp + 0x70]
call sub.kernel32.dll_Process32NextW
jmp 0x7ff6989f7726
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [rbp + 0x78]
jmp 0x7ff6989f7766
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
mov dword [0x7ff698a8976c], eax
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x58], eax
lea rdx, [rbp - 0x60]
lea rcx, [0x7ff6989e7fd0]
call qword [sym.imp.user32.dll_EnumWindows]
test eax, eax
jne 0x7ff6989f779c
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x7ff6989f779c
mov rax, qword [rbp - 0x60]
test rax, rax
jne 0x7ff6989f779f
mov rax, rsi
mov qword [0x7ff698a897b0], rax
mov r8d, dword [0x7ff698a8976c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.kernel32.dll_OpenProcess]
mov qword [0x7ff698a897b8], rax
test rax, rax
jne 0x7ff6989f77f8
lea rdx, [0x7ff698a674f0]
mov rcx, qword [sym.imp.msvcp140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.7ff6989e8140
lea rdx, [0x7ff6989e8d70]
mov rcx, rax
call qword [sym.imp.msvcp140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::basic_istream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_istream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x7ff698a67548]
call qword [sym.imp.ucrtbase.dll_system]
jmp 0x7ff6989f785c
mov dword [rsp + 0x68], esi
lea r9, [rsp + 0x68]
mov r8d, 8
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.kernel32.dll_K32EnumProcessModules
test eax, eax
je 0x7ff6989f7d55
mov rdx, qword [rbp - 0x70]
mov qword [0x7ff698a89708], rdx
mov qword [rbp - 0x68], rsi
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0x78]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
jne 0x7ff6989f785c
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rdx, [rbp + 0x60]
mov rcx, qword [0x7ff698a897b0]
call qword [sym.imp.user32.dll_GetWindowRect]
test eax, eax
je 0x7ff6989f7cfe
lea rcx, [0x7ff698a6773c]
call qword [sym.imp.ucrtbase.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.kernel32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.kernel32.dll_SetConsoleTextAttribute]
mov rax, qword [0x7ff698a89708]
mov qword [0x7ff698a897a8], rax
mov ecx, 0xfffffff5
call qword [sym.imp.kernel32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.kernel32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x7ff698a679b0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x7ff698a67990]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x7ff698a679a0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x7ff698a67970]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x7ff698a67980]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x7ff698a678b0]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x7ff698a678c0]
movdqa xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0x30], 0x34393076
mov dword [rbp + 0x34], 0x100513f
mov rcx, rsi
nop dword [rax]
lea eax, [rcx - 0x1a]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x76
jb 0x7ff6989f7930
mov byte [rbp + 0x37], 0
mov rdx, qword [0x7ff698a897a8]
lea rcx, [rbp - 0x40]
call fcn.7ff6989f7de0
xor edx, edx
lea rcx, [0x7ff698a673c8]
call qword [sym.imp.kernel32.dll_CreateDirectoryA]
xor edx, edx
lea rcx, [0x7ff698a67788]
call qword [sym.imp.kernel32.dll_CreateDirectoryA]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x7ff6989f0a00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov qword [rbp - 0x40], 0x50
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp + 8], rsi
mov qword [rbp], r14
mov qword [rbp - 0x38], r13
lea rcx, [rbp - 0x40]
call qword [sym.imp.user32.dll_RegisterClassExW]
mov rcx, qword [0x7ff698a897b0]
test rcx, rcx
je 0x7ff6989f7d49
lea rdx, [0x7ff698a89680]
call qword [sym.imp.user32.dll_GetClientRect]
mov qword [rsp + 0x70], rsi
lea rdx, [rsp + 0x70]
mov rcx, qword [0x7ff698a897b0]
call qword [sym.imp.user32.dll_ClientToScreen]
mov eax, dword [rsp + 0x70]
mov dword [0x7ff698a89680], eax
mov eax, dword [rsp + 0x74]
mov dword [0x7ff698a89684], eax
mov ecx, dword [0x7ff698a89688]
mov dword [0x7ff698a897d0], ecx
mov eax, dword [0x7ff698a8968c]
mov dword [0x7ff698a897d4], eax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov r9d, 0x90000000
lea r8, [0x7ff698a67630]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.user32.dll_CreateWindowExW]
mov qword [0x7ff698a89f90], rax
lea rdx, [0x7ff698a66550]
mov rcx, rax
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x7ff698a89f90]
call qword [sym.imp.user32.dll_ShowWindow]
mov rcx, qword [0x7ff698a89f90]
call qword [sym.imp.user32.dll_UpdateWindow]
call fcn.7ff6989f7040
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x7ff6989f3ae0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
test rax, rax
je 0x7ff6989f7ac4
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x7ff6989f3b00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
test rax, rax
je 0x7ff6989f7aef
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x7ff698a89778], 0x12
je 0x7ff6989f7ce0
nop dword [rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x7ff698a89f90]
lea rcx, [0x7ff698a89770]
call qword [sym.imp.user32.dll_PeekMessageW]
test eax, eax
je 0x7ff6989f7b40
lea rcx, [0x7ff698a89770]
call qword [sym.imp.user32.dll_TranslateMessage]
lea rcx, [0x7ff698a89770]
call qword [sym.imp.user32.dll_DispatchMessageW]
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov rcx, qword [0x7ff698a897b0]
cmp rax, rcx
jne 0x7ff6989f7b8d
mov edx, 3
mov rcx, rax
call qword [sym.imp.user32.dll_GetWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [0x7ff698a89f90]
call qword [sym.imp.user32.dll_SetWindowPos]
mov rcx, qword [0x7ff698a897b0]
lea rdx, [rbp - 0x50]
call qword [sym.imp.user32.dll_GetClientRect]
lea rdx, [rsp + 0x60]
mov rcx, qword [0x7ff698a897b0]
call qword [sym.imp.user32.dll_ClientToScreen]
mov eax, dword [rsp + 0x60]
mov dword [rbp - 0x50], eax
mov eax, dword [rsp + 0x64]
mov dword [rbp - 0x4c], eax
call fcn.7ff6989a58b0
mov rdi, rax
mov rbx, qword [0x7ff698a897b0]
call fcn.7ff6989a59e0
mov qword [rax + 0x50], rbx
mov dword [rdi + 0x10], 0x3c888889
lea rcx, [rbp - 0x80]
call qword [sym.imp.user32.dll_GetCursorPos]
mov ecx, dword [rbp - 0x80]
sub ecx, dword [rsp + 0x60]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x118], xmm0
mov ecx, dword [rbp - 0x7c]
sub ecx, dword [rsp + 0x64]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x11c], xmm0
mov ecx, 1
call qword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
je 0x7ff6989f7c38
mov byte [rdi + 0x120], 1
mov byte [rdi + 0x410], 1
mov eax, dword [rdi + 0x11c]
mov dword [rdi + 0x3c0], eax
jmp 0x7ff6989f7c3f
mov byte [rdi + 0x120], 0
mov ecx, dword [rbp - 0x44]
mov edx, dword [rbp - 0x48]
mov eax, dword [0x7ff698a8a388]
cmp dword [rbp - 0x50], eax
jne 0x7ff6989f7c6b
cmp edx, dword [0x7ff698a8a390]
jne 0x7ff6989f7c6b
mov eax, dword [0x7ff698a8a38c]
cmp dword [rbp - 0x4c], eax
jne 0x7ff6989f7c6b
cmp ecx, dword [0x7ff698a8a394]
je 0x7ff6989f7cce
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [0x7ff698a8a388], xmm0
mov dword [0x7ff698a897d0], edx
mov dword [0x7ff698a897d4], ecx
mov dword [0x7ff698a89690], edx
mov dword [0x7ff698a89694], ecx
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov rcx, qword [0x7ff698a89f90]
call qword [sym.imp.user32.dll_SetWindowPos]
mov rcx, qword [0x7ff698a89f98]
mov rax, qword [rcx]
lea rdx, [0x7ff698a89690]
call qword [rax + 0x80]
call fcn.7ff6989f5400
cmp dword [0x7ff698a89778], 0x12
jne 0x7ff6989f7b00
call fcn.7ff6989cb5e0
call fcn.7ff6989cc5e0
xor ecx, ecx
call fcn.7ff69899b190
mov rcx, qword [0x7ff698a89f90]
call qword [sym.imp.user32.dll_DestroyWindow]
cmp qword [0x7ff698a897b0], 0
je 0x7ff6989f76a1
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x7ff6989f7dad
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6989f7da8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6989f7da8
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 2
call qword [sym.imp.ucrtbase.dll_exit]
int3
lea rdx, [0x7ff698a67550]
mov rcx, qword [sym.imp.msvcp140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.7ff6989e8140
lea rdx, [0x7ff6989e8d70]
mov rcx, rax
call qword [sym.imp.msvcp140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::basic_istream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_istream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x7ff698a675f8]
call qword [sym.imp.ucrtbase.dll_system]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rcx, [0x7ff698a67548]
call qword [sym.imp.ucrtbase.dll_system]
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
nop
call fcn.7ff698a5b9ac
xor eax, eax
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.7ff698a5be00
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret