Function at 0x1400016c0
Capabilities:
Check for foreground window switch
Execute command
Get session user name
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x90], rax
lea rcx, str.title_Logging_in_as__USERNAME_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mode_40__13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_______________Connecting.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140004850]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_______________Connecting...
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.timeout__t_1__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140004850]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.title_Logged_in_as__username_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mode_70_22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo__Product_t_t_t_t___Options
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo____x64_Clicker_3.07_t_t_____________1__Load
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_t____Build_14_02_24__t_t_____________2__Exit
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo__Status
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo____Connected
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo____Welcome_back___username_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo____Your_session_expires_in_3_minutes
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400049c4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002250
lea rdx, [rsp + 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x28]
cmp eax, 1
je 0x140001960
lea rdi, str._x64__fym_nigga__
cmp eax, 2
je 0x140001960
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0xf
mov rdx, qword [rdi + rax*8]
mov rcx, rbx
call fcn.140002250
lea rdx, [0x140002420]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400049c4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002250
lea rdx, [rsp + 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x28]
cmp eax, 1
jne 0x140001901
lea rcx, [0x140004850]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp dword [rsp + 0x28], 2
je 0x140002149
mov dword [rsp + 0x2c], 0x100
lea rdx, [rsp + 0x2c]
lea rcx, [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1400019db
lea rdx, str.failed_to_get_username__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002250
mov eax, 1
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140002ae0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rsp + 0x68]
call fcn.140001550
nop
mov r14, qword [rsp + 0x78]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, r14
cmp rax, 6
jb 0x1400021e1
lea r15, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova r15, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rsi, [r14 + 6]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x140001ac7
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x140001a82
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002be4
test rax, rax
je 0x140001aaa
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001ac2
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001ab1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400021e7
jmp 0x140001a67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001ac0
call fcn.140002be4
mov rdi, rax
jmp 0x140001ac2
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov eax, dword [str.title]
mov dword [rdi], eax
movzx eax, word [0x140004a40]
mov word [rdi + 4], ax
lea rcx, [rdi + 6]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._t_t_t_____________________________________n
call fcn.140001070
lea rcx, str._t_t_t________________________________.__n
call fcn.140001070
lea rcx, str._t_t_t____________________.____________:__n
call fcn.140001070
lea rcx, str._t_t_t__________________________.__:___n
call fcn.140001070
lea rcx, str._t_t_t__________________________:_______n
call fcn.140001070
lea rcx, str._t_t_t_.___.___.____________:_____n
call fcn.140001070
lea rcx, str._t_t_t____________________:___:_.____n
call fcn.140001070
lea rcx, str._t_t_t____._______:_____________:__n
call fcn.140001070
lea rcx, str._t_t_t____________________._____..___n
call fcn.140001070
lea rcx, str._t_t_t________________________:_____n
call fcn.140001070
lea rcx, str._t_t_t._______________._____________n
call fcn.140001070
lea rcx, str._t_t_t___:________:_____:_______:____n
call fcn.140001070
lea rcx, str._t_t_t_________________________________n
call fcn.140001070
lea rcx, str._t_t_t___________________________________n
call fcn.140001070
lea rcx, str.
call fcn.140001070
lea rcx, [0x140004d10]
call fcn.140001070
lea rdx, str.hi_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002250
mov rcx, rax
lea rdx, [rbp - 0x70]
call fcn.140002250
mov rcx, rax
lea rdx, [0x140004d14]
call fcn.140002250
lea rcx, str.echo__hostname:__COMPUTERNAME_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.e_1_34m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002250
mov rcx, rax
lea rdx, str.__hint:_either_an_integer_or_a_float_number__n
call fcn.140002250
mov rcx, rax
lea rdx, str.e_0m
call fcn.140002250
lea rcx, str.chcp_65001___NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.set_LANG__hu_HU.UTF___8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._static_clicks_second_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002250
lea rdx, [0x140007750]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov r13d, 4
movabs rsi, 0xb2f4fc0794908cf3
movabs r14, 0x4e94914f0000
movabs r15, 0x431bde82d7b634db
nop dword [rax]
movabs rbx, 0x7ffffffff1194d7f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001f36
cmp byte [0x1400070b4], 0
jne 0x140001cba
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor r9d, r9d
mov edx, 0x201
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageA]
lea rcx, [0x140007760]
call fcn.140002930
mov ecx, eax
imul rax, rcx, 0x65
cmp eax, 0x43
ja 0x140001d27
nop dword [rax]
lea rcx, [0x140007760]
call fcn.140002930
mov ecx, eax
imul rax, rcx, 0x65
cmp eax, 0x44
jb 0x140001d10
shr rax, 0x20
add eax, 0x1c2
cdq
idiv dword [0x140007750]
movsxd rdi, eax
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
add rbx, r13
mov eax, dword [rbx]
cmp dword [0x140008ae8], eax
jle 0x140001d7b
lea rcx, [0x140008ae8]
call fcn.140002b6c
cmp dword [0x140008ae8], 0xffffffff
jne 0x140001d7b
mov byte [0x140008aec], 0
lea rcx, [0x140008ae8]
call fcn.140002b00
mov eax, dword [rbx]
cmp dword [0x140008af8], eax
jle 0x140001de3
lea rcx, [0x140008af8]
call fcn.140002b6c
cmp dword [0x140008af8], 0xffffffff
jne 0x140001de3
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140007758], rax
lea rcx, str._clicker_is_currently_paused__press_F8_to_resume_n
call fcn.140001070
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008af8]
call fcn.140002b00
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
imul rax, rdi, 0xffffffffffffd8f0
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [0x140007758]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
cmp byte [0x1400070b4], 0
jne 0x140001cb0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor r9d, r9d
mov edx, 0x202
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageA]
lea rcx, [0x140007760]
call fcn.140002930
mov ecx, eax
imul rax, rcx, 0x65
cmp eax, 0x43
ja 0x140001e68
lea rcx, [0x140007760]
call fcn.140002930
mov ecx, eax
imul rax, rcx, 0x65
cmp eax, 0x44
jb 0x140001e51
shr rax, 0x20
add eax, 0x1c2
cdq
idiv dword [0x140007750]
movsxd rdi, eax
mov eax, dword [rbx]
cmp dword [0x140008ae8], eax
jle 0x140001ead
lea rcx, [0x140008ae8]
call fcn.140002b6c
cmp dword [0x140008ae8], 0xffffffff
jne 0x140001ead
mov byte [0x140008aec], 0
lea rcx, [0x140008ae8]
call fcn.140002b00
mov eax, dword [rbx]
cmp dword [0x140008af8], eax
jle 0x140001f15
lea rcx, [0x140008af8]
call fcn.140002b6c
cmp dword [0x140008af8], 0xffffffff
jne 0x140001f15
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140007758], rax
lea rcx, str._clicker_is_currently_paused__press_F8_to_resume_n
call fcn.140001070
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008af8]
call fcn.140002b00
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
imul rax, rdi, 0xffffffffffffd8f0
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
jmp 0x140002131
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000206e
cmp byte [0x1400070b4], 0
sete byte [0x1400070b4]
call fcn.140001370
lea rcx, [rsp + 0x20]
call fcn.140001290
mov rax, qword [rsp + 0x20]
cmp rax, rbx
lea rdi, [rax + 0xee6b280]
jl 0x140001f80
mov rdi, r12
nop dword [rax + rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140001fa1
imul rax, rcx, 0x64
jmp 0x140002012
cmp rbx, 0x16e3600
jne 0x140001ff4
mov rax, rsi
imul rcx
lea r9, [rcx + rdx]
sar r9, 0x18
mov rax, r9
shr rax, 0x3f
add r9, rax
imul rax, r9, 0x16e3600
sub rcx, rax
imul r8, rcx, 0x3b9aca00
mov rax, rsi
imul r8
lea rax, [r8 + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r9, 0x3b9aca00
jmp 0x14000200f
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
movabs rbx, 0x7ffffffff1194d7f
jge 0x140001cba
mov rcx, rdi
sub rcx, rax
cmp rcx, r14
jl 0x14000203f
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140001f80
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140002062
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140001f80
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov eax, dword [rbx + r13]
cmp dword [0x140008ae8], eax
jle 0x1400020ae
lea rcx, [0x140008ae8]
call fcn.140002b6c
cmp dword [0x140008ae8], 0xffffffff
jne 0x1400020ae
mov byte [0x140008aec], 0
lea rcx, [0x140008ae8]
call fcn.140002b00
mov eax, dword [rbx + r13]
cmp dword [0x140008af8], eax
jle 0x140002118
lea rcx, [0x140008af8]
call fcn.140002b6c
cmp dword [0x140008af8], 0xffffffff
jne 0x140002118
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140007758], rax
lea rcx, str._clicker_is_currently_paused__press_F8_to_resume_n
call fcn.140001070
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140008af8]
call fcn.140002b00
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov qword [rsp + 0x60], 0xfffffffffffe7960
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [0x140007758]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
jmp 0x140001cb0
lea rcx, [0x140004850]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.title_See_ya_later
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.mode_50__15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_________Closing_application_at__DATE_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.timeout__t_1__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140001270
int3
call fcn.1400011d0
int3