Function at 0x14004b360
Capabilities:
Create thread
Enumerate process modules
Inject thread
Log keystrokes via polling

Disassembly:
sub rsp, 0x288
mov rax, qword [0x140101020]
xor rax, rsp
mov qword [rsp + 0x278], rax
call fcn.14004b1b0
call fcn.14004beb0
mov dword [0x140103c90], eax
cmp eax, 1
jae 0x14004b39b
call fcn.14004b190
xor ecx, ecx
call fcn.140053ab0
int3
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
mov qword [rsp + 0x280], r14
xor r14d, r14d
cmp eax, 1
jbe 0x14004b4c0
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [0x140103c90]
lea ecx, [r14 + 0x18]
mov qword [0x140103ca0], rax
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004b44e
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x14004b44e
nop dword [rax]
lea rdx, str.BlackOps3.exe
lea rcx, [rsp + 0x60]
call fcn.14005e320
test eax, eax
je 0x14004b449
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x14004b420
jmp 0x14004b44e
mov rbx, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbx + 0xa549de0]
mov qword [0x140103cb0], rbx
mov qword [0x140103ce8], rax
lea rax, [rbx + 0xa549de8]
mov qword [0x140103cc0], rax
lea rax, [rbx + 0x30789c4]
mov qword [0x140103ce0], rax
lea rax, [rbx + 0x11bd903]
mov qword [0x140103cd8], rax
lea rax, [rbx + 0x19c780bc]
mov qword [0x140103da0], rax
lea rax, [rbx + 0xa549e48]
mov qword [0x140103cc8], rax
lea rax, [rbx + 0xa3d3a2c]
mov qword [0x140103cd0], rax
mov qword [rsp + 0x28], r14
lea r8, [0x140041460]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [0x140103da0]
lea r8, [0x140103da8]
mov rcx, qword [0x140103ca0]
mov r9d, 4
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [0x140103da8], 1
jge 0x14004b57a
mov eax, dword [0x140103ca8]
test eax, eax
jne 0x14004b548
call fcn.140001e00
call fcn.140002430
mov rcx, qword [0x140103cb0]
lea rax, [rcx + 0xa549e48]
mov qword [0x140103cc8], rax
lea rax, [rcx + 0xa3d3a2c]
mov qword [0x140103cd0], rax
jmp 0x14004b557
cmp eax, 1
jne 0x14004b561
call fcn.140001e00
call fcn.140002430
mov dword [0x140103ca8], 2
cmp byte [0x140103d70], r14b
je 0x14004b60b
mov byte [0x140103d70], r14b
jmp 0x14004b60b
mov rdx, qword [0x140103da0]
lea r8, [0x140103da8]
mov rcx, qword [0x140103ca0]
mov r9d, 4
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [0x140103da8], r14d
jle 0x14004b60b
mov eax, dword [0x140103ca8]
test eax, eax
jne 0x14004b5e2
call fcn.140001e00
call fcn.140002430
mov rcx, qword [0x140103cb0]
lea rax, [rcx + 0xa549e48]
mov qword [0x140103cc8], rax
lea rax, [rcx + 0xa3d3a2c]
mov qword [0x140103cd0], rax
jmp 0x14004b5f1
cmp eax, 2
jne 0x14004b5fb
call fcn.140001e00
call fcn.140002430
mov dword [0x140103ca8], 1
cmp byte [0x140103d70], r14b
jne 0x14004b60b
mov byte [0x140103d70], 1
call fcn.1400034d0
movzx eax, byte [0x140103d70]
test al, al
je 0x14004b6f1
cmp byte [0x140103cad], r14b
je 0x14004b642
lea r8, [0x140101c4b]
mov edx, 1
call fcn.140002520
cmp byte [0x140103cad], r14b
jne 0x14004b653
lea r8, [0x140103d83]
mov edx, 1
call fcn.140002520
cmp byte [0x140103d99], r14b
je 0x14004b666
mov edx, 1
call fcn.140002b00
cmp byte [0x140103d97], r14b
je 0x14004b679
mov edx, 1
call fcn.140002bd0
cmp byte [0x140103cae], r14b
je 0x14004b693
mov edx, 1
call fcn.140002ca0
mov byte [0x140103cae], r14b
cmp byte [0x140103d61], r14b
je 0x14004b6a6
mov edx, 1
call fcn.140002ca0
cmp byte [0x140103d93], r14b
je 0x14004b6c0
mov edx, 1
call fcn.140002f30
mov byte [0x140103d93], r14b
cmp byte [0x140103d82], r14b
je 0x14004b6d3
mov edx, 1
call fcn.140003100
cmp byte [0x140103cac], r14b
je 0x14004b6e6
mov edx, 1
call fcn.140003310
movzx eax, byte [0x140103d70]
test al, al
jne 0x14004b71a
cmp byte [0x140103cad], r14b
je 0x14004b712
lea r8, [0x140103d83]
mov edx, 1
call fcn.140002520
movzx eax, byte [0x140103d70]
test al, al
je 0x14004b7ec
cmp byte [0x140103d95], r14b
je 0x14004b73d
lea r8, [0x140101c4b]
mov edx, 2
call fcn.140002520
cmp byte [0x140103d95], r14b
jne 0x14004b74e
lea r8, [0x140103d83]
mov edx, 2
call fcn.140002520
cmp byte [0x140103d94], r14b
je 0x14004b761
mov edx, 2
call fcn.140002b00
cmp byte [0x140103d84], r14b
je 0x14004b774
mov edx, 2
call fcn.140002bd0
cmp byte [0x140103d62], r14b
je 0x14004b78e
mov edx, 2
call fcn.140002ca0
mov byte [0x140103d62], r14b
cmp byte [0x140103d9a], r14b
je 0x14004b7a1
mov edx, 2
call fcn.140002ca0
cmp byte [0x140103d90], r14b
je 0x14004b7bb
mov edx, 2
call fcn.140002f30
mov byte [0x140103d90], r14b
cmp byte [0x140103d81], r14b
je 0x14004b7ce
mov edx, 2
call fcn.140003100
cmp byte [0x140103d64], r14b
je 0x14004b7e1
mov edx, 2
call fcn.140003310
movzx eax, byte [0x140103d70]
test al, al
jne 0x14004b815
cmp byte [0x140103d95], r14b
je 0x14004b80d
lea r8, [0x140103d83]
mov edx, 2
call fcn.140002520
movzx eax, byte [0x140103d70]
test al, al
je 0x14004b8e7
cmp byte [0x140103d73], r14b
je 0x14004b838
lea r8, [0x140101c4b]
mov edx, 3
call fcn.140002520
cmp byte [0x140103d73], r14b
jne 0x14004b849
lea r8, [0x140103d83]
mov edx, 3
call fcn.140002520
cmp byte [0x140103d65], r14b
je 0x14004b85c
mov edx, 3
call fcn.140002b00
cmp byte [0x140103d86], r14b
je 0x14004b86f
mov edx, 3
call fcn.140002bd0
cmp byte [0x140103d60], r14b
je 0x14004b889
mov edx, 3
call fcn.140002ca0
mov byte [0x140103d60], r14b
cmp byte [0x140103d9c], r14b
je 0x14004b89c
mov edx, 3
call fcn.140002ca0
cmp byte [0x140103c5e], r14b
je 0x14004b8b6
mov edx, 3
call fcn.140002f30
mov byte [0x140103c5e], r14b
cmp byte [0x140103d87], r14b
je 0x14004b8c9
mov edx, 3
call fcn.140003100
cmp byte [0x140103caf], r14b
je 0x14004b8dc
mov edx, 3
call fcn.140003310
movzx eax, byte [0x140103d70]
test al, al
jne 0x14004b910
cmp byte [0x140103d73], r14b
je 0x14004b908
lea r8, [0x140103d83]
mov edx, 3
call fcn.140002520
movzx eax, byte [0x140103d70]
test al, al
je 0x14004ba19
cmp byte [0x140103d80], r14b
je 0x14004b9ea
mov ecx, dword [0x140103c94]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14004b953
mov rdx, qword [0x140103c28]
lea r8, [0x140105528]
mov rcx, qword [0x140103ca0]
mov r9d, 0xc
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rsi, r14
mov ebp, 0x50
nop dword [rax + rax]
mov rbx, qword [0x140103c40]
lea rax, [rsp + 0x270]
mov rdi, qword [0x140103ca0]
mov r9d, 4
add rbx, rsi
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
lea r8d, [r9 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r9d, 0xc
mov qword [rsp + 0x20], r14
lea r8, [0x140105528]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rsp + 0x270]
lea rax, [rsp + 0x270]
mov r8d, 0xc
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add rsi, 0x4f8
sub rbp, 1
jne 0x14004b960
cmp byte [0x140103d96], r14b
je 0x14004ba19
mov rdx, qword [0x140103cd0]
lea r8, [0x140103cfc]
mov rcx, qword [0x140103ca0]
mov r9d, 4
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.14004beb0
cmp eax, 1
jb 0x14004bc07
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x14004ba43
cmp byte [0x140103c5f], r14b
je 0x14004bb82
mov edx, dword [0x140103d54]
lea r8, [0x140103d83]
mov byte [0x140103d98], r14b
call fcn.140002520
lea rdx, [0x140103d83]
mov byte [0x140103d66], r14b
mov byte [0x140103d72], r14b
mov byte [0x140103d71], r14b
mov byte [0x140103d9b], r14b
mov byte [0x140103d9d], r14b
call fcn.1400031b0
lea r8, [0x140103d83]
mov byte [0x140103d63], r14b
mov edx, 1
mov byte [0x140103c5d], r14b
mov byte [0x140103d80], r14b
mov byte [0x140103d85], r14b
mov byte [0x140103cad], r14b
call fcn.140002520
lea r8, [0x140103d83]
mov byte [0x140103d99], r14b
mov edx, 2
mov byte [0x140103d97], r14b
mov byte [0x140103d61], r14b
mov byte [0x140103d82], r14b
mov byte [0x140103cac], r14b
mov byte [0x140103d95], r14b
call fcn.140002520
lea r8, [0x140103d83]
mov byte [0x140103d94], r14b
mov edx, 3
mov byte [0x140103d84], r14b
mov byte [0x140103d9a], r14b
mov byte [0x140103d81], r14b
mov byte [0x140103d64], r14b
mov byte [0x140103d73], r14b
call fcn.140002520
mov byte [0x140103d65], r14b
mov byte [0x140103d86], r14b
mov byte [0x140103d9c], r14b
mov byte [0x140103d87], r14b
mov byte [0x140103caf], r14b
mov byte [0x140103c5a], r14b
mov byte [0x140101c48], r14b
mov byte [0x140103c5b], r14b
mov byte [0x140101c40], r14b
mov byte [0x140103c59], r14b
mov byte [0x140103d96], r14b
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14004bba2
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004b4e0
mov edx, dword [0x140103d54]
lea r8, [0x140103d83]
call fcn.140002520
lea rdx, [0x140103d83]
call fcn.1400031b0
lea rdx, [0x140103d83]
call fcn.140002e50
lea r8, [0x140103d83]
mov edx, 1
call fcn.140002520
lea r8, [0x140103d83]
mov edx, 2
call fcn.140002520
lea r8, [0x140103d83]
mov edx, 3
call fcn.140002520
xor ecx, ecx
call fcn.140053ab0
int3
xor ecx, ecx
call fcn.140053ab0
int3