Function at 0x45dc00
Capabilities:
Accept command line arguments
Create thread
Encode data using xor
Hide graphical window
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x128
mov eax, dword [0x509040]
xor eax, esp
mov dword [esp + 0x124], eax
push esi
push edi
mov cl, 0x50
mov dword [esp + 0xd0], 0x14111350
mov dword [esp + 0xd4], 0x62656760
xor eax, eax
mov dword [esp + 0xd8], 0x68166761
mov word [esp + 0xdc], 0x66
nop dword [eax + eax]
xor byte [esp + eax + 0xd1], cl
inc eax
cmp eax, 0xc
jae 0x45dc66
mov cl, byte [esp + 0xd0]
jmp 0x45dc50
lea ecx, [esp + 0x88]
mov byte [esp + 0xdd], 0
call fcn.004605e0
lea esi, [esp + 0xd1]
mov ecx, eax
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x45dc86
sub esi, edx
cmp dword [ecx + 0x14], 0xf
mov edx, dword [ecx + 0x10]
jbe 0x45dc9a
mov ecx, dword [ecx]
lea eax, [esp + 0xd1]
push esi
push eax
call fcn.0045c9a0
mov ecx, dword [esp + 0xa4]
add esp, 8
mov byte [esp + 0x17], al
cmp ecx, 0xf
jbe 0x45dcf1
mov edx, dword [esp + 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45dce3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45dce3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00487522
mov al, byte [esp + 0x1f]
add esp, 8
test al, al
je 0x45dcfc
mov byte [0x588847], 1
lea eax, [esp + 0xe4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0xe4], 1
mov dword [esp + 0x18], eax
jg 0x45dd2c
cmp byte [0x588847], 0
je 0x45e666
mov edx, dword [eax + 0xc]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45dd34
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub ecx, esi
push 0
push 0
push 0
push 0
sar ecx, 1
push ecx
push edx
push 0
push 0xfde9
mov dword [esp + 0x30], ecx
call edi
mov esi, eax
lea ecx, [esp + 0xe8]
push 0
push esi
call fcn.0045e7e0
cmp dword [esp + 0xfc], 0xf
lea ecx, [esp + 0xe8]
push 0
cmova ecx, dword [esp + 0xec]
push 0
push esi
mov esi, dword [esp + 0x24]
push ecx
push dword [esp + 0x20]
push dword [esi + 0xc]
push 0
push 0xfde9
call edi
cmp dword [esp + 0xfc], 0xf
lea eax, [esp + 0xe8]
push dword [esp + 0xf8]
cmova eax, dword [esp + 0xec]
mov ecx, 0x5879f4
push eax
call fcn.0045bdb0
mov eax, dword [esi + 4]
mov ecx, str.4mhhC5a1x4O3r1Qx2vtWWd7GW0xj1M1j5Od3xGlS1ql16n1f11ttG8sz227Mrb1w
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45ddf9
test dx, dx
je 0x45ddf5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45ddf9
add eax, 4
add ecx, 4
test dx, dx
jne 0x45ddd3
xor eax, eax
jmp 0x45ddfe
sbb eax, eax
or eax, 1
test eax, eax
je 0x45deda
mov eax, dword [esi + 8]
mov ecx, str.3OyO71f216blu522l11l18121vOq1YQ6d1w41f42a0sC5x10480h27n27f12C421
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45de36
test dx, dx
je 0x45de32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45de36
add eax, 4
add ecx, 4
test dx, dx
jne 0x45de10
xor eax, eax
jmp 0x45de3b
sbb eax, eax
or eax, 1
test eax, eax
je 0x45deda
cmp byte [0x588847], 0
je 0x45e666
movaps xmm0, xmmword [0x5003f0]
xor ecx, ecx
movups xmmword [esp + 0x20], xmm0
mov word [esp + 0x80], 0x13
movaps xmm0, xmmword [0x5000c0]
movups xmmword [esp + 0x30], xmm0
movaps xmm0, xmmword [0x4ff360]
movups xmmword [esp + 0x40], xmm0
movaps xmm0, xmmword [0x500010]
movups xmmword [esp + 0x50], xmm0
movaps xmm0, xmmword [0x500180]
movups xmmword [esp + 0x60], xmm0
movaps xmm0, xmmword [0x500210]
movups xmmword [esp + 0x70], xmm0
mov al, byte [esp + 0x20]
xor byte [esp + ecx + 0x21], al
inc ecx
cmp ecx, 0x60
jb 0x45dea4
lea edx, [esp + 0x21]
mov byte [esp + 0x81], 0
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x45dec1
sub edx, edi
lea eax, [esp + 0x21]
push edx
push eax
mov ecx, 0x5879f4
call fcn.0045bdb0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 0
push 0x45d6e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
mov dword [esp + 0xa4], 0x30
mov dword [esp + 0xa8], 0x40
mov dword [esp + 0xac], 0x45e720
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0xb4], eax
xorps xmm0, xmm0
lea eax, [esp + 0xa0]
mov dword [esp + 0xc8], str.VBR_Community_Loader___discord.gg_vbrc
push eax
movups xmmword [esp + 0xbc], xmm0
mov dword [esp + 0xd0], 0
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [esp + 0xb8]
push 0
push 0
push 5
push 5
push 0
push 0
push connect
push str.VBR_Community_Loader___discord.gg_vbrc
push dword [esp + 0xf0]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
push 0x20
mov dword [0x588840], esi
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov ecx, eax
mov dword [0x58883c], ecx
test ecx, ecx
je 0x45e674
push 0x588838
push 0x588800
push 0x40
xorps xmm0, xmm0
mov dword [0x588814], 0
push esi
push 1
movlpd qword [0x588800], xmm0
movlpd qword [0x58880c], xmm0
mov dword [0x58881c], 0
movlpd qword [0x58882c], xmm0
mov dword [0x588820], 1
mov dword [0x588818], 1
mov dword [0x588808], 0
mov dword [0x588824], 1
mov dword [0x588828], 0x50
mov dword [0x588834], 1
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x40]
test eax, eax
js 0x45e66e
push 0
push dword [0x588840]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x588840]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x5887f0]
test eax, eax
je 0x45e06c
inc dword [eax + 0x374]
push 0x3e70
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
test eax, eax
je 0x45e089
push 0
mov ecx, eax
call fcn.00401ed0
jmp 0x45e08b
xor eax, eax
cmp dword [0x5887f0], 0
jne 0x45e099
mov dword [0x5887f0], eax
mov ecx, eax
call fcn.004087f0
mov eax, dword [0x5887f0]
mov dword [esp + 0x1c], eax
or dword [eax + 8], 0x400
mov dword [eax + 0x20], 0
mov dword [eax + 0x15a4], 0
mov dword [eax + 0x1688], 0x3f800000
call fcn.00432dd0
mov ecx, dword [0x588838]
mov esi, dword [0x5887f0]
push ecx
mov dword [0x588ae4], ecx
or dword [esi + 0xc], 0x1008
mov dword [esi + 0xc8], str.imgui_impl_dx9
mov eax, dword [ecx]
call dword [eax + 4]
test dword [esi + 8], 0x400
je 0x45e139
mov eax, dword [0x5887f0]
mov dword [eax + 0x156c], 0x432b20
mov dword [eax + 0x1570], 0x432be0
mov dword [eax + 0x1574], 0x432c40
mov dword [eax + 0x1578], 0x432c90
mov dword [eax + 0x157c], 0x432db0
call fcn.0045cbf0
call fcn.0045cb60
xorps xmm0, xmm0
mov dword [esp + 0x118], 0
movaps xmmword [esp + 0x100], xmm0
movq qword [esp + 0x110], xmm0
push 1
push 0
push 0
push 0
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x45e19d
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x45e4c7
cmp dword [0x588adc], 0
jne 0x45e1ab
call fcn.004329c0
mov esi, dword [0x5887f0]
lea eax, [esp + 0x88]
push eax
push dword [0x588af8]
xorps xmm0, xmm0
mov dword [esp + 0x18], esi
movups xmmword [esp + 0x90], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x90]
sub eax, dword [esp + 0x88]
movd xmm1, eax
mov eax, dword [esp + 0x94]
sub eax, dword [esp + 0x8c]
cmp byte [0x587825], 0
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi + 0x10], xmm1
movss dword [esi + 0x14], xmm0
je 0x45e216
call fcn.00433960
lea eax, [esp + 0xd0]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0xd4], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0xd0]
mov ecx, edi
sub ecx, dword [0x588b00]
mov esi, dword [esp + 0xd4]
mov edx, esi
sbb edx, dword [0x588b04]
call fcn.004dbd60
mov edx, dword [0x588b0c]
mov ecx, dword [0x588b08]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x18], xmm0
call fcn.004dbd60
movss xmm1, dword [esp + 0x18]
cvtsd2ss xmm0, xmm0
mov eax, dword [esp + 0x10]
push 0x11
divss xmm1, xmm0
movss dword [eax + 0x18], xmm1
mov dword [0x588b00], edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x588b04], esi
call edi
mov esi, dword [esp + 0x10]
shr eax, 0xf
and al, 1
push 0x10
mov byte [esi + 0x100], al
call edi
shr eax, 0xf
and al, 1
push 0x12
mov byte [esi + 0x101], al
call edi
shr eax, 0xf
and al, 1
mov byte [esi + 0x103], 0
mov byte [esi + 0x102], al
call fcn.00433250
cmp byte [esi + 0xb7], 0
je 0x45e2e2
or eax, 0xffffffff
jmp 0x45e2ed
mov eax, dword [0x5887f0]
mov eax, dword [eax + 0x1f58]
cmp dword [0x5879d8], eax
je 0x45e2ff
mov dword [0x5879d8], eax
call fcn.00433120
call fcn.00433410
call fcn.00407640
cmp dword [0x588b20], 0
jne 0x45e329
mov ecx, dword [0x588838]
call fcn.0047fb30
mov dword [0x588b20], 1
jmp 0x45e33b
cmp byte [0x587c50], 0
je 0x45e666
call fcn.0045b0e0
call fcn.00409b50
mov eax, dword [0x588838]
push 0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push 0
push 3
push 0
push 0
push eax
call dword [ecx + 0xac]
mov eax, dword [0x588838]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x45e3a1
call fcn.00409fd0
mov eax, dword [0x5887f0]
xor ecx, ecx
mov eax, dword [eax + 0x1dd8]
mov eax, dword [eax]
sub eax, 0xffffff80
cmp byte [eax], cl
cmovne ecx, eax
call fcn.00432230
mov eax, dword [0x588838]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [esp + 0x1c]
test dword [eax + 8], 0x400
je 0x45e477
call fcn.00418860
mov esi, dword [0x5887f0]
mov edi, 1
mov eax, dword [esi + 0x158c]
lea ecx, [esi + 0x1594]
mov dword [esp + 0x10], ecx
cmp eax, edi
jle 0x45e421
mov eax, dword [ecx]
mov eax, dword [eax + edi*4]
mov dword [esp + 0x18], eax
test dword [eax + 4], 0x400
jne 0x45e414
mov ecx, dword [esi + 0x1554]
test ecx, ecx
je 0x45e3fe
push 0
push eax
call ecx
mov eax, dword [esp + 0x20]
add esp, 8
mov ecx, dword [esi + 0x1578]
test ecx, ecx
je 0x45e410
push 0
push eax
call ecx
add esp, 8
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x158c]
inc edi
cmp edi, eax
jl 0x45e3d6
jmp 0x45e425
mov dword [esp + 0x10], ecx
mov edi, 1
cmp eax, edi
jle 0x45e477
nop
mov eax, dword [ecx]
mov eax, dword [eax + edi*4]
mov dword [esp + 0x18], eax
test dword [eax + 4], 0x400
jne 0x45e46e
mov ecx, dword [esi + 0x1558]
test ecx, ecx
je 0x45e458
push 0
push eax
call ecx
mov eax, dword [esp + 0x20]
add esp, 8
mov ecx, dword [esi + 0x157c]
test ecx, ecx
je 0x45e46a
push 0
push eax
call ecx
add esp, 8
mov ecx, dword [esp + 0x10]
inc edi
cmp edi, dword [esi + 0x158c]
jl 0x45e430
mov ecx, dword [0x588838]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x44]
cmp eax, 0x88760868
jne 0x45e4be
mov eax, dword [0x588838]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x45e4be
call fcn.00432a20
mov eax, dword [0x588838]
push 0x588800
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
call fcn.004329c0
cmp byte [0x587c50], 0
je 0x45e4d7
cmp dword [esp + 0x104], 0x12
jne 0x45e162
jmp 0x45e4e2
mov dword [esp + 0x104], 0x12
call fcn.00418da0
call fcn.00432a20
mov ecx, dword [0x588ae4]
test ecx, ecx
je 0x45e506
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x588ae4], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
push eax
push str.ImGui_Platform
call edi
mov eax, dword [0x588aec]
test eax, eax
je 0x45e52c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [0x5887f0]
xorps xmm0, xmm0
mov ecx, esi
mov dword [0x588aec], 0
mov dword [0x588af0], 0
mov dword [0x588af4], 0
mov dword [0x588af8], 0
movlpd qword [0x588b00], xmm0
movlpd qword [0x588b08], xmm0
mov dword [0x5879d8], 9
mov byte [0x588a2d], 0
mov byte [0x587824], 1
call fcn.00408ab0
cmp dword [0x5887f0], esi
jne 0x45e59e
mov dword [0x5887f0], 0
test esi, esi
je 0x45e5c2
mov ecx, esi
call fcn.00421790
mov eax, dword [0x5887f0]
test eax, eax
je 0x45e5b8
dec dword [eax + 0x374]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [0x588838]
test ecx, ecx
je 0x45e5dc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x588838], 0
mov ecx, dword [0x58883c]
test ecx, ecx
je 0x45e5f6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x58883c], 0
push dword [0x588840]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esp + 0xb4]
push dword [esp + 0xcc]
call edi
mov ecx, dword [esp + 0xfc]
cmp ecx, 0xf
jbe 0x45e64e
mov edx, dword [esp + 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45e644
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45e6ea
push ecx
push edx
call fcn.00487522
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.004870f9
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [0x58883c]
mov edx, dword [0x588838]
test edx, edx
je 0x45e694
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [0x58883c]
mov dword [0x588838], 0
test ecx, ecx
je 0x45e6a8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x58883c], 0
push dword [esp + 0xb4]
push dword [esp + 0xcc]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov ecx, dword [esp + 0xfc]
cmp ecx, 0xf
jbe 0x45e6fa
mov edx, dword [esp + 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45e6f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45e6f0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00487522
add esp, 8
mov ecx, dword [esp + 0x12c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004870f9
mov esp, ebp
pop ebp
ret 0x10