Function at 0x140042c80
Capabilities:
Create process on windows
Execute command
Hide graphical window
Log keystrokes via polling
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x138]
sub rsp, 0x1f8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
movaps xmmword [rax - 0x98], xmm10
movaps xmmword [rax - 0xa8], xmm11
movaps xmmword [rax - 0xb8], xmm12
movaps xmmword [rax - 0xc8], xmm13
movaps xmmword [rax - 0xd8], xmm14
movaps xmmword [rax - 0xe8], xmm15
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x1400ba760]
call fcn.140002c50
cmp byte [0x1400ba920], 0
jne 0x140042d5c
lea r8, [0x1400ba928]
lea rdx, str._n_Status:
lea rcx, [rbp - 0x80]
call fcn.140005250
nop
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140041ce0
nop
lea rcx, [rbp - 0x80]
call fcn.140004550
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rbp - 0x60], 0x50
mov dword [rbp - 0x5c], 0x40
lea rax, [0x140042a90]
mov qword [rbp - 0x58], rax
xor r15d, r15d
mov qword [rbp - 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
lea rbx, [0x14009ec20]
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], r15
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov r11d, dword [0x1400ba1d4]
mov eax, r11d
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [rbp - 4]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
sub r10d, ecx
mov r9d, dword [0x1400ba1d0]
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [rbp - 8]
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
mov qword [rsp + 0x58], r15
mov rcx, qword [rbp - 0x48]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
mov r8, rbx
mov rdx, qword [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r14, rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call sub.d3d9.dll_Direct3DCreate9
mov rcx, rax
mov qword [0x1400ba758], rax
lea r8, [0x1400ba9b0]
test rax, rax
jne 0x140042e7f
mov edx, 0x80004005
jmp 0x140042f25
mov qword [0x1400ba9b0], r15
mov qword [0x1400ba9bc], r15
mov dword [0x1400ba9c4], r15d
mov qword [0x1400ba9cc], r15
mov dword [0x1400ba9d4], r15d
mov qword [0x1400ba9e4], r15
mov dword [0x1400ba9d8], 1
mov dword [0x1400ba9c8], 1
mov dword [0x1400ba9b8], r15d
mov dword [0x1400ba9dc], 1
mov dword [0x1400ba9e0], 0x50
mov dword [0x1400ba9ec], 0x80000000
mov rax, qword [rax]
lea rdx, [0x1400ba9a8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x40
mov r9, r14
xor edx, edx
mov r8d, 1
call qword [rax + 0x80]
mov ecx, r15d
mov edx, 0x80004005
test eax, eax
cmovs ecx, edx
mov edx, ecx
mov rcx, qword [0x1400ba758]
cmp edx, dword [0x1400ba754]
jge 0x140042f7a
mov rdx, qword [0x1400ba9a8]
test rdx, rdx
je 0x140042f50
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1400ba9a8], r15
mov rcx, qword [0x1400ba758]
test rcx, rcx
je 0x140042f62
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov qword [0x1400ba758], r15
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
jmp 0x1400435fc
mov edx, 0xa
mov rcx, r14
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r14
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], reloc.WS2_32.dll_sendto
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, 0x1560
mov r9d, 8
mov r8d, 0x3b8
lea rcx, str.1.78_WIP
call fcn.140017a90
xor ecx, ecx
call fcn.1400175f0
call fcn.14001a380
mov rbx, rax
mov rcx, qword [rax + 0xa0]
call fcn.14002c870
mov qword [rsp + 0x20], rax
xor r9d, r9d
movss xmm8, dword [0x1400986c8]
movaps xmm2, xmm8
lea rdx, str..SegoeUI.ttf
mov rcx, qword [rbx + 0xa0]
call fcn.140029b30
mov qword [0x1400ba9f0], rax
mov rcx, r14
call fcn.1400411f0
mov rcx, qword [0x1400ba9a8]
call fcn.140040550
call fcn.14001a930
mov dword [rax + 0x40], 0x40400000
mov dword [rax + 0x1c], 0x3e99999a
mov dword [rax + 0x20], 0x3e99999a
mov dword [rax + 0xc], r15d
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov sil, 1
movabs rdi, 0x7ffffffffeced2ff
movabs rbx, 0x7fffffffffffffff
movabs r13, 0xb2f4fc0794908cf3
movdqa xmm11, xmmword [0x14009ecf0]
movdqa xmm15, xmmword [0x14009ed00]
movdqa xmm14, xmmword [0x14009ecd0]
movdqa xmm13, xmmword [0x14009ece0]
movdqa xmm12, xmmword [0x14009d960]
movss xmm10, dword [0x140098564]
movss xmm9, dword [0x14009858c]
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400430f7
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400435c3
lea rcx, [rsp + 0x78]
call fcn.140042ba0
mov rax, qword [rsp + 0x78]
cmp rax, rdi
lea rdi, [rax + 0x1312d00]
jl 0x140043115
mov rdi, rbx
movabs r15, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
nop dword [rax]
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
mov rcx, rax
cmp rbx, 0x989680
jne 0x14004314f
imul rax, rcx, 0x64
jmp 0x1400431c0
cmp rbx, 0x16e3600
jne 0x1400431a2
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r13
imul rcx
lea rax, [rcx + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r8, 0x3b9aca00
jmp 0x1400431bd
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jge 0x14004320e
mov rcx, rdi
sub rcx, rax
cmp rcx, r15
jl 0x1400431df
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140043130
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140043202
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140043130
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
mov r15d, 0
lea r12, [0x1400ba6f0]
je 0x140043231
test sil, sil
sete sil
test sil, sil
je 0x1400435af
call fcn.140040610
call fcn.140041300
call fcn.140020510
movd xmm0, dword [0x1400ba1d0]
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x140], xmm0
movd xmm1, dword [0x1400ba1d4]
cvtdq2ps xmm1, xmm1
movss dword [rbp + 0x144], xmm1
mov edx, 2
lea rcx, [rbp + 0x140]
call fcn.1400248f0
mov qword [rbp + 0x148], r15
mov qword [rbp + 0x150], r15
lea r8, [rbp + 0x148]
mov edx, 2
lea rcx, [rbp + 0x150]
call fcn.140024860
mov r8d, Ordinal_41
lea rdx, reloc.WS2_32.dll_accept
lea rcx, str.Speed_Loader
call fcn.140013970
call fcn.14001a930
add rax, 0xb8
movups xmmword [rax], xmm12
movups xmmword [rax + 0x20], xmm13
movups xmmword [rax + 0x50], xmm14
movups xmmword [rax + 0xa0], xmm15
movups xmmword [rax + 0xb0], xmm11
movdqa xmm0, xmmword [0x14009ed10]
movups xmmword [rax + 0x150], xmm0
movdqa xmm0, xmmword [0x14009ed20]
movups xmmword [rax + 0x160], xmm0
movups xmmword [rax + 0x170], xmm11
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8d, 0x64
mov rdx, r12
lea rcx, str.Enter_Key
call fcn.14003a080
mov qword [rbp + 0x158], r15
lea rdx, [rbp + 0x158]
lea rcx, str.Login_With_License
call fcn.140038ed0
test al, al
je 0x14004339b
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r12 + r8], r15b
jne 0x140043364
mov rdx, r12
lea rcx, [rbp - 0x80]
call fcn.140041d00
lea rdx, [rbp - 0x80]
lea rcx, [0x1400ba760]
call fcn.140003750
cmp byte [0x1400ba920], r15b
je 0x14004339b
mov byte [0x1400ba9f8], 1
jmp 0x1400433a8
cmp byte [0x1400ba9f8], r15b
je 0x1400434ce
call fcn.14003e4c0
call fcn.14003e4c0
call fcn.14003e4c0
call fcn.14003e4c0
call fcn.14003e4c0
call fcn.14003e4c0
call fcn.14003e4c0
call fcn.14003e4c0
call fcn.14003e4c0
call fcn.14003e4c0
call fcn.14003e4c0
lea rcx, [rbp + 0x38]
call fcn.14001a0e0
movss xmm7, dword [rax]
subss xmm7, xmm8
lea rcx, [rbp + 0x40]
call fcn.14001a9e0
movss xmm6, dword [rax]
subss xmm6, xmm7
mulss xmm6, xmm10
movaps xmm0, xmm6
call fcn.1400245e0
movss dword [rsp + 0x60], xmm7
mov dword [rsp + 0x64], r15d
lea rdx, [rsp + 0x60]
lea rcx, str.Spoof__TPM2.0_Vanguard
call fcn.140038ed0
test al, al
je 0x14004345c
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str.Protections.exe
lea rdx, [0x14009ebb8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [0x1400ba9f8], r15b
call fcn.14003e4c0
movaps xmm0, xmm6
call fcn.1400245e0
movss dword [rsp + 0x68], xmm7
mov dword [rsp + 0x6c], r15d
lea rdx, [rsp + 0x68]
lea rcx, str.TEMP_SPOOF_BE_EAC
call fcn.140038ed0
test al, al
je 0x14004349d
lea rcx, str.start_cmd__k_echo_You_Have_Been_Temp_Spoofed__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [0x1400ba9f8], r15b
call fcn.14003e4c0
movaps xmm0, xmm6
call fcn.1400245e0
movss dword [rsp + 0x70], xmm7
mov dword [rsp + 0x74], r15d
lea rdx, [rsp + 0x70]
lea rcx, str.Exit
call fcn.140038ed0
test al, al
jne 0x14004364f
call fcn.140017c60
mov rcx, qword [0x1400ba9a8]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r15d
movss dword [rsp + 0x28], xmm9
mov dword [rsp + 0x20], r15d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x1400ba9a8]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140043535
call fcn.140021b90
call fcn.14001a170
mov rcx, rax
call fcn.140040790
mov rcx, qword [0x1400ba9a8]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x1400ba9a8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x1400435af
mov rcx, qword [0x1400ba9a8]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x1400435af
call fcn.140040590
mov rcx, qword [0x1400ba9a8]
mov rax, qword [rcx]
lea rdx, [0x1400ba9b0]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x1400435aa
mov r8d, reloc.WLDAP32.dll_Ordinal_45
lea rdx, str.C:UserselilaDownloadsKeyAuth_IMGUI_LoginExample_masterKeyAuth_IMGUI_LoginExample_mastermain.h
lea rcx, [0x1400955d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.1400403e0
movabs rdi, 0x7ffffffffeced2ff
movabs rbx, 0x7fffffffffffffff
cmp dword [rbp + 8], 0x12
jne 0x1400430c0
call fcn.140041140
call fcn.140041500
xor ecx, ecx
call fcn.140017bf0
call fcn.1400429e0
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor eax, eax
lea r11, [rsp + 0x1f8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [r11 - 0x88]
movaps xmm14, xmmword [r11 - 0x98]
movaps xmm15, xmmword [r11 - 0xa8]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140042a30
int3