Function at 0x140003900
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
sub rsp, 0x30
call fcn.140002580
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
jne 0x14000394f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.__________________________________
call fcn.140005f60
mov rcx, rax
lea rdx, [0x140006310]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x48], rbx
mov ecx, 0x258
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140005f60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._e_37m_Settings_Togglekey_e_32mON_e_37m_:
call fcn.140005f60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x40]
call fcn.1400064c0
movsx ebx, byte [rsp + 0x40]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov ecx, ebx
mov r14d, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov r15d, eax
xor dil, dil
xor bl, bl
call fcn.140005f60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.____Key_Set_:_e_32m
call fcn.140005f60
mov rcx, rax
movzx edx, r14b
call fcn.140006140
mov rcx, rax
lea rdx, [0x140006310]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._e_37m___e_32mSuccessfully_e_37mHide_Program_in_4_seconds_n
call fcn.140005f60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._e_37m___e_31mEND_e_37m__e_37m_to_exit_last_n
call fcn.140005f60
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0xfa0
call fcn.140006350
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
nop word [rax + rax]
mov ecx, r14d
movzx esi, dil
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140003a87
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140003a87
xor bl, bl
jmp 0x140003b36
test bl, bl
jne 0x140003b36
test dil, dil
sete dil
test sil, sil
jne 0x140003ad9
mov edx, Ordinal_301
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, [0x140087108]
mov rcx, rbp
call fcn.140003840
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Values_changed.
jmp 0x140003b18
mov edx, reloc.WLDAP32.dll_Ordinal_50
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, [0x140087128]
mov rcx, rbp
call fcn.140003840
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Values_reverted.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005f60
lea rdx, [0x140006310]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov bl, 1
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140003b56
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003a60
mov edx, 0x3e8
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rdx, [0x140087128]
mov rcx, rbp
call fcn.140003840
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
int3