Function at 0x14004dee0
Capabilities:
Enumerate gui resources
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x14004e304
mov ecx, 0x61
vmovaps xmmword [rsp + 0x30], xmm6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004df29
cmp byte [0x14006bcce], 0
sete byte [0x14006bcce]
mov ecx, 0x62
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004df49
cmp byte [0x14006bccc], 0
sete byte [0x14006bccc]
mov ecx, 0x63
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004df69
cmp byte [0x14006bccd], 0
sete byte [0x14006bccd]
mov ecx, 0x64
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004df89
cmp byte [0x140fb3f08], 0
sete byte [0x140fb3f08]
mov ecx, 0x65
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004e038
cmp byte [0x1401a3ed2], 0
mov eax, dword [str.S_A3s_vnP__P_]
sete byte [0x1401a3ed2]
mov dword [rbp + 0x10], eax
cmp byte [0x140061d5f], 0
je 0x14004e02f
vmovdqu xmm5, xmmword [0x140061ed0]
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmmword [0x140062020]
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmmword [0x140062020]
vshufps xmm4, xmm3, xmm2, 0xdd
mov ecx, 4
vmovd xmm0, ecx
vpsrad xmm2, xmm4, xmm0
mov ecx, 0x1f
vmovd xmm0, ecx
vpsrld xmm1, xmm2, xmm0
vpaddd xmm2, xmm1, xmm2
vpmulld xmm3, xmm2, xmmword [0x140061f20]
vpsubd xmm4, xmm5, xmm3
vpshufb xmm2, xmm4, xmmword [0x140061e90]
vpaddb xmm3, xmm2, xmmword [0x140061fe0]
vmovd xmm0, eax
vpxor xmm1, xmm3, xmm0
vmovd dword [rbp + 0x10], xmm1
lea rcx, [rbp + 0x10]
call fcn.140015634
mov ecx, 0x66
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004e058
cmp byte [0x1401a3ed1], 0
sete byte [0x1401a3ed1]
mov ecx, 0x68
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x67
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004e104
mov eax, dword [0x14006bce8]
inc eax
mov dword [0x14006bce8], eax
cmp eax, 3
jne 0x14004e098
mov dword [0x14006bce8], 0
jmp 0x14004e09c
test eax, eax
jne 0x14004e0b6
vmovss xmm0, dword [0x140fb3f00]
vmulss xmm1, xmm0, dword [0x140061df8]
vmovss dword [0x14006bcbc], xmm1
jmp 0x14004e104
cmp eax, 1
jne 0x14004e0d5
vmovss xmm0, dword [0x140fb3f00]
vmulss xmm1, xmm0, dword [0x140061e00]
vmovss dword [0x14006bcbc], xmm1
jmp 0x14004e104
vmovss xmm2, dword [0x140fb3f00]
vmovd xmm0, eax
mov ecx, 2
vmovd xmm1, ecx
vpcmpeqd xmm3, xmm0, xmm1
vmovss xmm1, dword [0x14006bcbc]
vblendvps xmm0, xmm1, xmm2, xmm3
vmovss dword [0x14006bcbc], xmm0
mov ecx, 0x6f
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004e124
cmp byte [0x1401a3ed3], 0
sete byte [0x1401a3ed3]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
vmovss xmm6, dword [0x140061e48]
jae 0x14004e177
vmovss xmm0, dword [0x14006bcc0]
vaddss xmm1, xmm0, dword [0x140061e6c]
vcomiss xmm6, xmm1
vmovss dword [0x14006bcc0], xmm1
jbe 0x14004e177
mov eax, dword [0x14006bcb0]
cdq
sub eax, edx
sar eax, 1
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
vmovss dword [0x14006bcc0], xmm0
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004e1bf
vmovss xmm0, dword [0x14006bcc0]
vaddss xmm2, xmm0, dword [0x140061e44]
mov eax, dword [0x14006bcb0]
cdq
vxorps xmm0, xmm0, xmm0
sub eax, edx
sar eax, 1
vcvtsi2ss xmm0, xmm0, eax
vcmpltss xmm1, xmm0, xmm2
vblendvps xmm0, xmm2, xmm6, xmm1
vmovss dword [0x14006bcc0], xmm0
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
vmovaps xmm6, xmmword [rsp + 0x30]
jae 0x14004e25f
mov ecx, 0x50
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004e25f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [0x14004e840]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [0x140061991], 0
vmovsd xmm0, qword [0x140061988]
movzx eax, word [0x140061990]
vmovsd qword [rbp - 0x20], xmm0
mov word [rbp - 0x18], ax
je 0x14004e24b
xor byte [rbp - 0x1f], 0x31
xor byte [rbp - 0x1e], 0x32
xor byte [rbp - 0x1d], 0x33
xor byte [rbp - 0x1c], 0x34
xor byte [rbp - 0x1b], 0x35
xor byte [rbp - 0x1a], 0x36
xor byte [rbp - 0x19], 0x37
xor byte [rbp - 0x18], 0x38
xor byte [rbp - 0x17], 0x39
mov byte [rbp - 0x20], 0xb9
lea rcx, [rbp - 0x20]
call fcn.1400036e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x4b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004e2f9
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14004e2f9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [0x14004e960]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [0x140061c09], 0
vmovsd xmm0, qword [0x140061c00]
movzx eax, word [0x140061c08]
vmovsd qword [rbp - 0x20], xmm0
mov word [rbp - 0x18], ax
je 0x14004e2e5
xor byte [rbp - 0x1f], 0x31
xor byte [rbp - 0x1e], 0x32
xor byte [rbp - 0x1d], 0x33
xor byte [rbp - 0x1c], 0x34
xor byte [rbp - 0x1b], 0x35
xor byte [rbp - 0x1a], 0x36
xor byte [rbp - 0x19], 0x37
xor byte [rbp - 0x18], 0x38
xor byte [rbp - 0x17], 0x39
mov byte [rbp - 0x20], 0xbf
lea rcx, [rbp - 0x20]
call fcn.1400036e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
xor ecx, ecx
call fcn.14001b1f0
int3