Function at 0x140022440
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
mov rax, qword [0x1403150c0]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor r13d, r13d
mov r12d, r13d
mov dword [rbp + 0x18], r13d
cmp byte [0x1403376b8], r13b
jne 0x140023d80
movabs rbx, 0x8000000000000000
movss xmm10, dword [0x1402ff0dc]
movss xmm7, dword [0x1402ff0b0]
movss xmm8, dword [0x1402ff0d8]
movss xmm9, dword [0x1402feee0]
mov r10, qword [0x140339068]
mov r14, qword [rbp + 0x20]
nop dword [rax]
mov rdx, qword [0x140338f78]
add rdx, 0x20
test r10, r10
je 0x14002251b
cmp dword [0x140338fc4], 0
je 0x14002251b
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1c8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140339068]
mov rdx, qword [0x140339740]
add rdx, qword [0x140338f58]
test r10, r10
je 0x140022559
cmp dword [0x140338fc4], 0
je 0x140022559
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x88]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140339068]
mov r15, qword [rbp + 0x88]
mov rdx, qword [0x140339740]
test rdx, rdx
je 0x140023d73
cmp byte [0x140337698], 0
je 0x1400225bd
movd xmm0, dword [0x140337694]
cvtdq2ps xmm0, xmm0
movss dword [rbp], xmm0
test r10, r10
je 0x1400225b6
cmp dword [0x140338fc4], 0
je 0x1400225b6
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x140337698], 0
mov ecx, dword [0x140337690]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14002288c
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x30], 0
mov dword [rbp - 8], 0xffffffff
movaps xmm6, xmm10
cmp qword [0x140339740], 0
je 0x1400227d2
lea rdx, [0x140339760]
lea rcx, [rbp + 0x1a8]
call fcn.140023ed0
or r12d, 1
mov rsi, qword [rbp + 0x1b0]
mov rax, qword [rbp + 0x1a8]
cmp rax, rsi
je 0x140022782
lea rbx, [rax + 0x28]
nop word [rax + rax]
mov rax, qword [rbx - 0x28]
mov qword [rbp - 0x70], rax
lea rdx, [rbx - 0x20]
lea rcx, [rbp - 0x68]
call fcn.140013730
mov rax, qword [rbx]
mov qword [rbp - 0x48], rax
mov eax, dword [rbx + 8]
mov dword [rbp - 0x40], eax
mov rdi, qword [rbp - 0x70]
test rdi, rdi
je 0x140022732
mov rcx, qword [0x140339068]
test rcx, rcx
je 0x1400226a1
cmp dword [0x140338fc4], 0
je 0x1400226a1
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], r13
mov r9d, listen
lea r8, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm1, dword [rsp + 0x54]
subss xmm1, dword [0x140339754]
movss xmm2, dword [rsp + 0x58]
subss xmm2, dword [0x140339758]
movss xmm0, dword [rsp + 0x5c]
subss xmm0, dword [0x14033975c]
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
mulss xmm0, xmm0
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x1400226f0
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x1400226f8
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
comiss xmm6, xmm0
jbe 0x140022732
comiss xmm7, xmm0
jbe 0x140022732
movaps xmm6, xmm0
mov qword [rbp - 0x38], rdi
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [rbp - 0x30]
call fcn.140014ac0
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 8], eax
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14002276d
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022768
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023dc9
call fcn.1400f2e44
add rbx, 0x38
lea rax, [rbx - 0x28]
cmp rax, rsi
jne 0x140022640
mov rbx, qword [rbp - 0x18]
lea rcx, [rbp + 0x1a8]
call fcn.1400033a0
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400227d2
mov dword [rbp + 0x28], 1
mov rdx, qword [0x140338f80]
add rdx, rcx
mov rcx, qword [0x140339068]
test rcx, rcx
je 0x1400227d9
cmp dword [0x140338fc4], 0
je 0x1400227d9
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140339068]
cmp rbx, 0xf
jbe 0x140022818
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002280c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023dd0
call fcn.1400f2e44
mov rcx, qword [0x140339068]
movabs rbx, 0x8000000000000000
cmp byte [0x14033767a], 0
je 0x140022895
test rcx, rcx
je 0x140022866
cmp dword [0x140338fc4], 0
je 0x140022866
mov rdx, qword [0x140339740]
add rdx, 0x10c8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov dword [rbp], 0xbf800000
test rcx, rcx
je 0x140022908
cmp dword [0x140338fc4], 0
je 0x140022908
mov rdx, qword [rbp + 0x90]
jmp 0x1400228ec
mov rcx, qword [0x140339068]
jmp 0x140022822
test rcx, rcx
je 0x1400228d0
cmp dword [0x140338fc4], 0
je 0x1400228d0
mov rdx, qword [0x140339740]
add rdx, 0x10c8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov dword [rbp], 0x42c80000
test rcx, rcx
je 0x140022908
cmp dword [0x140338fc4], 0
je 0x140022908
mov rdx, qword [rbp + 0x98]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp]
add rdx, 0xcf4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, 0xdf
mov rcx, qword [0x140339740]
cmp byte [0x140337678], 0
je 0x140022922
mov r8b, 1
jmp 0x140022925
xor r8d, r8d
call fcn.140021e80
cmp byte [0x14033769a], 0
je 0x14002297f
mov ecx, dword [0x14033768c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14002297f
mov rcx, qword [0x140339740]
add rcx, 0x189
cmp byte [0x140337699], 0
je 0x14002295f
xor dl, dl
jmp 0x140022961
mov dl, 1
call fcn.140024050
cmp byte [0x140337699], 0
sete byte [0x140337699]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140339068]
cmp qword [0x140338f08], 0
jne 0x140022a3b
mov rdx, qword [0x140339740]
test rdx, rdx
jne 0x1400229a5
mov rdx, r13
jmp 0x1400229e0
test rcx, rcx
je 0x1400229d9
cmp dword [0x140338fc4], 0
je 0x1400229d9
add rdx, qword [0x140338f58]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0xa0]
test rcx, rcx
je 0x140022a11
cmp dword [0x140338fc4], 0
je 0x140022a11
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
xor edx, edx
movss xmm0, dword [rbp + 0x30]
comiss xmm0, xmm8
jb 0x140022a2c
subss xmm0, xmm8
comiss xmm0, xmm8
jae 0x140022a2c
mov rdx, rbx
cvttss2si rax, xmm0
add rax, rdx
mov qword [0x140338f08], rax
cmp byte [0x140337679], 0
je 0x140022b62
mov rdx, qword [0x140339740]
test rdx, rdx
jne 0x140022a59
mov rdx, r13
jmp 0x140022a94
test rcx, rcx
je 0x140022a8d
cmp dword [0x140338fc4], 0
je 0x140022a8d
add rdx, qword [0x140338f58]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140022ac5
cmp dword [0x140338fc4], 0
je 0x140022ac5
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x34]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
movzx eax, byte [0x140337679]
neg al
sbb ebx, ebx
and ebx, 0x4000
cvttss2si rax, dword [rbp + 0x34]
or ebx, eax
mov rdx, qword [0x140339740]
test rdx, rdx
jne 0x140022aef
mov rdx, r13
jmp 0x140022b2a
test rcx, rcx
je 0x140022b23
cmp dword [0x140338fc4], 0
je 0x140022b23
add rdx, qword [0x140338f58]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x198]
mov dword [rbp + 0x38], ebx
test rcx, rcx
je 0x140022bcf
cmp dword [0x140338fc4], 0
je 0x140022b62
add rdx, 0x270
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140339068]
test rcx, rcx
je 0x140022bcf
cmp dword [0x140338fc4], 0
je 0x140022b96
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x190]
mov rdx, qword [0x140339450]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
test rcx, rcx
je 0x140022bcf
cmp dword [0x140338fc4], 0
je 0x140022bcf
mov rdx, qword [rbp + 0x190]
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov r14, qword [rbp + 0x20]
mov rbx, r14
mov rax, qword [0x140339350]
mov rdx, qword [0x140339358]
cmp rax, rdx
je 0x140022bf3
cmp qword [rax], r14
je 0x140022c68
add rax, 0x10
cmp rax, rdx
jne 0x140022be5
mov qword [rsp + 0x70], r14
test rcx, rcx
je 0x140022c31
cmp dword [0x140338fc4], 0
je 0x140022c31
lea rdx, [r14 + 0x30]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140339358]
mov rcx, qword [0x140339068]
mov r14, qword [rbp + 0x20]
movss xmm0, dword [rbp + 0x40]
movss dword [rsp + 0x78], xmm0
cmp rdx, qword [0x140339360]
je 0x140022c57
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rdx], xmm0
add qword [0x140339358], 0x10
jmp 0x140022c68
lea r8, [rsp + 0x70]
call fcn.1400240e0
mov rcx, qword [0x140339068]
cmp byte [0x140337684], 0
je 0x140022c80
movss xmm0, dword [0x140337688]
movss dword [rbp], xmm0
jmp 0x140022c87
mov dword [rbp], 0x42480000
test rcx, rcx
je 0x140022cb2
cmp dword [0x140338fc4], 0
je 0x140022cb2
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp]
lea rdx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14, qword [rbp + 0x20]
mov edx, 0x59
mov rcx, qword [0x140339740]
cmp byte [0x14033767d], 0
je 0x140022e07
mov r8b, 1
call fcn.140021e80
mov r8b, 1
mov edx, 0x6a
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, WSAGetLastError
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, WSASetLastError
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, WSASetLastError
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, WSASetLastError
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, reloc.WS2_32.dll___WSAFDIsSet
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, 0xa0
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, 0xa1
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, 0xa2
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, 0xa3
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, 0xa4
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, 0xa5
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, Ordinal_200
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, Ordinal_200
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
mov edx, 0xa3
mov rcx, qword [0x140339740]
call fcn.140021e80
mov r8b, 1
jmp 0x140022f3e
xor r8d, r8d
call fcn.140021e80
xor r8d, r8d
mov edx, 0x6a
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, WSAGetLastError
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, WSASetLastError
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, WSASetLastError
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, WSASetLastError
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, reloc.WS2_32.dll___WSAFDIsSet
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, 0xa0
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, 0xa1
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, 0xa2
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, 0xa3
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, 0xa4
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, 0xa5
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, Ordinal_200
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, Ordinal_200
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, 0xa3
mov rcx, qword [0x140339740]
call fcn.140021e80
xor r8d, r8d
mov edx, 0xa3
mov rcx, qword [0x140339740]
call fcn.140021e80
mov rcx, qword [0x140339068]
cmp byte [0x14033767c], 0
je 0x1400230b7
test rcx, rcx
je 0x140022f9b
cmp dword [0x140338fc4], 0
je 0x140022f9b
mov rdx, qword [0x140339740]
add rdx, 0x30
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x188]
test rdx, rdx
je 0x140023225
test rcx, rcx
je 0x140022fdc
cmp dword [0x140338fc4], 0
je 0x140022fdc
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x140023225
test rcx, rcx
je 0x14002301d
cmp dword [0x140338fc4], 0
je 0x14002301d
add rdx, 0x20
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x178]
test rdx, rdx
je 0x140023225
test rcx, rcx
je 0x14002305e
cmp dword [0x140338fc4], 0
je 0x14002305e
add rdx, 0x70
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x170]
test rdx, rdx
je 0x140023225
test rcx, rcx
je 0x14002309b
cmp dword [0x140338fc4], 0
je 0x14002309b
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x160]
test rdx, rdx
je 0x140023225
mov dword [rbp], 0xbf800000
jmp 0x1400231fe
test rcx, rcx
je 0x1400230ef
cmp dword [0x140338fc4], 0
je 0x1400230ef
mov rdx, qword [0x140339740]
add rdx, 0x30
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x138]
test rdx, rdx
je 0x140023225
test rcx, rcx
je 0x140023130
cmp dword [0x140338fc4], 0
je 0x140023130
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x168]
test rdx, rdx
je 0x140023225
test rcx, rcx
je 0x140023171
cmp dword [0x140338fc4], 0
je 0x140023171
add rdx, 0x20
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
je 0x140023225
test rcx, rcx
je 0x1400231b2
cmp dword [0x140338fc4], 0
je 0x1400231b2
add rdx, 0x70
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0xb8]
test rdx, rdx
je 0x140023225
test rcx, rcx
je 0x1400231eb
cmp dword [0x140338fc4], 0
je 0x1400231eb
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x140023225
mov dword [rbp], 0x3e800000
test rcx, rcx
je 0x140023225
cmp dword [0x140338fc4], 0
je 0x140023225
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp]
add rdx, 0x2c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x140337699], 0
je 0x14002324c
mov rcx, qword [0x140339740]
add rcx, 0x189
mov dl, 1
call fcn.140024050
cmp byte [0x140337699], 0
jne 0x140023261
mov rcx, qword [0x140339740]
add rcx, 0x189
xor edx, edx
call fcn.140024050
mov edx, 2
mov rcx, qword [0x140339740]
cmp byte [0x14033767b], 0
je 0x14002327b
mov r8b, 1
jmp 0x14002327e
xor r8d, r8d
call fcn.140021e80
mov rdx, qword [0x140339740]
mov rcx, qword [0x140339068]
test rdx, rdx
jne 0x14002329e
mov rbx, r13
jmp 0x14002341e
test rcx, rcx
je 0x1400232d2
cmp dword [0x140338fc4], 0
je 0x1400232d2
add rdx, qword [0x140338f60]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rbx, qword [rbp + 0xc8]
test rbx, rbx
je 0x14002341e
test rcx, rcx
je 0x140023319
cmp dword [0x140338fc4], 0
je 0x140023319
mov rdx, qword [0x140338f70]
add rdx, rbx
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rax, qword [0x140339740]
cmp qword [rbp + 0xd0], rax
jne 0x140023417
mov byte [0x140338f18], 1
test rcx, rcx
je 0x140023365
cmp dword [0x140338fc4], 0
je 0x140023365
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rax, qword [rbp + 0xd8]
mov qword [0x140338f10], rax
mov qword [0x140338f20], rbx
test rcx, rcx
je 0x1400233ab
cmp dword [0x140338fc4], 0
je 0x1400233ab
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rax, qword [rbp + 0xe0]
mov qword [0x140338f00], rax
test rcx, rcx
je 0x1400233eb
cmp dword [0x140338fc4], 0
je 0x1400233eb
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], r13
mov r9d, listen
lea r8, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
movss xmm0, dword [rsp + 0x48]
movss dword [0x140339368], xmm0
movss xmm1, dword [rsp + 0x4c]
movss dword [0x14033936c], xmm1
movss xmm0, dword [rsp + 0x50]
movss dword [0x140339370], xmm0
jmp 0x14002341e
mov byte [0x140338f18], 0
mov rax, qword [0x140339378]
mov rdx, qword [0x140339380]
cmp rax, rdx
je 0x140023443
cmp qword [rax], rbx
je 0x140023608
add rax, 0x10
cmp rax, rdx
jne 0x140023431
mov qword [rsp + 0x60], rbx
mov rdx, qword [0x140339740]
test rdx, rdx
je 0x1400234d1
test rcx, rcx
je 0x140023488
cmp dword [0x140338fc4], 0
je 0x140023488
add rdx, qword [0x140338f60]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0xe8]
test rdx, rdx
je 0x1400234d1
test rcx, rcx
je 0x1400234c8
cmp dword [0x140338fc4], 0
je 0x1400234c8
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0xf0]
jmp 0x1400234d4
mov rdx, r13
test rcx, rcx
je 0x140023505
cmp dword [0x140338fc4], 0
je 0x140023505
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
movss xmm0, dword [rbp + 0x78]
movss dword [rsp + 0x6c], xmm0
mov rdx, qword [0x140339740]
test rdx, rdx
je 0x140023599
test rcx, rcx
je 0x140023550
cmp dword [0x140338fc4], 0
je 0x140023550
add rdx, qword [0x140338f60]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x140023599
test rcx, rcx
je 0x140023590
cmp dword [0x140338fc4], 0
je 0x140023590
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x100]
jmp 0x14002359c
mov rdx, r13
test rcx, rcx
je 0x1400235ca
cmp dword [0x140338fc4], 0
je 0x1400235ca
add rdx, 0x4c
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
movss xmm0, dword [rbp + 0x44]
movss dword [rsp + 0x68], xmm0
mov rdx, qword [0x140339380]
cmp rdx, qword [0x140339388]
je 0x1400235f7
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rdx], xmm0
add qword [0x140339380], 0x10
jmp 0x140023608
lea r8, [rsp + 0x60]
call fcn.1400242a0
mov rcx, qword [0x140339068]
test rcx, rcx
je 0x14002363c
cmp dword [0x140338fc4], 0
je 0x14002363c
lea rdx, [rbx + 0x960]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
cmp byte [0x1403376ac], 0
je 0x1400237cb
movss xmm6, dword [0x1403376b4]
mov rdx, qword [0x140339740]
test rdx, rdx
je 0x1400236da
test rcx, rcx
je 0x140023691
cmp dword [0x140338fc4], 0
je 0x140023691
add rdx, qword [0x140338f60]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x108]
test rdx, rdx
je 0x1400236da
test rcx, rcx
je 0x1400236d1
cmp dword [0x140338fc4], 0
je 0x1400236d1
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x110]
jmp 0x1400236dd
mov rdx, r13
movss dword [rbp + 0x48], xmm6
test rcx, rcx
je 0x140023713
cmp dword [0x140338fc4], 0
je 0x140023713
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140339068]
movss xmm6, dword [0x1403376b0]
mov rdx, qword [0x140339740]
test rdx, rdx
je 0x1400237a4
test rcx, rcx
je 0x14002375b
cmp dword [0x140338fc4], 0
je 0x14002375b
add rdx, qword [0x140338f60]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x118]
test rdx, rdx
je 0x1400237a4
test rcx, rcx
je 0x14002379b
cmp dword [0x140338fc4], 0
je 0x14002379b
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x120]
jmp 0x1400237a7
mov rdx, r13
movss dword [rbp + 0x50], xmm6
test rcx, rcx
je 0x1400239a5
cmp dword [0x140338fc4], 0
je 0x1400239a5
lea r8, [rbp + 0x50]
jmp 0x140023989
mov rax, qword [0x140339378]
mov rdx, qword [0x140339380]
cmp rax, rdx
je 0x1400237ee
nop
cmp qword [rax], rbx
je 0x1400237f1
add rax, 0x10
cmp rax, rdx
jne 0x1400237e0
mov rax, r13
movss xmm6, dword [rax + 0xc]
mov rdx, qword [0x140339740]
test rdx, rdx
je 0x14002387f
test rcx, rcx
je 0x140023836
cmp dword [0x140338fc4], 0
je 0x140023836
add rdx, qword [0x140338f60]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x128]
test rdx, rdx
je 0x14002387f
test rcx, rcx
je 0x140023876
cmp dword [0x140338fc4], 0
je 0x140023876
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x130]
jmp 0x140023882
mov rdx, r13
movss dword [rbp + 0x58], xmm6
test rcx, rcx
je 0x1400238b8
cmp dword [0x140338fc4], 0
je 0x1400238b8
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140339068]
mov rax, qword [0x140339378]
mov rdx, qword [0x140339380]
cmp rax, rdx
je 0x1400238de
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x1400238e1
add rax, 0x10
cmp rax, rdx
jne 0x1400238d0
mov rax, r13
movss xmm6, dword [rax + 8]
mov rdx, qword [0x140339740]
test rdx, rdx
je 0x14002396f
test rcx, rcx
je 0x140023926
cmp dword [0x140338fc4], 0
je 0x140023926
add rdx, qword [0x140338f60]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x1a0]
test rdx, rdx
je 0x14002396f
test rcx, rcx
je 0x140023966
cmp dword [0x140338fc4], 0
je 0x140023966
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x140]
jmp 0x140023972
mov rdx, r13
movss dword [rbp + 0x60], xmm6
test rcx, rcx
je 0x1400239a5
cmp dword [0x140338fc4], 0
je 0x1400239a5
lea r8, [rbp + 0x60]
mov qword [rsp + 0x20], r13
mov r9d, 4
add rdx, 0x4c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140339068]
cmp byte [0x14033766e], 0
je 0x140023a73
test rcx, rcx
je 0x1400239ea
cmp dword [0x140338fc4], 0
je 0x1400239ea
mov rdx, qword [0x140339740]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
movss xmm0, dword [rbp + 0x68]
comiss xmm0, xmm9
jbe 0x140023a2e
mov rdx, qword [0x140339740]
test rdx, rdx
je 0x140023a66
mov byte [rbp + 8], 1
test rcx, rcx
je 0x140023a66
cmp dword [0x140338fc4], 0
je 0x140023a66
add rdx, 0x2c
mov qword [rsp + 0x20], r13
mov r9d, 1
lea r8, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140023a5f
test rcx, rcx
je 0x140023a66
cmp dword [0x140338fc4], 0
je 0x140023a66
mov rdx, qword [0x140339740]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x7c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
cmp byte [0x14033766e], 0
jne 0x140023b2a
test rcx, rcx
je 0x140023aab
cmp dword [0x140338fc4], 0
je 0x140023aab
mov rdx, qword [0x140339740]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x6c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
movss xmm0, dword [rbp + 0x6c]
comiss xmm0, xmm9
jbe 0x140023aef
mov rdx, qword [0x140339740]
test rdx, rdx
je 0x140023b2a
mov byte [rbp + 0x10], gethostname
test rcx, rcx
je 0x140023b2a
cmp dword [0x140338fc4], 0
je 0x140023b2a
add rdx, 0x2c
mov qword [rsp + 0x20], r13
mov r9d, 1
lea r8, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140023b23
test rcx, rcx
je 0x140023b2a
cmp dword [0x140338fc4], 0
je 0x140023b2a
mov rdx, qword [0x140339740]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
cmp byte [0x14033767e], 0
je 0x140023b54
movss xmm0, dword [0x140337680]
movss dword [rbp + 0x70], xmm0
test rcx, rcx
je 0x140023b8c
cmp dword [0x140338fc4], 0
je 0x140023b8c
lea r8, [rbp + 0x70]
jmp 0x140023b6d
mov dword [rbp + 0x18], 0x3f800000
test rcx, rcx
je 0x140023b8c
cmp dword [0x140338fc4], 0
je 0x140023b8c
lea r8, [rbp + 0x18]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea rdx, [r15 + 0xd40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140339068]
cmp byte [0x140338f18], 0
jne 0x140023cc0
mov rdx, qword [0x140339740]
test rdx, rdx
jne 0x140023baa
mov rax, r13
jmp 0x140023be2
test rcx, rcx
je 0x140023bdb
cmp dword [0x140338fc4], 0
je 0x140023bdb
add rdx, 0x20
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rax, qword [rbp + 0x148]
mov qword [0x140338f10], rax
mov rdx, qword [0x140339740]
mov qword [0x140338f20], rdx
test rdx, rdx
jne 0x140023c01
mov rax, r13
jmp 0x140023c39
test rcx, rcx
je 0x140023c32
cmp dword [0x140338fc4], 0
je 0x140023c32
add rdx, 0x30
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rax, qword [rbp + 0x150]
mov qword [0x140338f00], rax
cmp qword [0x140339740], 0
jne 0x140023c5d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
jmp 0x140023c96
test rcx, rcx
je 0x140023c96
cmp dword [0x140338fc4], 0
je 0x140023c96
mov rdx, qword [0x140339740]
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, listen
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
movss xmm0, dword [rsp + 0x30]
movss dword [0x140339368], xmm0
movss xmm1, dword [rsp + 0x34]
movss dword [0x14033936c], xmm1
movss xmm0, dword [rsp + 0x38]
movss dword [0x140339370], xmm0
mov rdx, qword [0x140339678]
test rdx, rdx
je 0x140023d36
test rcx, rcx
je 0x140023d00
cmp dword [0x140338fc4], 0
je 0x140023d00
add rdx, 0x3c0
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140339068]
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x140023d36
test rcx, rcx
je 0x140023d47
cmp dword [0x140338fc4], 0
je 0x140023d47
add rdx, 0x40
mov qword [rsp + 0x20], r13
mov r9d, listen
lea r8, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140023d47
mov qword [rsp + 0x3c], 0
mov dword [rsp + 0x44], 0
movsd xmm0, qword [rsp + 0x3c]
movsd qword [rbp - 0x80], xmm0
mov eax, dword [rsp + 0x44]
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x80]
call fcn.140021fd0
mov r10, qword [0x140339068]
movabs rbx, 0x8000000000000000
cmp byte [0x1403376b8], 0
je 0x1400224e0
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400f2ba0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3