Function at 0x7ff6989f0c90
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x390
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
movaps xmmword [rax - 0xc8], xmm14
movaps xmmword [rax - 0xd8], xmm15
xor edi, edi
movabs rsi, 0x6666666666666667
movss xmm13, dword [0x7ff698a61c54]
movss xmm15, dword [0x7ff698a61c98]
movss xmm14, dword [0x7ff698a61c90]
movsd xmm7, qword [0x7ff698a677f8]
xorps xmm8, xmm8
movdqu xmmword [rbp - 0x48], xmm8
mov r13, rdi
mov qword [rbp - 0x38], rdi
mov rdx, qword [0x7ff698a897a8]
add rdx, 0x5c80950
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 8]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rax, qword [rbp + 8]
mov qword [0x7ff698a89630], rax
lea rdx, [rax + 0x160]
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x10]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x10]
add rdx, 0x38
lea rax, [rbp + 0x108]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x18]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x20]
mov qword [0x7ff698a89648], rax
lea rdx, [rax + 0x30]
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x28]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x28]
mov qword [0x7ff698a89658], rax
lea rdx, [rax + 0x3b8]
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x30]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x30]
mov qword [0x7ff698a89638], rax
lea rdx, [rax + 0x350]
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0xe0]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0xe0]
mov qword [0x7ff698a89640], rax
mov rdx, qword [0x7ff698a89638]
add rdx, 0x158
lea rax, [rbp + 0x198]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x38]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x38]
mov qword [0x7ff698a89650], rax
mov rdx, qword [0x7ff698a89638]
test rdx, rdx
je 0x7ff6989f0f15
add rdx, 0x18
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x2e0]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x2e0]
mov dword [0x7ff698a89678], eax
mov rdx, qword [0x7ff698a89630]
add rdx, 0x30
lea rax, [rbp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x40]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x40]
mov qword [0x7ff698a89660], rax
mov rdx, qword [0x7ff698a89648]
add rdx, 0xb0
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x48]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x48]
lea rdx, [rbx + 0xa60]
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x60]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
movss xmm9, dword [rbp - 0x70]
movss xmm10, dword [rbp - 0x6c]
movss xmm11, dword [rbp - 0x68]
movss xmm0, dword [rbp - 0x78]
call sub.ucrtbase.dll_asinf
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
mulsd xmm1, xmm7
divsd xmm1, qword [0x7ff698a677e8]
cvtpd2ps xmm12, xmm1
movss xmm6, dword [rbp - 0x80]
movaps xmm1, xmm6
movss xmm0, dword [rbp - 0x7c]
call sub.ucrtbase.dll_atan2f
xorps xmm2, xmm2
cvtss2sd xmm2, xmm0
mulsd xmm2, xmm7
divsd xmm2, qword [0x7ff698a677e8]
cvtpd2ps xmm7, xmm2
movaps xmm1, xmm6
movss xmm0, dword [rsp + 0x68]
call sub.ucrtbase.dll_atan2f
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
mulsd xmm1, qword [0x7ff698a677f8]
divsd xmm1, qword [0x7ff698a677e8]
cvtpd2ps xmm6, xmm1
lea rdx, [rbx + 0x960]
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x2e8]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
movss xmm0, dword [0x7ff698a61c34]
divss xmm0, dword [rbp + 0x2e8]
call sub.ucrtbase.dll_atanf
addss xmm0, xmm0
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
mulsd xmm1, qword [0x7ff698a677f8]
divsd xmm1, qword [0x7ff698a677e8]
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x7ff698a67820]
comiss xmm7, xmm1
jae 0x7ff6989f10a7
comiss xmm1, xmm7
jb 0x7ff6989f10af
mulss xmm0, dword [0x7ff698a61cb8]
movss dword [0x7ff698a89fb0], xmm9
movss dword [0x7ff698a89fb4], xmm10
movss dword [0x7ff698a89fb8], xmm11
movss dword [0x7ff698a89fbc], xmm12
movss dword [0x7ff698a89fc0], xmm7
movss dword [0x7ff698a89fc4], xmm6
movss dword [0x7ff698a89fc8], xmm0
mov rdx, qword [0x7ff698a89630]
add rdx, 0x120
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x50]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x50]
test rbx, rbx
jne 0x7ff6989f112a
jmp 0x7ff6989f0d19
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x58]
lea rdx, [rbx + 0x348]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
lea rdx, [rbx + 0x350]
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x40]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov ecx, dword [rsp + 0x40]
lea eax, [rcx - 1]
cmp eax, 0x67
ja 0x7ff6989f1720
mov r14, qword [rbp + 0x58]
mov r12d, ecx
mov rbx, qword [rbp - 0x40]
nop word [rax + rax]
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x60]
mov rdx, r14
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x7ff6989f1700
add rdx, 0x3b8
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x68]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rdi, qword [rbp + 0x68]
test rdi, rdi
je 0x7ff6989f1700
mov rdx, qword [0x7ff698a89638]
add rdx, 0x350
lea rax, [rbp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x70]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x70]
add rdx, 0xee8
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x88]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
lea rdx, [rdi + 0x350]
lea rax, [rbp + 0x138]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x78]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x78]
add rdx, 0xee8
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x80]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x80]
cmp qword [rbp + 0x88], rax
je 0x7ff6989f1700
cmp rdi, qword [0x7ff698a89638]
je 0x7ff6989f1700
lea rdx, [rdi + 0x158]
lea rax, [rbp + 0x148]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x98]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
lea rdx, [rdi + 0x390]
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x90]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rsi, qword [rbp + 0x90]
test rsi, rsi
je 0x7ff6989f1700
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov rdx, qword [rbp + 0x98]
add rdx, 0x164
lea rax, [rbp + 0x158]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rdx, qword [0x7ff698a89650]
add rdx, 0x164
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x48]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
movsd xmm0, qword [rsp + 0x48]
movsd qword [0x7ff698a89f70], xmm0
mov eax, dword [rsp + 0x50]
mov dword [0x7ff698a89f78], eax
movss xmm7, dword [rsp + 0x34]
movaps xmm0, xmm7
subss xmm0, dword [0x7ff698a89fb4]
movaps xmm1, xmm13
call sub.ucrtbase.dll_powf
movaps xmm6, xmm0
movss xmm8, dword [rsp + 0x30]
movaps xmm0, xmm8
subss xmm0, dword [0x7ff698a89fb0]
movaps xmm1, xmm13
call sub.ucrtbase.dll_powf
addss xmm6, xmm0
movss xmm9, dword [rsp + 0x38]
movaps xmm0, xmm9
subss xmm0, dword [0x7ff698a89fb8]
movaps xmm1, xmm13
call sub.ucrtbase.dll_powf
addss xmm6, xmm0
xorps xmm1, xmm1
ucomiss xmm1, xmm6
ja 0x7ff6989f145b
sqrtss xmm6, xmm6
jmp 0x7ff6989f1466
movaps xmm0, xmm6
call sub.ucrtbase.dll_sqrtf
movaps xmm6, xmm0
divss xmm6, xmm15
lea rdx, [rdi + 0x3a0]
lea rax, [rbp + 0x1e8]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp - 0x50]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
movss xmm1, dword [0x7ff698a8981c]
comiss xmm1, xmm6
jbe 0x7ff6989f1700
lea rdx, [rdi + 0x820]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0xa0]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xa0]
add rdx, 0x361
lea rax, [rbp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rbp + 0x2d8]
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
cmp byte [0x7ff698a898e7], 0
je 0x7ff6989f1599
cmp byte [0x7ff698a898d6], 0
jne 0x7ff6989f1599
mov ecx, dword [0x7ff698a896ec]
call qword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jns 0x7ff6989f1556
comiss xmm14, xmm6
jbe 0x7ff6989f1556
mov dword [rbp - 0x10], 0x42b40000
mov dword [rbp - 0xc], 0x42b40000
mov dword [rbp - 8], 0x42b40000
lea rax, [rbp + 0x180]
lea r8, [rbp - 0x10]
jmp 0x7ff6989f1576
mov dword [rbp - 4], 0x3f800000
mov dword [rbp], 0x3f800000
mov dword [rbp + 4], 0x3f800000
lea rax, [rbp + 0x188]
lea r8, [rbp - 4]
mov rdx, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
add rdx, 0x17c
mov rcx, qword [0x7ff698a897b8]
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
mov rcx, rsi
call fcn.7ff6989f3dd0
movzx r15d, al
mov r8d, 0x42
mov rdx, rsi
lea rcx, [rbp + 0xe8]
call fcn.7ff6989eccc0
movsd xmm0, qword [rbp + 0xe8]
movsd qword [rbp + 0xb0], xmm0
mov ecx, dword [rbp + 0xf0]
mov dword [rbp + 0xb8], ecx
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x20]
call fcn.7ff6989f2460
mov r8d, 1
mov rdx, rsi
lea rcx, [rbp + 0xc0]
call fcn.7ff6989eccc0
movsd xmm0, qword [rbp + 0xc0]
movsd qword [rbp + 0xd0], xmm0
mov eax, dword [rbp + 0xc8]
mov dword [rbp + 0xd8], eax
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x30]
call fcn.7ff6989f2460
movss xmm1, dword [rbp - 0x1c]
movss xmm2, dword [rbp - 0x2c]
ucomiss xmm1, xmm2
jp 0x7ff6989f163c
je 0x7ff6989f1700
xor eax, eax
mov qword [rsp + 0x68], rax
mov word [rsp + 0x7e], ax
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x60], rdi
movzx eax, byte [rbp + 0x2d8]
mov byte [rsp + 0x7c], al
mov qword [rsp + 0x70], rsi
movss dword [rsp + 0x78], xmm6
mov byte [rsp + 0x7d], r15b
movss dword [rbp - 0x80], xmm8
movss dword [rbp - 0x7c], xmm7
movss dword [rbp - 0x78], xmm9
movss xmm0, dword [rbp - 0x20]
movss dword [rbp - 0x68], xmm0
movss dword [rbp - 0x64], xmm1
movss xmm1, dword [rbp - 0x18]
movss dword [rbp - 0x60], xmm1
movss xmm0, dword [rbp - 0x30]
movss dword [rbp - 0x5c], xmm0
movss dword [rbp - 0x58], xmm2
movss xmm1, dword [rbp - 0x28]
movss dword [rbp - 0x54], xmm1
cmp rbx, r13
je 0x7ff6989f16e7
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [rbp - 0x80]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [rbp - 0x70]
movups xmmword [rbx + 0x30], xmm1
movaps xmm0, xmmword [rbp - 0x60]
movups xmmword [rbx + 0x40], xmm0
add rbx, 0x50
mov qword [rbp - 0x40], rbx
jmp 0x7ff6989f1700
lea r8, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.7ff6989e8460
mov r13, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x40]
add r14, 8
sub r12, 1
jne 0x7ff6989f11a0
movdqu xmm8, xmmword [rbp - 0x48]
xor edi, edi
movabs rsi, 0x6666666666666667
lea rcx, [0x7ff698a89b20]
call sub.msvcp140.dll__Mtx_lock
test eax, eax
jne 0x7ff6989f17e2
cmp dword [0x7ff698a89b6c], 0x7fffffff
je 0x7ff6989f17cd
mov r8, qword [0x7ff698a89ef0]
test r8, r8
je 0x7ff6989f179f
mov rcx, qword [0x7ff698a89f00]
sub rcx, r8
mov rax, rsi
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 4
cmp rdx, 0x1000
jb 0x7ff6989f1797
add rdx, 0x27
mov rcx, qword [r8 - 8]
sub r8, rcx
lea rax, [r8 - 8]
cmp rax, 0x1f
ja 0x7ff6989f17c6
mov r8, rcx
mov rcx, r8
call fcn.7ff698a5b9ac
movups xmmword [0x7ff698a89ef0], xmm8
movsd xmm0, qword [rbp - 0x38]
movsd qword [0x7ff698a89f00], xmm0
lea rcx, [0x7ff698a89b20]
call sub.msvcp140.dll__Mtx_unlock
nop
jmp 0x7ff6989f0d19
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
mov dword [0x7ff698a89b6c], 0x7ffffffe
mov ecx, 6
call sub.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3