Function at 0x140001cf0
Capabilities:
Link many functions at runtime
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x240
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r13d, 2
xor edx, edx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor r12d, r12d
lea rsi, str.Game.exe
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001d54
mov rcx, rax
jmp 0x140001dca
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x140001dc2
nop dword [rax]
lea rax, [rbp + 0x1c]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x140001d80
mov r8d, 8
lea rdx, [rbp + 0x1c]
cmp rdi, r8
mov rcx, rsi
cmovb r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001db0
cmp rdi, 8
je 0x1400020e8
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x140001d70
test rbx, rbx
je 0x140001dd0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r12d
mov edx, edi
mov dword [0x140006628], edi
lea rcx, str.Warface:__d_n
call fcn.140001010
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x140006628]
lea rcx, str.win32u.dll
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x3f], r12
mov qword [rsp + 0x47], r12
mov qword [rsp + 0x4f], r12
mov byte [rsp + 0x57], r12b
mov qword [rsp + 0x60], r12
mov word [rsp + 0x3d], 0x100
mov byte [rsp + 0x3c], r12b
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [rsp + 0x60]
lea rcx, str.BASE:
mov qword [0x140006620], rax
call fcn.140001010
mov rdx, qword [0x140006620]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140002470]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp qword [0x140006620], r12
je 0x1400022ea
xorps xmm6, xmm6
movabs rcx, 0x1424314a8
mov eax, dword [0x140006628]
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
lea rcx, str.win32u.dll
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 8
mov word [rsp + 0x3c], 0x100
mov byte [rsp + 0x3e], r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
call rax
mov eax, dword [0x140006628]
lea rcx, str.win32u.dll
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x70]
add rax, 0xd0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov word [rsp + 0x3c], 0x100
mov byte [rsp + 0x3e], r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
call rax
mov eax, dword [0x140006628]
lea rcx, str.win32u.dll
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x78]
add rax, 0x48
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
mov word [rsp + 0x3c], 0x100
mov byte [rsp + 0x3e], r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
call rax
mov eax, dword [0x140006628]
lea rcx, str.win32u.dll
mov rsi, qword [rbp - 0x80]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], 8
mov word [rsp + 0x3c], 0x100
lea rax, [rsi + 0x780]
mov byte [rsp + 0x3e], r12b
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
call rax
mov eax, dword [0x140006628]
lea rbx, [rsi + 0x4e0]
mov dword [rsp + 0x38], eax
lea rcx, str.win32u.dll
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
mov word [rsp + 0x3c], 0x100
mov byte [rsp + 0x3e], r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
call rax
mov eax, dword [0x140006628]
lea rcx, str.win32u.dll
mov dword [rbp - 0x48], eax
lea rax, [rbp - 0x78]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x50], 8
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x44], 0x100
mov byte [rbp - 0x42], r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x60]
call rax
lea rcx, [rsi + 0x50]
call fcn.140002350
lea rcx, [rax + 0x48]
call fcn.140002350
test rax, rax
je 0x140002102
lea rcx, [rax + 0x10]
call fcn.140002350
test rax, rax
je 0x140002102
lea rcx, [rax + 0x20]
call fcn.1400023e0
jmp 0x140002105
mov edi, dword [rbp - 8]
test rbx, rbx
je 0x140001dd3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001dd3
mov eax, r12d
mov rcx, qword [rbp - 0x78]
mov edx, eax
call fcn.1400013b0
mov rdi, rax
lea rcx, [rax + 0x64]
call fcn.1400023e0
test eax, eax
je 0x140002129
lea rcx, [rdi + 0x60]
call fcn.1400023e0
lea rcx, [rsi + 0x4e8]
call fcn.140002350
lea rcx, [rdi + 0x38]
mov rbx, rax
call fcn.140002350
lea rcx, [rax + 0xb0]
call fcn.1400023e0
lea rcx, [rbx + 0x10]
mov edx, eax
call fcn.1400019b0
lea rcx, [rdi + 0x18]
mov r15, rax
call fcn.140002350
test rax, rax
jne 0x14000216e
mov eax, r12d
jmp 0x1400021a0
lea rcx, [rax + 0x68]
call fcn.140002350
test rax, rax
jne 0x140002181
mov eax, r12d
jmp 0x1400021a0
lea rcx, [rax + 0x20]
call fcn.140002350
test rax, rax
jne 0x140002194
mov eax, r12d
jmp 0x1400021a0
lea rcx, [rax + 0x170]
call fcn.1400023e0
mov rcx, qword [rbp - 0x70]
mov edx, eax
call fcn.140001070
mov rbx, rax
movabs rcx, 0x1424314a8
test rax, rax
je 0x140001eb1
lea rcx, [rdi + 0x3e4]
call fcn.1400023e0
lea rcx, [rbx + 0x3e4]
mov esi, eax
call fcn.1400023e0
lea rcx, [rbx + 0x64]
mov r14d, eax
call fcn.1400023e0
mov edi, eax
movaps xmm0, xmm6
test eax, eax
je 0x140002202
lea rcx, [rbx + 0x60]
call fcn.1400023e0
xor eax, edi
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm6, xmm0
mov eax, r12d
movabs rcx, 0x1424314a8
setae al
test eax, eax
jne 0x140001eb1
cmp esi, r14d
je 0x140001eb1
test r15, r15
je 0x140001eb1
mov ecx, r13d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movabs rcx, 0x1424314a8
test ax, ax
je 0x140001eb1
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x140006628]
lea rcx, str.win32u.dll
mov dword [rsp + 0x38], eax
mov eax, 1
mov word [rsp + 0x48], ax
mov dword [rsp + 0x3c], 0x1000000
mov qword [rsp + 0x40], r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
call rax
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x140006628]
lea rcx, str.win32u.dll
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], 0x1000000
mov qword [rsp + 0x40], r12
mov word [rsp + 0x48], r13w
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenCompositionSurfaceSectionInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
call rax
jmp 0x140001ea7
lea rcx, str.Fuck_n
call fcn.140001010
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400024c0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret