Function at 0x18000a280
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x398]
sub rsp, 0x470
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x1803d3080]
xor rax, rsp
mov qword [rbp + 0x2c8], rax
call fcn.180001b70
mov rcx, rax
test rax, rax
je 0x18000b6c1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
lea rdi, [0x1800138e1]
lea rcx, [rbp - 0x38]
cmp rdi, 0x10000
jae 0x18000a333
movzx edx, di
call fcn.18000d800
jmp 0x18000a33b
mov rdx, rdi
call fcn.18000cec0
movzx ebx, di
call fcn.180001b70
mov rcx, rax
test rax, rax
je 0x18000b6b6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
cmp rdi, 0x10000
jae 0x18000a374
movzx edx, bx
call fcn.18000d800
jmp 0x18000a37d
mov rdx, rdi
call fcn.18000cec0
nop
mov rdi, qword [0x1803d3e68]
xor ebx, ebx
mov qword [rbp + 0x10], rbx
lea edx, [rbx + 8]
lea rcx, [rdi + 0x943f078]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a3b6
lea r8d, [rbx + 8]
lea rdx, [rdi + 0x943f078]
lea rcx, [rbp + 0x10]
call fcn.180002dc0
mov rbx, qword [rbp + 0x10]
lea rdi, [rbx + 0xb8]
xor ebx, ebx
mov qword [rbp + 0x88], rbx
lea edx, [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a3f0
lea r8d, [rbx + 8]
mov rdx, rdi
lea rcx, [rbp + 0x88]
call fcn.180002dc0
mov rbx, qword [rbp + 0x88]
lea rdi, [rbx + 8]
xor ebx, ebx
mov qword [rbp + 0x90], rbx
lea edx, [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a427
lea r8d, [rbx + 8]
mov rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.180002dc0
mov rbx, qword [rbp + 0x90]
lea rdi, [rbx + 0x18]
xor ebx, ebx
mov qword [rbp + 8], rbx
lea edx, [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a455
lea r8d, [rbx + 8]
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.180002dc0
mov rbx, qword [rbp + 8]
mov r13d, 0xffffffff
test rbx, rbx
je 0x18000b612
lea rdi, [rbx + 0x2f8]
xor esi, esi
mov qword [rbp + 0x98], rsi
lea edx, [rsi + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a49e
lea r8d, [r13 + 9]
mov rdx, rdi
lea rcx, [rbp + 0x98]
call fcn.180002dc0
mov rsi, qword [rbp + 0x98]
lea rcx, [rsi + 0x100]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
mov rcx, rbx
call fcn.1800039c0
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.180003b60
lea r15, [rbx + 0xf8]
xor esi, esi
mov qword [rbp + 0xa0], rsi
lea edx, [rsi + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a4fe
lea r8d, [rsi + 8]
mov rdx, r15
lea rcx, [rbp + 0xa0]
call fcn.180002dc0
mov rsi, qword [rbp + 0xa0]
lea rcx, [rsi + 0x70]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
lea r14, [rbx + 0xc8]
xor esi, esi
mov qword [rbp + 0xa8], rsi
lea edx, [rsi + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a547
lea r8d, [rsi + 8]
mov rdx, r14
lea rcx, [rbp + 0xa8]
call fcn.180002dc0
mov rsi, qword [rbp + 0xa8]
lea r12, [rsi + 0xe0]
xor esi, esi
mov qword [rbp + 0xb0], rsi
lea edx, [rsi + 8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a581
lea r8d, [rsi + 8]
mov rdx, r12
lea rcx, [rbp + 0xb0]
call fcn.180002dc0
mov rsi, qword [rbp + 0xb0]
lea rcx, [rsi + 0xb0]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
mov rcx, rbx
call fcn.180003c90
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.180003e10
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x18000a609
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x18000a5fb
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x18000a5fb
call fcn.18000d980
mov rsi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x18000a5f1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x38], rax
jmp 0x18000a609
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x38]
call fcn.18000da70
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000a628
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rsi, qword [rbp + 0x10]
add rsi, 0x40
xor ebx, ebx
mov qword [rbp + 0xb8], rbx
lea edx, [rbx + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a663
lea r8d, [rbx + 8]
mov rdx, rsi
lea rcx, [rbp + 0xb8]
call fcn.180002dc0
mov rbx, qword [rbp + 0xb8]
lea r12, [rbx + 0xb8]
xor ebx, ebx
mov qword [rbp + 0xc0], rbx
lea edx, [rbx + 8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a69d
lea r8d, [rbx + 8]
mov rdx, r12
lea rcx, [rbp + 0xc0]
call fcn.180002dc0
mov rbx, qword [rbp + 0xc0]
lea r12, [rbx + 0x18]
xor ebx, ebx
mov qword [rbp + 0xc8], rbx
lea edx, [rbx + 8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a6d4
lea r8d, [rbx + 8]
mov rdx, r12
lea rcx, [rbp + 0xc8]
call fcn.180002dc0
mov rbx, qword [rbp + 0xc8]
lea rcx, [rbx + 0x18]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
xor ebx, ebx
mov qword [rbp + 0xd0], rbx
lea edx, [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a716
lea r8d, [rbx + 8]
mov rdx, rdi
lea rcx, [rbp + 0xd0]
call fcn.180002dc0
mov rbx, qword [rbp + 0xd0]
mov dword [rbp - 0x1c], 0
mov edx, 4
lea rcx, [rbx + 0x100]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a747
lea r8d, [rax + 4]
lea rdx, [rbx + 0x100]
lea rcx, [rbp - 0x1c]
call fcn.180002dc0
mov rdi, qword [rbp + 8]
mov rcx, rdi
call fcn.1800039c0
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.180003b60
movsd xmm0, qword [rax]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [rax + 8]
mov dword [rsp + 0x28], eax
xor ebx, ebx
mov qword [rbp + 0xd8], rbx
lea edx, [rbx + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a7a3
lea r8d, [rbx + 8]
mov rdx, r15
lea rcx, [rbp + 0xd8]
call fcn.180002dc0
mov rbx, qword [rbp + 0xd8]
xor r15d, r15d
mov dword [rbp - 0x10], r15d
lea edx, [r15 + 4]
lea rcx, [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a7cd
lea r8d, [r15 + 4]
lea rdx, [rbx + 0x70]
lea rcx, [rbp - 0x10]
call fcn.180002dc0
mov rbx, r15
mov qword [rbp + 0xe0], rbx
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a803
lea r8d, [rax + 8]
mov rdx, r14
lea rcx, [rbp + 0xe0]
call fcn.180002dc0
mov rbx, qword [rbp + 0xe0]
lea r14, [rbx + 0xe0]
mov rbx, r15
mov qword [rbp + 0x20], rbx
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a837
lea r8d, [rax + 8]
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.180002dc0
mov rbx, qword [rbp + 0x20]
mov dword [rbp - 4], r15d
mov edx, 4
lea rcx, [rbx + 0xb0]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a865
lea r8d, [rax + 4]
lea rdx, [rbx + 0xb0]
lea rcx, [rbp - 4]
call fcn.180002dc0
mov rcx, rdi
call fcn.180003c90
movss dword [rsp + 0x30], xmm0
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.180003e10
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x18000a8e1
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x18000a8d3
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x18000a8d3
call fcn.18000d980
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x18000a8c9
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x38], rax
jmp 0x18000a8e1
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x38]
call fcn.18000da70
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000a900
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, r15
mov qword [rbp + 0x28], rbx
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a92d
lea r8d, [rax + 8]
mov rdx, rsi
lea rcx, [rbp + 0x28]
call fcn.180002dc0
mov rbx, qword [rbp + 0x28]
lea rdi, [rbx + 0xb8]
mov rbx, r15
mov qword [rbp + 0x30], rbx
mov edx, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a961
lea r8d, [rax + 8]
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.180002dc0
mov rbx, qword [rbp + 0x30]
lea rdi, [rbx + 0x18]
mov rbx, r15
mov qword [rbp + 0x38], rbx
mov edx, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a992
lea r8d, [rax + 8]
mov rdx, rdi
lea rcx, [rbp + 0x38]
call fcn.180002dc0
mov rbx, qword [rbp + 0x38]
mov dword [rbp - 0x30], r15d
mov edx, 4
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a9ba
lea r8d, [rax + 4]
lea rdx, [rbx + 0x18]
lea rcx, [rbp - 0x30]
call fcn.180002dc0
mov edi, dword [rbp - 0x30]
lea eax, [rdi - 1]
cmp eax, 0x1386
ja 0x18000b612
mov qword [rbp + 0x40], r15
mov edx, 8
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a9f3
lea r8d, [rax + 8]
lea rdx, [rbx + 0x10]
lea rcx, [rbp + 0x40]
call fcn.180002dc0
mov r12d, r15d
test edi, edi
je 0x18000b612
movss xmm10, dword [0x1803ce2c0]
movsd xmm13, qword [0x1803ce200]
movsd xmm14, qword [0x1803ce170]
movsd xmm15, qword [0x1803ce178]
movsd xmm12, qword [0x1803ce1b0]
movss xmm11, dword [0x1803ce168]
mov rdi, qword [rbp - 0x28]
nop dword [rax + rax]
lea esi, [r12*8]
add rsi, qword [rbp + 0x40]
mov rbx, r15
mov qword [rbp + 0x18], rbx
mov edx, 8
lea rcx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000aa7b
lea r8d, [rax + 8]
lea rdx, [rsi + 0x20]
lea rcx, [rbp + 0x18]
call fcn.180002dc0
mov rbx, qword [rbp + 0x18]
cmp rbx, 0xffff
jbe 0x18000b603
cmp rbx, qword [rbp + 8]
je 0x18000b603
mov rsi, r15
mov qword [rbp + 0x48], r15
mov edx, 8
lea rcx, [rbx + 0x2f8]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000aac7
lea r8d, [rax + 8]
lea rdx, [rbx + 0x2f8]
lea rcx, [rbp + 0x48]
call fcn.180002dc0
mov rsi, qword [rbp + 0x48]
lea r14, [rsi + 0x100]
mov esi, r15d
mov dword [rbp - 0x20], r15d
mov edx, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000aafa
lea r8d, [rax + 4]
mov rdx, r14
lea rcx, [rbp - 0x20]
call fcn.180002dc0
mov esi, dword [rbp - 0x20]
cmp esi, dword [rbp - 0x1c]
je 0x18000b603
mov dword [rbp - 0x18], r15d
mov edx, 4
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000b603
lea r8d, [rax + 4]
lea rdx, [rbx + 0x38]
lea rcx, [rbp - 0x18]
call fcn.180002dc0
cmp dword [rbp - 0x18], 0x101
jne 0x18000b603
mov dword [rbp - 0x14], r15d
mov edx, 4
lea rcx, [rbx + 0x6c]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000b603
lea r8d, [rax + 4]
lea rdx, [rbx + 0x6c]
lea rcx, [rbp - 0x14]
call fcn.180002dc0
cmp dword [rbp - 0x14], 1
jne 0x18000b603
mov rcx, rbx
call fcn.1800039c0
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.180003b60
movsd xmm2, qword [rax]
mov ecx, dword [rax + 8]
mov dword [rsp + 0x48], ecx
movss xmm0, dword [rsp + 0x20]
subss xmm0, xmm2
andps xmm0, xmm10
cvtps2pd xmm0, xmm0
movss xmm1, dword [rsp + 0x24]
movaps xmm9, xmm2
shufps xmm9, xmm9, 0x55
movsd qword [rsp + 0x40], xmm2
subss xmm1, xmm9
andps xmm1, xmm10
cvtps2pd xmm8, xmm1
movss xmm2, dword [rsp + 0x28]
movd xmm1, ecx
subss xmm2, xmm1
andps xmm2, xmm10
cvtps2pd xmm6, xmm2
movsd xmm1, qword [0x1803ce188]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm7, xmm0
movsd xmm1, qword [0x1803ce188]
movaps xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm8, xmm0
movsd xmm1, qword [0x1803ce188]
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm8, xmm7
addsd xmm8, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm8
ja 0x18000ac2c
xorps xmm6, xmm6
sqrtsd xmm6, xmm8
jmp 0x18000ac38
movaps xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movaps xmm6, xmm0
comisd xmm13, xmm6
jb 0x18000b603
subss xmm9, dword [rsp + 0x24]
andps xmm9, xmm10
movss xmm0, dword [0x1803ce280]
comiss xmm0, xmm9
jb 0x18000b603
mov rsi, r15
mov qword [rbp + 0x50], r15
mov edx, 8
lea rcx, [rbx + 0xf8]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ac95
lea r8d, [rax + 8]
lea rdx, [rbx + 0xf8]
lea rcx, [rbp + 0x50]
call fcn.180002dc0
mov rsi, qword [rbp + 0x50]
mov dword [rbp - 8], r15d
mov edx, 4
lea rcx, [rsi + 0x70]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000acbd
lea r8d, [rax + 4]
lea rdx, [rsi + 0x70]
lea rcx, [rbp - 8]
call fcn.180002dc0
lea rsi, [rbx + 0xc8]
mov r14, r15
mov qword [rbp + 0x58], r15
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000acf1
lea r8d, [rax + 8]
mov rdx, rsi
lea rcx, [rbp + 0x58]
call fcn.180002dc0
mov r14, qword [rbp + 0x58]
lea r15, [r14 + 0xe0]
xor r14d, r14d
mov qword [rbp + 0x60], r14
lea edx, [r14 + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ad24
lea r8d, [r14 + 8]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.180002dc0
mov r14, qword [rbp + 0x60]
mov dword [rbp - 0xc], 0
mov edx, 4
lea rcx, [r14 + 0xb0]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ad55
lea r8d, [rax + 4]
lea rdx, [r14 + 0xb0]
lea rcx, [rbp - 0xc]
call fcn.180002dc0
xor r14d, r14d
mov qword [rbp + 0x68], r14
lea edx, [r14 + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ad81
lea r8d, [r14 + 8]
mov rdx, rsi
lea rcx, [rbp + 0x68]
call fcn.180002dc0
mov r14, qword [rbp + 0x68]
lea r15, [r14 + 0xe0]
xor r14d, r14d
mov qword [rbp + 0x70], r14
lea edx, [r14 + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000adb4
lea r8d, [r14 + 8]
mov rdx, r15
lea rcx, [rbp + 0x70]
call fcn.180002dc0
mov r14, qword [rbp + 0x70]
xor r15d, r15d
mov dword [rbp], r15d
lea edx, [r15 + 4]
lea rcx, [r14 + 0x5c]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000adde
lea r8d, [r15 + 4]
lea rdx, [r14 + 0x5c]
lea rcx, [rbp]
call fcn.180002dc0
mov r14, r15
mov qword [rbp + 0x78], r15
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ae0b
lea r8d, [rax + 8]
mov rdx, rsi
lea rcx, [rbp + 0x78]
call fcn.180002dc0
mov r14, qword [rbp + 0x78]
mov rsi, r15
mov qword [rbp + 0x80], r15
mov edx, 8
lea rcx, [r14 + 0xe0]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ae49
lea r8d, [rax + 8]
lea rdx, [r14 + 0xe0]
lea rcx, [rbp + 0x80]
call fcn.180002dc0
mov rsi, qword [rbp + 0x80]
mov dword [rbp + 4], r15d
mov edx, 4
lea rcx, [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ae71
lea r8d, [rax + 4]
lea rdx, [rsi + 0x58]
lea rcx, [rbp + 4]
call fcn.180002dc0
mov rcx, rbx
call fcn.180003c90
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.180003e10
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x18000aee3
mov eax, dword [rdi + 0x10]
shr eax, 0x1f
test al, al
jne 0x18000aed5
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x18000aed5
call fcn.18000d980
mov rbx, rax
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x18000aecb
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x28], rax
jmp 0x18000aee3
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x28]
call fcn.18000da70
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000af02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movsd xmm0, qword [rsp + 0x20]
movsd qword [rsp + 0x70], xmm0
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x78], eax
movsd xmm0, qword [rsp + 0x40]
movsd qword [rbp - 0x80], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rbp - 0x78], eax
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
mov rcx, qword [rbp + 0x18]
call fcn.180004110
mov r14d, eax
mov ecx, dword [rbp - 0x10]
call fcn.180004450
mov rdi, qword [rbp - 0x28]
mov r15d, dword [rbp - 0xc]
mov esi, dword [rbp - 8]
test eax, eax
je 0x18000b3e0
mov ecx, dword [rbp - 4]
call fcn.180004480
test eax, eax
je 0x18000b3e0
mov rbx, qword [rbp - 0x38]
cmp dword [rbx - 0x10], 0
jl 0x18000afc0
lea rdx, str.shock
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x18000af96
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x18000b3e0
cmp dword [rbx - 0x10], 0
jl 0x18000afc0
lea rdx, str.emptystep
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x18000afc0
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x18000b3e0
cmp byte [0x1803d30e4], 0
je 0x18000b3e0
lea rcx, [rdi - 0x18]
call fcn.18000d980
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x38]
movaps xmm2, xmm6
mov edx, r15d
mov ecx, esi
call fcn.1800047d0
test eax, eax
je 0x18000b3e0
test r14d, r14d
je 0x18000b3e0
mov rbx, qword [rbp + 8]
mov rcx, rbx
call fcn.180003c90
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
comisd xmm1, xmm14
jbe 0x18000b221
mov rcx, rbx
call fcn.180003c90
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
comisd xmm15, xmm1
jb 0x18000b221
xor r15d, r15d
mov qword [rbp + 0xe8], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xfc], xmm0
mov dword [rbp + 0x10c], r15d
mov r14d, 0x47
mov word [rbp + 0xf0], r14w
mov dword [rbp + 0xf4], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0xf8], eax
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp + 0xf2], ax
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0xe8]
lea ecx, [r15 + 1]
call section..data
lea ecx, [r15 + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b120
lea ecx, [r15 + 0xc]
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18c], xmm0
mov qword [rbp + 0x1a4], r15
mov dword [rbp + 0x1ac], r15d
mov dword [rbp + 0x188], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x1a0], eax
mov dword [rbp + 0x19c], 4
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x188]
lea ecx, [r15 + 1]
call section..data
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b195
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b4], xmm0
mov qword [rbp + 0x1cc], r15
mov dword [rbp + 0x1d4], r15d
mov dword [rbp + 0x1b0], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x1c8], eax
mov dword [rbp + 0x1c4], 0x10
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
mov r8d, 0x28
lea rdx, [rbp + 0x1b0]
lea ecx, [r8 - 0x27]
call section..data
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0x110], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x124], xmm0
mov dword [rbp + 0x134], r15d
mov word [rbp + 0x118], r14w
mov dword [rbp + 0x11c], 2
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x120], eax
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp + 0x11a], ax
lea rdx, [rbp + 0x110]
mov rax, qword [0x1803d3e80]
mov r8d, 0x28
mov qword [0x1803d3e58], rax
lea ecx, [r8 - 0x27]
call section..data
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000b603
xor r15d, r15d
mov qword [rbp + 0x138], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x14c], xmm0
mov dword [rbp + 0x15c], r15d
mov r14d, 0x47
mov word [rbp + 0x140], r14w
mov dword [rbp + 0x144], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x148], eax
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp + 0x142], ax
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x138]
lea ecx, [r15 + 1]
call section..data
lea ecx, [r15 + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b307
lea ecx, [r15 + 0xc]
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1dc], xmm0
mov qword [rbp + 0x1f4], r15
mov dword [rbp + 0x1fc], r15d
mov dword [rbp + 0x1d8], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x1f0], eax
mov dword [rbp + 0x1ec], 4
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x1d8]
lea ecx, [r15 + 1]
call section..data
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b37c
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x204], xmm0
mov qword [rbp + 0x21c], r15
mov dword [rbp + 0x224], r15d
mov dword [rbp + 0x200], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x218], eax
mov dword [rbp + 0x214], 0x10
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
mov r8d, 0x28
lea rdx, [rbp + 0x200]
lea ecx, [r8 - 0x27]
call section..data
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0x160], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x174], xmm0
mov dword [rbp + 0x184], r15d
mov word [rbp + 0x168], r14w
mov dword [rbp + 0x16c], 2
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x170], eax
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp + 0x16a], ax
lea rdx, [rbp + 0x160]
jmp 0x18000b1f4
cmp byte [0x1803d30e5], 0
je 0x18000b600
comisd xmm12, xmm6
jbe 0x18000b600
movss xmm0, dword [rsp + 0x30]
comiss xmm0, xmm11
jbe 0x18000b600
mov ebx, dword [rbp]
cmp ebx, 1
jne 0x18000b509
cmp esi, 0x74
mov ecx, 0xb9
je 0x18000b423
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18000b499
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x22c], xmm0
xor r15d, r15d
mov qword [rbp + 0x244], r15
mov dword [rbp + 0x24c], r15d
mov dword [rbp + 0x228], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x240], eax
mov dword [rbp + 0x23c], 4
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x228]
lea ecx, [r15 + 1]
call section..data
jmp 0x18000b603
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18000b509
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x254], xmm0
xor r15d, r15d
mov qword [rbp + 0x26c], r15
mov dword [rbp + 0x274], r15d
mov dword [rbp + 0x250], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x268], eax
mov dword [rbp + 0x264], 0x10
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x250]
lea ecx, [r15 + 1]
call section..data
jmp 0x18000b603
cmp dword [rbp + 4], 0xc
jne 0x18000b600
cmp r15d, 0x14
je 0x18000b600
cmp ebx, 1
je 0x18000b600
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18000b593
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x27c], xmm0
xor r15d, r15d
mov qword [rbp + 0x294], r15
mov dword [rbp + 0x29c], r15d
mov dword [rbp + 0x278], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x290], eax
mov dword [rbp + 0x28c], 4
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x278]
lea ecx, [r15 + 1]
call section..data
jmp 0x18000b603
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
xor r15d, r15d
test ax, ax
jns 0x18000b603
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2a4], xmm0
mov qword [rbp + 0x2bc], r15
mov dword [rbp + 0x2c4], r15d
mov dword [rbp + 0x2a0], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x2b8], eax
mov dword [rbp + 0x2b4], 0x10
mov rax, qword [0x1803d3e80]
mov qword [0x1803d3e58], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x2a0]
lea ecx, [r15 + 1]
call section..data
jmp 0x18000b603
xor r15d, r15d
inc r12d
cmp r12d, dword [rbp - 0x30]
jb 0x18000aa40
jmp 0x18000b616
mov rdi, qword [rbp - 0x28]
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000b631
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x18000b64e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x2c8]
xor rcx, rsp
call fcn.1800100e0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.1800019d0
nop
mov ecx, 0x80004005
call fcn.1800019d0
int3