Function at 0x1400848e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x9b0
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14015d040]
xor rax, rsp
mov qword [rbp + 0x948], rax
mov qword [rbp + 0x90], rcx
movabs rax, 0x47c822a1a8e0ad10
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs r14, 0x8d8631998a892888
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs r15, 0x47ad5ac486d2de73
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x770], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x778], rax
movdqa xmm0, xmmword [rbp + 0x770]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x50], xmm0
lea rax, [rbp + 0x50]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x140084990
cmp qword [0x14015d388], 0
jne 0x140084a78
nop word [rax + rax]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x604]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x600], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
lea rdx, [rbp + 0x600]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140084a5c
lea rax, [rbp + 0x62c]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140084a00
mov r8, rdi
cmp rbx, rdi
cmovb r8, rbx
lea rdx, [rbp + 0x62c]
lea rcx, [rbp + 0x50]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140084a2e
cmp rdi, rbx
jb 0x140084a2e
jbe 0x140084a44
lea rdx, [rbp + 0x600]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400849f0
jmp 0x140084a5c
mov ecx, dword [rbp + 0x608]
mov dword [0x14015d380], ecx
call fcn.140082d20
mov qword [0x14015d388], rax
test rsi, rsi
je 0x140084a6a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x14015d388], 0
je 0x1400849b0
movabs r12, 0x22d929bdf5a4bf1d
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs r13, 0x8d8631f5e6ed06e5
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
movdqa xmm0, xmmword [rbp + 0x730]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
lea rax, [rbp + 0x20]
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140084ae6
mov qword [rbp + 0x38], rax
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0xa0], xmm0
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x380]
call fcn.1400830a0
mov rbx, qword [rax]
lea rcx, [rbp + 0x380]
call fcn.14004e290
test rbx, rbx
jne 0x140084c98
movabs rdi, 0x4e94914effff
movabs rsi, 0x431bde82d7b634db
movabs r15, 0x7fffffffe2329afe
movabs r14, 0x7fffffffffffffff
lea rcx, [rbp + 0x120]
call fcn.140049d70
mov rax, qword [rbp + 0x120]
cmp rax, r15
lea rbx, [rax + 0x1dcd6500]
jle 0x140084b74
mov rbx, r14
lea rcx, [rbp + 0x128]
call fcn.140049d70
mov rax, qword [rbp + 0x128]
cmp rbx, rax
je 0x140084bd1
jl 0x140084bd1
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jg 0x140084bc5
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140084bbc
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140084b74
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140084b74
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x47ad5ac486d2de73
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
movabs rax, 0x8d8631998a892888
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
movdqa xmm0, xmmword [rbp + 0x730]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
lea rax, [rbp + 0x20]
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x20]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140084c40
mov qword [rbp + 0x38], rax
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0xa0], xmm0
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x380]
call fcn.1400830a0
mov rbx, qword [rax]
lea rcx, [rbp + 0x380]
call fcn.14004e290
test rbx, rbx
je 0x140084b52
movabs r14, 0x8d8631998a892888
movabs r15, 0x47ad5ac486d2de73
movabs rax, 0x23832eaae3bbb210
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x8d8631998a8944e4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x760], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x768], rax
movdqa xmm0, xmmword [rbp + 0x760]
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x70], xmm0
lea rax, [rbp + 0x70]
mov qword [rbp + 0x220], rax
lea rcx, [rbp + 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140084d10
mov qword [rbp + 0x228], rax
movaps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x370], xmm0
lea rdx, [rbp + 0x370]
lea rcx, [0x14015efc0]
call fcn.1400837c0
test al, al
je 0x140085cd7
movabs rax, 0x699f3faaefb5b016
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x8d8631998ae544ec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x750], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x758], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x750]
movdqa xmmword [rbp + 0x40], xmm0
lea rax, [rbp + 0x40]
mov qword [rbp + 0x230], rax
lea rcx, [rbp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140084dc0
mov qword [rbp + 0x238], rax
movaps xmm0, xmmword [rbp + 0x230]
movdqa xmmword [rbp + 0x360], xmm0
lea rdx, [rbp + 0x360]
lea rcx, [0x14015ef38]
call fcn.1400837c0
test al, al
je 0x140085dcc
movabs rax, 0x3ede3ba9e3babd00
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xe1ea55b7e7ec5cfb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rdi, 0xb34ea0aa01178ebd
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs r13, 0x91cb78c7458881aa
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x840], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x848], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x850], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x858], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x840]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x240], rax
lea rcx, [rbp + 0xc0]
mov rax, 0xffffffffffffffff
vzeroupper
inc rax
cmp byte [rcx + rax], 0
jne 0x140084ed1
mov qword [rbp + 0x248], rax
movaps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x350], xmm0
lea rdx, [rbp + 0x350]
lea rcx, [0x14015efe8]
call fcn.1400837c0
test al, al
je 0x140085f29
movabs rax, 0x69d936b1e7b4bb37
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x8d863199e4e65be2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x780], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x788], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x780]
movdqa xmmword [rbp + 0x60], xmm0
lea rax, [rbp + 0x60]
mov qword [rbp + 0x250], rax
lea rcx, [rbp + 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140084f80
mov qword [rbp + 0x258], rax
movaps xmm0, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x340], xmm0
lea rcx, [rbp + 0x340]
call fcn.14004e870
test al, al
je 0x14008607c
movabs rax, 0x47c85aac86b1de20
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x8df231b78ae828e5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0xb34ea0aa01638ec5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x880], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x888], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x890], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x898], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x880]
vmovdqu ymmword [rbp + 0x160], ymm1
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.140088b40
test al, al
je 0x140086153
call fcn.140083b20
test al, al
je 0x14008622a
cmp byte [0x14015ec50], 0
jne 0x140085093
call fcn.140081a60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, 0x80
mov rcx, qword [0x14015ec30]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.14007d280
movabs rax, 0x2bcc34b6e3a6a636
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xf4e411fcf9e86aa8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xc627c4c56d6fcb9d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xf0a20cae2be1a1c7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0x711fa7c1af856db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xdd798a7bda96dfcd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs r9, 0x261cbeee6010d791
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs r8, 0x33b4f2bbc8ff18e
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x8e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x8e8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x8f0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x8f8], rax
movabs rdx, 0x6f31d6187f823fb7
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x900], rax
movabs rcx, 0xfc17ff1dfaf3a9ac
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x908], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x910], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x918], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x8e0]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x900]
vpxor ymm0, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x200], ymm0
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x260], rax
lea rcx, [rbp + 0x1e0]
mov rax, 0xffffffffffffffff
vzeroupper
inc rax
cmp byte [rcx + rax], 0
jne 0x140085261
mov qword [rbp + 0x268], rax
movaps xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x330], xmm0
lea rcx, [rbp + 0x330]
call fcn.140086440
xor r15d, r15d
movabs rsi, 0xdccf003ada4c08e3
lea r14, [0x14015f038]
mov r12d, 0xee6b2800
movabs rbx, 0x338d3ea1eabbbf15
cmp byte [0x14015ec38], 0
jne 0x140085ca5
lea rcx, [rbp + 0x300]
call fcn.140049d70
mov rcx, qword [rax]
sub rcx, qword [0x14015e9a8]
cmp rcx, r12
jl 0x1400854de
call fcn.14007d280
test al, al
jne 0x1400853eb
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xe8f250fdfafc08e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xc022c1c86e7be99d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x47ad5ac486d2de73
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x920], rax
movabs rax, 0x8d8631998a892888
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x928], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x930], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x938], rax
vmovdqu ymm0, ymmword [rbp + 0x920]
vpxor ymm0, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x100], ymm0
lea rax, [rbp + 0x100]
mov qword [rbp + 0x270], rax
lea rcx, [rbp + 0x100]
mov rax, 0xffffffffffffffff
vzeroupper
inc rax
cmp byte [rcx + rax], 0
jne 0x1400853c0
mov qword [rbp + 0x278], rax
movaps xmm0, xmmword [rbp + 0x270]
movdqa xmmword [rbp + 0x320], xmm0
lea rcx, [rbp + 0x320]
call fcn.140086440
mov qword [rbp + 0x5e8], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x5e8]
mov rdx, qword [0x14015ee90]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp + 0x450]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r15
mov r9d, 0x190
lea r8, [rbp + 0x450]
mov rdx, qword [rbp + 0x5e8]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [0x14015ecf0]
lea rcx, [rbp + 0x450]
mov edx, 3
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140085470
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x310]
call fcn.140049d70
mov rcx, qword [rax]
mov qword [0x14015e9a8], rcx
mov rbx, qword [0x14015eb00]
mov r12d, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r12 + rcx]
cmp dword [0x14015eec4], eax
jle 0x14008553a
lea rcx, [0x14015eec4]
call fcn.1400f63ac
cmp dword [0x14015eec4], 0xffffffff
jne 0x14008553a
movabs rcx, 0xc08c21b68a2c746d
call fcn.14008a470
mov qword [0x14015eee0], rax
lea rcx, [0x14015eec4]
call fcn.1400f6340
mov rdx, qword [0x14015eee0]
add rdx, rbx
mov dword [rbp + 0x5e4], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x5e4]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
mov eax, dword [rbp + 0x5e4]
mov dword [0x14015ecc4], eax
cmp eax, dword [0x14015ecc8]
je 0x140085934
call fcn.140084690
mov rsi, qword [0x14015d368]
mov r14, qword [0x14015d370]
cmp rsi, r14
je 0x14008590d
mov rbx, qword [rsi]
test rbx, rbx
je 0x1400858d7
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [r12 + rdi]
cmp dword [0x14015eed8], eax
jle 0x1400855fa
lea rcx, [0x14015eed8]
call fcn.1400f63ac
cmp dword [0x14015eed8], 0xffffffff
jne 0x1400855fa
movabs rcx, 0xdccf003ada4c08e3
call fcn.14008a470
mov qword [0x14015ecd0], rax
lea rcx, [0x14015eed8]
call fcn.1400f6340
mov rdx, qword [0x14015ecd0]
add rdx, rbx
mov byte [rbp + 0x5e0], 0
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp + 0x5e0]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
cmp byte [rbp + 0x5e0], 0
je 0x1400858d7
mov eax, dword [r12 + rdi]
cmp dword [0x14015eec0], eax
jle 0x14008567b
lea rcx, [0x14015eec0]
call fcn.1400f63ac
cmp dword [0x14015eec0], 0xffffffff
jne 0x14008567b
movabs rcx, 0x5252226c300e74d9
call fcn.14008a470
mov qword [0x14015eed0], rax
lea rcx, [0x14015eec0]
call fcn.1400f6340
mov rdx, qword [0x14015eed0]
add rdx, rbx
mov byte [rbp + 0x5e3], 0
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp + 0x5e3]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
cmp byte [rbp + 0x5e3], 0
jne 0x1400858d7
mov eax, dword [r12 + rdi]
cmp dword [0x14015ec00], eax
jle 0x1400856fc
lea rcx, [0x14015ec00]
call fcn.1400f63ac
cmp dword [0x14015ec00], 0xffffffff
jne 0x1400856fc
movabs rcx, 0x737ddda9e99e0b5d
call fcn.14008a470
mov qword [0x14015ec08], rax
lea rcx, [0x14015ec00]
call fcn.1400f6340
mov rdx, qword [0x14015ec08]
add rdx, rbx
mov dword [rbp + 0x10], 0xffffffff
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x10]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
lea rcx, [rbp + 0x10]
call fcn.14007d3d0
test rax, rax
je 0x1400858d7
mov r8d, dword [0x14015efa0]
mov rcx, qword [0x14015d240]
sub rcx, qword [0x14015d238]
movabs rdi, 0x6666666666666667
mov rax, rdi
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jbe 0x140086301
lea rbx, [r8 + r8*4]
shl rbx, 4
add rbx, 0x10
add rbx, qword [0x14015d238]
je 0x1400857ac
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x1400857ac
add rcx, 8
lea rdx, [0x14015d920]
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x1400857af
mov rbx, r15
cmp byte [rbx], 0
je 0x14008581e
mov ecx, dword [0x14015efa4]
call fcn.140079450
mov ecx, dword [rax]
test ecx, ecx
je 0x14008581e
mov eax, dword [rax + 4]
test eax, eax
jne 0x1400857d4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x1400857df
cmp eax, 1
jne 0x1400857eb
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
test al, al
je 0x14008581e
jmp 0x1400857f0
cmp eax, 2
jne 0x14008581e
mov ecx, dword [0x14015efac]
call fcn.1400793c0
movss xmm0, dword [rax]
movss dword [0x14015eeb8], xmm0
mov ecx, dword [0x14015efa8]
call fcn.1400793c0
movss xmm0, dword [rax]
movss dword [0x14015eebc], xmm0
mov r8d, dword [0x14015efb0]
mov rcx, qword [0x14015d240]
sub rcx, qword [0x14015d238]
mov rax, rdi
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jbe 0x140086306
lea rbx, [r8 + r8*4]
shl rbx, 4
add rbx, 0x10
add rbx, qword [0x14015d238]
je 0x140085884
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x140085884
add rcx, 8
lea rdx, [0x14015d920]
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x140085887
mov rbx, r15
cmp byte [rbx], 0
je 0x1400858d7
mov ecx, dword [0x14015efb4]
call fcn.140079450
mov ecx, dword [rax]
test ecx, ecx
je 0x1400858c1
mov eax, dword [rax + 4]
test eax, eax
jne 0x1400858ac
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x1400858b7
cmp eax, 1
jne 0x1400858e0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
test al, al
jne 0x1400858e5
lea rcx, [rbp + 0xe0]
call fcn.140049d70
mov rcx, qword [rax]
mov qword [0x14015d258], rcx
add rsi, 0x10
jmp 0x140085596
cmp eax, 2
jne 0x1400858c1
mov ecx, dword [0x14015efb8]
call fcn.1400794e0
mov eax, dword [rax]
mov dword [0x14015d250], eax
lea rcx, [rbp + 0x308]
call fcn.140049d70
add rsi, 0x10
jmp 0x140085596
mov eax, dword [0x14015ecc4]
mov dword [0x14015ecc8], eax
movabs rdi, 0xb34ea0aa01178ebd
movabs rsi, 0xdccf003ada4c08e3
lea r14, [0x14015f038]
cmp qword [0x14015f058], 0
je 0x140085946
mov rcx, r14
call fcn.140056ff0
cmp byte [0x14015ec50], 0
je 0x140085ba4
mov r14, qword [0x14015d368]
mov r15, qword [0x14015d370]
cmp r14, r15
je 0x140085b90
mov rdi, qword [r14]
test rdi, rdi
je 0x140085b7d
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov eax, dword [r12 + rbx]
cmp dword [0x14015eed8], eax
jle 0x1400859be
lea rcx, [0x14015eed8]
call fcn.1400f63ac
cmp dword [0x14015eed8], 0xffffffff
jne 0x1400859be
mov rcx, rsi
call fcn.14008a470
mov qword [0x14015ecd0], rax
lea rcx, [0x14015eed8]
call fcn.1400f6340
mov rdx, qword [0x14015ecd0]
add rdx, rdi
mov byte [rbp + 0x5e2], 0
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 1]
lea r8, [rbp + 0x5e2]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
cmp byte [rbp + 0x5e2], sil
je 0x140085b7d
mov eax, dword [r12 + rbx]
cmp dword [0x14015eec0], eax
jle 0x140085a3f
lea rcx, [0x14015eec0]
call fcn.1400f63ac
cmp dword [0x14015eec0], 0xffffffff
jne 0x140085a3f
movabs rcx, 0x5252226c300e74d9
call fcn.14008a470
mov qword [0x14015eed0], rax
lea rcx, [0x14015eec0]
call fcn.1400f6340
mov rdx, qword [0x14015eed0]
add rdx, rdi
mov byte [rbp + 0x5e1], 0
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp + 0x5e1]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
cmp byte [rbp + 0x5e1], 0
jne 0x140085b7d
mov eax, dword [r12 + rbx]
cmp dword [0x14015ec00], eax
jle 0x140085ac0
lea rcx, [0x14015ec00]
call fcn.1400f63ac
cmp dword [0x14015ec00], 0xffffffff
jne 0x140085ac0
movabs rcx, 0x737ddda9e99e0b5d
call fcn.14008a470
mov qword [0x14015ec08], rax
lea rcx, [0x14015ec00]
call fcn.1400f6340
mov rdx, qword [0x14015ec08]
add rdx, rdi
mov dword [rbp + 0x14], 0xffffffff
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x14]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
lea rcx, [rbp + 0x14]
call fcn.14007d3d0
mov rsi, rax
test rax, rax
je 0x140085b7d
mov r8d, dword [0x14015ef68]
mov rcx, qword [0x14015d240]
mov r9, qword [0x14015d238]
sub rcx, r9
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 5
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
cmp rdx, r8
jbe 0x14008630b
lea rbx, [r8 + r8*4]
shl rbx, 4
add rbx, 0x10
add rbx, r9
je 0x140085b6b
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x140085b6b
add rcx, 8
lea rdx, [0x14015d920]
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x140085b6d
xor ebx, ebx
cmp byte [rbx], 0
je 0x140085b7d
mov r8, rsi
mov rdx, rdi
call fcn.140079a80
add r14, 0x10
movabs rsi, 0xdccf003ada4c08e3
jmp 0x140085961
movabs rdi, 0xb34ea0aa01178ebd
xor r15d, r15d
lea r14, [0x14015f038]
xorps xmm0, xmm0
movups xmmword [rbp + 0x5f0], xmm0
lea r12, [0x14015ef00]
mov qword [rbp + 0x5f0], r12
mov rcx, r12
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov byte [rbp + 0x5f8], 1
lea rdx, [0x14015f010]
cmp r14, rdx
je 0x140085c7e
mov rax, qword [0x14015f038]
mov rcx, qword [0x14015f010]
mov qword [0x14015f038], rcx
mov qword [0x14015f010], rax
test rcx, rcx
je 0x140085c06
mov qword [rcx], r14
mov rax, qword [0x14015f010]
test rax, rax
je 0x140085c0e
mov qword [rax], rdx
mov rcx, qword [0x14015f040]
mov rax, qword [0x14015f018]
mov qword [0x14015f040], rax
mov qword [0x14015f018], rcx
mov rcx, qword [0x14015f048]
mov rax, qword [0x14015f020]
mov qword [0x14015f048], rax
mov qword [0x14015f020], rcx
mov rcx, qword [0x14015f050]
mov rax, qword [0x14015f028]
mov qword [0x14015f050], rax
mov qword [0x14015f028], rcx
mov rcx, qword [0x14015f058]
mov rax, qword [0x14015f030]
mov qword [0x14015f058], rax
mov qword [0x14015f030], rcx
mov rcx, r12
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
call fcn.140081680
test al, al
je 0x140085ca7
mov qword [rbp + 8], 1
lea rcx, [rbp + 8]
call fcn.140086370
jmp 0x1400852a0
xor al, al
mov rcx, qword [rbp + 0x948]
xor rcx, rsp
call fcn.1400f5fd0
lea r11, [rsp + 0x9b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movabs rax, 0x338d3ea1eabbbf15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xe1e511edefee08e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0xdf22c4847579ebd4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x91ae14b221e7ec8a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x820], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x828], rax
movabs rax, 0xb34ea0aa01178ebd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x830], rax
movabs r13, 0x91cb78c7458881aa
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x838], rax
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x820]
vmovdqa ymmword [rbp + 0x1a0], ymm1
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x3d8]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a358]
lea rcx, [rbp + 0x3d8]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0x338d3ea1eabbbf15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
movabs rax, 0xe3e311edefee08e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movabs rax, 0xdf2a8e986479e7da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
movabs rax, 0xf4a70da32ae5a1c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movabs rdx, 0x6f31d6187f823fb7
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
movabs rcx, 0xfc17ff1dfaf3a9ac
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7a8], rax
movabs rax, 0xb34ea0aa01178ebd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7b0], rax
movabs r13, 0x91cb78c7458881aa
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7b8], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x7c0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x7c8], rax
vmovdqu ymm0, ymmword [rbp + 0x2c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x7a0]
vmovdqa ymmword [rbp + 0x2c0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x7c0]
vxorps xmm0, xmm0, xmmword [rbp + 0x2e0]
vmovdqa xmmword [rbp + 0x2e0], xmm0
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x3c0]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a358]
lea rcx, [rbp + 0x3c0]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0x338d3ea1eabbbf15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0xeef511edefee08e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
movabs rax, 0xc73dd9d9607aebd5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
movabs rax, 0xfceb14ab21a6eccf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
movabs rax, 0x6f31d67d13f75bd8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
movabs rcx, 0xfc17ff1dfaf3a9ac
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7e8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7f0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7f8], rax
movabs rdx, 0x6f31d6187f823fb7
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x800], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x808], rax
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0x7e0]
vmovdqa ymmword [rbp + 0x280], ymm1
vmovdqa xmm0, xmmword [rbp + 0x800]
vxorps xmm0, xmm0, xmmword [rbp + 0x2a0]
vmovdqa xmmword [rbp + 0x2a0], xmm0
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x3f0]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a358]
lea rcx, [rbp + 0x3f0]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0x338d3ea1eabbbf15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0xadf644edeffa08e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0xb34ec7c36779e1de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x860], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x868], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x870], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x878], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x860]
vmovdqa ymmword [rbp + 0x180], ymm1
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x408]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a358]
lea rcx, [rbp + 0x408]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0x338d3ea1eabbbf15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xfea641f4ffed08e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xb34ed3cb6c72e6de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x8a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x8a8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x8b0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x8b8], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x8a0]
vmovdqa ymmword [rbp + 0x140], ymm1
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x420]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a358]
lea rcx, [rbp + 0x420]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0x338d3ea1eabbbf15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xadf644edeffa08e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0xb33dd4cf7271e8d2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x8c0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x8c8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x8d0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x8d8], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x8c0]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x3a8]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a358]
lea rcx, [rbp + 0x3a8]
call sub.VCRUNTIME140.dll__CxxThrowException
call fcn.140056fd0
call fcn.140056fd0
call fcn.140056fd0
int3