Function at 0x140030a30
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
movaps xmmword [rsp + 0x3c0], xmm6
mov rax, qword [0x14003f010]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov dword [rsp + 0x60], r9d
mov r13, rcx
mov qword [rsp + 0x68], rcx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x1400395fc]
lea rdx, str.CONOUT_
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x140030b02
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x70], eax
je 0x140030b02
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x1400395fc]
lea rdx, str.CONOUT_
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
xorps xmm0, xmm0
mov qword [rbp - 0x20], 0
lea rax, [0x140031550]
movdqa xmmword [rbp], xmm0
mov edx, 0x7f00
mov qword [rbp - 0x28], rax
xor ecx, ecx
mov qword [rbp - 0x10], 0
mov qword [rbp + 0x18], 0
mov qword [rbp - 0x30], 0x50
mov qword [rbp - 0x18], r13
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
lea rax, str.External_Overlay_Class
mov qword [rbp + 0x10], rax
call qword [sym.imp.USER32.dll_RegisterClassExA]
xor r12d, r12d
lea rcx, [rbp + 0x24]
xor r15d, r15d
mov qword [rbp + 0x270], r12
xor edx, edx
mov qword [rbp + 0x278], r15
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rbp + 0x20], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32Next]
lea r14, [r12 - 1]
test eax, eax
je 0x140030c1c
nop
lea rax, [rbp + 0x4c]
mov rbx, r14
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140030bb7
mov r8d, 7
lea rdx, [rbp + 0x4c]
cmp rbx, r8
lea rcx, str.cs2.exe
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140030be7
cmp rbx, 7
je 0x140030bfa
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140030bb0
jmp 0x140030c1c
mov r12d, dword [rbp + 0x28]
xor edx, edx
mov r8d, r12d
mov qword [rbp + 0x270], r12
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x278], rax
test rdi, rdi
je 0x140030c2a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsd xmm6, qword [0x140039740]
movabs r13, 0x311cdad160000
movabs r15, 0x7fffffffffffffff
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x24]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
mov edx, r12d
mov dword [rbp + 0x20], 0x238
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x20]
xor esi, esi
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x140030cde
nop dword [rax]
lea rax, [rbp + 0x50]
mov rbx, r14
inc rbx
cmp byte [rax + rbx], sil
jne 0x140030c97
mov r8d, 0xa
lea rdx, [rbp + 0x50]
cmp rbx, r8
lea rcx, str.client.dll
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140030cc7
cmp rbx, 0xa
je 0x140030cda
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140030c90
jmp 0x140030cde
mov rsi, qword [rbp + 0x38]
test rdi, rdi
je 0x140030cec
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14003f6a8], rsi
test rsi, rsi
jne 0x140030e26
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140030d1a
imul rax, rax, 0x64
jmp 0x140030d38
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffc46535fe
lea rdi, [rax + 0x3b9aca00]
cmp rax, rcx
jle 0x140030d51
mov rdi, r15
movabs r14, 0x112e0be826d694b3
nop dword [rax + rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140030d7e
imul rbx, rax, 0x64
jmp 0x140030d9f
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rdi, rbx
je 0x140030e11
jl 0x140030e11
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x140030dcd
mov rax, r13
lea r8, [rcx + r13]
jmp 0x140030dd1
lea r8, [rax + rcx]
add rcx, rax
mov rax, r14
imul rcx
lea rcx, [rbp + 0x260]
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rbp + 0x260], rdx
sub r8d, eax
mov dword [rbp + 0x268], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140030d60
cmp qword [0x14003f6a8], 0
mov r14, 0xffffffffffffffff
je 0x140030c50
mov r13, qword [rsp + 0x68]
lea r8, [0x14003366e]
mov rdx, qword [rbp + 0x10]
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov r9d, 0x80000000
mov qword [rsp + 0x50], r13
mov ecx, 0x80028
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 0x438
mov dword [rsp + 0x30], 0x780
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r9d, [r12 + 1]
xor r8d, r8d
mov rcx, rax
mov qword [0x14003f6c8], rax
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rax, qword [0x14003f6c8]
lea edx, [r12 + 1]
mov qword [rbp - 0x50], rax
xor r9d, r9d
lea rax, [0x14003f6b0]
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rsp + 0x50], r12
lea rax, [0x14003f6d0]
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [0x14003f6b8]
mov qword [rbp - 0x6c], r12
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov dword [rbp - 0x60], r12d
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x44], r12
mov dword [rbp - 0x3c], r12d
mov dword [rbp - 0x80], 0x780
mov dword [rbp - 0x7c], 0x438
mov dword [rbp - 0x70], 0x1c
mov dword [rbp - 0x5c], 0x20
mov dword [rbp - 0x64], 1
mov dword [rbp - 0x48], 1
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
mov r15, qword [rbp + 0x278]
test eax, eax
jne 0x140031507
mov rcx, qword [0x14003f6b8]
lea r9, [rsp + 0x68]
lea r8, [0x140039638]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [0x14003f6d0]
lea r9, [0x14003f6c0]
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14003f6b0]
lea r8, [0x14003f6c0]
xor r9d, r9d
lea edx, [r12 + 1]
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rbx, qword [0x14003f698]
test rbx, rbx
je 0x140030fbc
inc dword [rbx + 0xf4]
mov ecx, 0x5e28
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140030fd8
xor edx, edx
mov rcx, rax
call fcn.1400012b0
jmp 0x140030fdb
mov rax, r12
mov qword [0x14003f698], rax
call fcn.140004c60
mov rax, qword [0x14003f698]
test rbx, rbx
mov rcx, qword [0x14003f6c8]
cmovne rax, rbx
mov qword [0x14003f698], rax
mov qword [rax + 0x20], r12
call fcn.14002a880
mov rdi, qword [0x14003f698]
mov r14, qword [0x14003f6b0]
mov rsi, qword [0x14003f6d0]
test rdi, rdi
je 0x14003102c
inc dword [rdi + 0xf4]
mov ecx, 0x78
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14003106d
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov dword [rax + 0x70], 0x1388
mov dword [rax + 0x74], 0x2710
jmp 0x140031070
mov rbx, r12
or dword [rdi + 0xc], 8
lea rax, str.imgui_impl_dx11
mov qword [rdi + 0x90], rax
lea r8, [rsp + 0x70]
mov qword [rdi + 0xa0], rbx
lea rdx, [0x140039398]
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r12
mov qword [rbp + 0x260], r12
call qword [rax]
test eax, eax
jne 0x1400310fc
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x68]
lea rdx, [0x1400393a8]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x1400310fc
mov rcx, qword [rsp + 0x68]
lea r8, [rbp + 0x260]
lea rdx, [0x1400393b8]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x1400310fc
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov rax, qword [rbp + 0x260]
mov qword [rbx + 0x10], rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14003110c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003111c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 8]
mov edx, dword [rsp + 0x60]
mov rcx, qword [0x14003f6c8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14003f6c8]
call qword [sym.imp.USER32.dll_UpdateWindow]
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
nop word [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x280]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x1400311b0
lea rcx, [rbp + 0x280]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x280]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x1400313a3
mov rcx, qword [0x14003f6b0]
lea r8, [0x140039650]
mov rdx, qword [0x14003f6c0]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14003120a
cmp byte [0x14003f703], r12b
jne 0x14003120a
cmp byte [0x14003f700], r12b
mov rcx, qword [0x14003f6c8]
sete byte [0x14003f700]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov byte [0x14003f703], 1
jmp 0x14003124c
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14003124c
mov rcx, qword [0x14003f6c8]
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov rcx, qword [0x14003f6c8]
mov edx, 0xffffffec
or rax, 0x20
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov byte [0x14003f703], r12b
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x1400314fd
mov rax, qword [0x14003f698]
test rax, rax
je 0x140031274
mov rcx, qword [rax + 0xa0]
jmp 0x140031277
mov rcx, r12
cmp qword [rcx + 0x48], r12
jne 0x140031282
call fcn.14002a220
call fcn.14002b1f0
call fcn.140006db0
cmp byte [0x14003f700], r12b
je 0x14003132a
mov rcx, qword [0x14003f6c8]
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov rcx, qword [0x14003f6c8]
mov edx, 0xffffffec
and rax, 0xffffffffffffffdf
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov rax, qword [0x14003f698]
lea rcx, str.Menu
xor edx, edx
mov r8d, 0x122
or dword [rax + 0x47a8], 2
mov dword [rax + 0x47c8], 0x43fa0000
mov dword [rax + 0x47cc], 0x43960000
mov dword [rax + 0x47b0], 1
call fcn.14000bce0
lea rdx, [0x14003f702]
lea rcx, str.Boxes
call fcn.14002f540
lea rdx, [0x14003f701]
lea rcx, str.Snaplines
call fcn.14002f540
cmp byte [0x14003f702], r12b
jne 0x14003133c
cmp byte [0x14003f701], r12b
je 0x140031348
lea rcx, [rbp + 0x270]
call fcn.140030300
call fcn.140008eb0
mov rcx, qword [0x14003f6b0]
lea r8, [0x14003f6c0]
xor r9d, r9d
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rax, qword [0x14003f698]
mov rcx, qword [rax + 0x48a8]
mov rax, qword [rcx]
mov rcx, r12
add rax, 0x48
cmp byte [rax], r12b
cmovne rcx, rax
call fcn.1400297b0
mov rcx, qword [0x14003f6b8]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 1]
call qword [rax + 0x40]
cmp dword [rbp + 0x288], 0x12
jne 0x140031170
mov rbx, qword [0x14003f698]
test rbx, rbx
je 0x1400313c5
mov rdi, qword [rbx + 0xa0]
jmp 0x1400313c8
mov rdi, r12
call fcn.14002a760
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400313dc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400313ea
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400313f9
mov rax, qword [rcx]
call qword [rax + 0x10]
and dword [rbx + 0xc], 0xfffffff7
mov rax, qword [0x14003f698]
mov qword [rbx + 0x90], r12
mov qword [rbx + 0xa0], r12
test rax, rax
je 0x14003141d
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x14003f698]
test rax, rax
je 0x14003143b
mov rdi, qword [rax + 0x98]
jmp 0x14003143e
mov rdi, r12
mov rcx, qword [rdi + 0x30]
lea rbx, [rax + 8]
test rcx, rcx
je 0x140031458
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x14003f698]
and dword [rbx + 4], 0xfffffff8
mov qword [rbx + 0x80], r12
mov qword [rbx + 0x90], r12
test rax, rax
je 0x140031475
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x14003f698]
mov qword [0x14003f698], rbx
call fcn.140005070
mov qword [0x14003f698], r12
test rbx, rbx
je 0x1400314c0
mov rcx, rbx
call fcn.140019310
mov rax, qword [0x14003f698]
test rax, rax
je 0x1400314b7
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14003f6c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14003f6b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14003f6b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14003f6d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r14d, dword [rbp + 0x290]
jmp 0x140031500
mov r14d, r12d
mov r15, qword [rbp + 0x278]
test r15, r15
je 0x140031515
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1400315f0
mov rbx, qword [rsp + 0x418]
movaps xmm6, xmmword [rsp + 0x3c0]
add rsp, 0x3d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret