Function at 0x18000cf60
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x210
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x1800e8740]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r15, rcx
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
lea r8d, [r12 + 0xa]
lea rdx, str.triggerbot
lea rcx, [rsp + 0x38]
call fcn.180008080
lea rdx, [rsp + 0x38]
lea rcx, [0x1800ebb68]
call fcn.180014a20
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
lea r8d, [r12 + 7]
lea rdx, str.enabled
lea rcx, [rbp + 0x20]
call fcn.180008080
nop
cmp byte [rdi], 1
jne 0x18000d6d6
mov rsi, qword [rdi + 8]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
mov rcx, rsi
call fcn.18001c090
mov rbx, qword [rbp + 0x50]
cmp byte [rbx + 0x19], r12b
jne 0x18000d043
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x20]
call fcn.18001ed20
test al, al
je 0x18000d046
mov rbx, qword [rsi]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18000d081
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d07c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d714
call fcn.180082a80
cmp byte [rbx + 0x40], 4
jne 0x18000d71a
cmp byte [rbx + 0x48], 0
je 0x18000d659
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov r8d, 3
lea rdx, [0x1800d469c]
lea rcx, [rbp + 0x20]
call fcn.180008080
nop
cmp byte [rdi], 1
jne 0x18000d698
mov rsi, qword [rdi + 8]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
mov rcx, rsi
call fcn.18001c090
mov rbx, qword [rbp + 0x50]
cmp byte [rbx + 0x19], 0
jne 0x18000d0f3
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x20]
call fcn.18001ed20
test al, al
je 0x18000d0f6
mov rbx, qword [rsi]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18000d131
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d12c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d758
call fcn.180082a80
lea rcx, [rbx + 0x40]
call fcn.1800123a0
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000d659
lea rcx, [rbp + 0x80]
call fcn.180021380
nop
cmp byte [rbp + 0xc8], 0
jne 0x18000d169
mov rbx, r12
jmp 0x18000d217
call fcn.180020f50
cmp byte [rbp + 0xc8], 0
je 0x18000d75e
mov rbx, qword [rbp + 0xb8]
add rbx, rax
mov dword [rbp + 0x68], r12d
lea rdx, [rbx + 3]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x68]
mov rcx, qword [0x1800ebab8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsxd rax, dword [rbp + 0x68]
add rax, 7
add rbx, rax
cmp byte [rbp + 0xc8], 0
je 0x18000d217
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x18000d1fe
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d1f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d764
call fcn.180082a80
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov qword [rbp + 0x70], r12
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x70]
mov rdx, rbx
mov rcx, qword [0x1800ebab8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x70]
test rbx, rbx
je 0x18000d659
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov r8d, ntohs
lea rdx, str.dead_target
lea rcx, [rbp + 0x20]
call fcn.180008080
nop
cmp byte [rdi], 1
jne 0x18000d88a
mov r14, qword [rdi + 8]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
mov rcx, r14
call fcn.18001c090
mov rsi, qword [rbp + 0x50]
cmp byte [rsi + 0x19], 0
jne 0x18000d2a5
lea r8, [rsi + 0x20]
lea rdx, [rbp + 0x20]
call fcn.18001ed20
test al, al
je 0x18000d2a8
mov rsi, qword [r14]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18000d2e3
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d2de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d76a
call fcn.180082a80
cmp byte [rsi + 0x40], 4
jne 0x18000d770
cmp byte [rsi + 0x48], 0
je 0x18000d32f
lea rdx, [rbx + 0x280]
mov dword [rbp + 0x60], 0
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x60]
mov rcx, qword [0x1800ebab8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [0x1800d6380]
comiss xmm0, dword [rbp + 0x60]
ja 0x18000d659
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov r8d, 4
lea rdx, str.npcs
lea rcx, [rbp + 0x20]
call fcn.180008080
nop
cmp byte [rdi], 1
jne 0x18000d84c
mov r14, qword [rdi + 8]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
mov rcx, r14
call fcn.18001c090
mov rsi, qword [rbp + 0x50]
cmp byte [rsi + 0x19], 0
jne 0x18000d38d
lea r8, [rsi + 0x20]
lea rdx, [rbp + 0x20]
call fcn.18001ed20
test al, al
je 0x18000d390
mov rsi, qword [r14]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18000d3cb
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d3c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d7ad
call fcn.180082a80
cmp byte [rsi + 0x40], 4
jne 0x18000d7b3
cmp byte [rsi + 0x48], 0
jne 0x18000d436
call fcn.180021150
mov qword [rsp + 0x20], r12
mov r9d, 8
mov rcx, qword [0x1800ebab8]
cmp eax, 0xaf2
jle 0x18000d414
lea rdx, [rbx + 0x10a0]
mov qword [rbp + 0x60], r12
lea r8, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x60]
jmp 0x18000d42d
lea rdx, [rbx + 0x10c8]
mov qword [rbp + 0x20], r12
lea r8, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x18000d659
lea rdx, [rbx + 0x30]
mov qword [rbp + 0x40], r12
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x40]
mov rcx, qword [0x1800ebab8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x40]
test rdx, rdx
je 0x18000d659
add rdx, 0x50
xor eax, eax
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], eax
mov qword [rsp + 0x20], r12
lea r9d, [rax + 0xc]
lea r8, [rbp + 0x20]
mov rcx, qword [0x1800ebab8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [r15]
movss xmm0, dword [rbp + 0x20]
subss xmm0, dword [rbx]
cvtps2pd xmm0, xmm0
movsd xmm6, qword [0x1800d6390]
movaps xmm1, xmm6
call fcn.1800aff60
movaps xmm7, xmm0
movss xmm2, dword [rbp + 0x24]
subss xmm2, dword [rbx + 4]
cvtps2pd xmm0, xmm2
movaps xmm1, xmm6
call fcn.1800aff60
movaps xmm8, xmm0
movss xmm2, dword [rbp + 0x28]
subss xmm2, dword [rbx + 8]
cvtps2pd xmm0, xmm2
movaps xmm1, xmm6
call fcn.1800aff60
addsd xmm8, xmm7
addsd xmm8, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm8
ja 0x18000d4fc
xorps xmm0, xmm0
sqrtsd xmm0, xmm8
jmp 0x18000d505
movaps xmm0, xmm8
call fcn.1800b15f4
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov r8d, 8
lea rdx, str.distance
lea rcx, [rbp + 0x20]
call fcn.180008080
nop
cmp byte [rdi], 1
jne 0x18000d810
mov rsi, qword [rdi + 8]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
mov rcx, rsi
call fcn.18001c090
mov rbx, qword [rbp + 0x50]
cmp byte [rbx + 0x19], 0
jne 0x18000d56a
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x20]
call fcn.18001ed20
test al, al
je 0x18000d56d
mov rbx, qword [rsi]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x18000d5a8
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d5a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d7f0
call fcn.180082a80
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xor eax, eax
mov qword [rbp + 0x48], rax
movzx edx, byte [rbp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.180010fa0
mov byte [rbp + 0x40], 7
cvtps2pd xmm0, xmm6
movsd qword [rbp + 0x48], xmm0
lea r8, [rbp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x40]
call fcn.1800145c0
nop
movzx edx, byte [rbp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.180010fa0
nop
cmp byte [rsp + 0x30], 0xff
je 0x18000d659
mov ecx, 8
call fcn.180082b6c
mov qword [rax], rdi
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x18001c060]
xor edx, edx
xor ecx, ecx
call fcn.18008d76c
mov qword [rbp + 0x20], rax
test rax, rax
je 0x18000d801
cmp dword [rbp + 0x28], 0
je 0x18000d7f6
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x40]
call fcn.1800824b8
test eax, eax
jne 0x18000d7f6
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.180082a60
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, rdi
call fcn.1800109a0
mov qword [rbp + 0x40], rax
lea r8, [rbp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.18001ac30
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rsp + 0x58]
call fcn.180012840
lea rdx, [0x1800e56a0]
lea rcx, [rsp + 0x58]
call fcn.180084f48
nop
mov rcx, rdi
call fcn.1800109a0
mov qword [rbp + 0x40], rax
lea r8, [rbp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.18001ac30
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rsp + 0x58]
call fcn.180012840
lea rdx, [0x1800e56a0]
lea rcx, [rsp + 0x58]
call fcn.180084f48
nop
call fcn.180090f24
int3
lea rcx, [rbx + 0x40]
call fcn.1800109a0
mov qword [rbp + 0x40], rax
lea r8, [rbp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.1800204b0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x50]
call fcn.180012840
lea rdx, [0x1800e56a0]
lea rcx, [rbp - 0x50]
call fcn.180084f48
nop
call fcn.180090f24
nop
call fcn.1800210c0
nop
call fcn.180090f24
int3
call fcn.180090f24
int3
lea rcx, [rsi + 0x40]
call fcn.1800109a0
mov qword [rbp + 0x40], rax
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.1800204b0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x50]
call fcn.180012840
lea rdx, [0x1800e56a0]
lea rcx, [rbp - 0x50]
call fcn.180084f48
nop
call fcn.180090f24
int3
lea rcx, [rsi + 0x40]
call fcn.1800109a0
mov qword [rbp + 0x40], rax
lea r8, [rbp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.1800204b0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x18]
call fcn.180012840
lea rdx, [0x1800e56a0]
lea rcx, [rbp - 0x18]
call fcn.180084f48
nop
call fcn.180090f24
nop
mov ecx, 1
call fcn.1800801e0
nop
mov dword [rbp + 0x28], r12d
mov ecx, 6
call fcn.1800801e0
nop
mov rcx, rdi
call fcn.1800109a0
mov qword [rbp + 0x40], rax
lea r8, [rbp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.18001ac30
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp - 0x18]
call fcn.180012840
lea rdx, [0x1800e56a0]
lea rcx, [rbp - 0x18]
call fcn.180084f48
nop
mov rcx, rdi
call fcn.1800109a0
mov qword [rbp + 0x40], rax
lea r8, [rbp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.18001ac30
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rsp + 0x58]
call fcn.180012840
lea rdx, [0x1800e56a0]
lea rcx, [rsp + 0x58]
call fcn.180084f48
nop
mov rcx, rdi
call fcn.1800109a0
mov qword [rbp + 0x40], rax
lea r8, [rbp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.18001ac30
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rsp + 0x58]
call fcn.180012840
lea rdx, [0x1800e56a0]
lea rcx, [rsp + 0x58]
call fcn.180084f48
int3