Function at 0x1400512f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400a7010]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor r15d, r15d
mov r14d, r15d
mov dword [rsp + 0x30], r15d
mov ecx, dword [0x1400a7d10]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400513b0
mov eax, r15d
cmp dword [0x140106ec8], r15d
sete al
mov dword [0x140106ec8], eax
xor ecx, ecx
test eax, eax
je 0x140051365
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [r15 + 0x69]
jmp 0x140051370
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x6a
mov r8d, 0x40005
mov rdx, rax
call qword [sym.imp.WINMM.dll_PlaySoundW]
mov ecx, dword [0x1400a7d10]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400513b0
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x1400a7d10]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140051392
mov ecx, dword [0x1400a7c68]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140051402
cmp byte [0x140106f04], r14b
sete byte [0x140106f04]
mov ecx, dword [0x1400a7c68]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140051402
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x1400a7c68]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x1400513e4
mov ecx, dword [0x1400a7d14]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x14005149e
call fcn.140052110
test al, al
jne 0x140051437
mov ecx, 0x46
call fcn.1400511e0
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0xc8
mov ecx, 0x578
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x46
call fcn.1400511e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x1400a7c78]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140051502
movzx ecx, word [0x1400a7c58]
call fcn.1400511e0
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, str.reconnect
mov al, 0x72
lea rbx, [rbx + 1]
movzx ecx, al
call qword [sym.imp.USER32.dll_VkKeyScanA]
movzx ecx, ax
call fcn.1400511e0
movzx eax, byte [rbx]
test al, al
jne 0x1400514d1
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xd
call fcn.1400511e0
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140051572
xor r9d, r9d
xor edx, edx
mov cl, 0x57
cmp byte [0x140106f10], r14b
je 0x140051532
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor al, al
jmp 0x14005153d
xor r8d, r8d
call qword [sym.imp.USER32.dll_keybd_event]
mov al, 1
mov byte [0x140106f10], al
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140051572
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140051555
mov ecx, dword [0x1400a7c60]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rdi, 0xffffffffffffffff
lea r13, [0x140099f48]
lea rbx, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea rsi, vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
bt ax, 0xf
jae 0x140051982
call fcn.140052110
test al, al
jne 0x1400515c1
lea ecx, [rdi + 0x47]
call fcn.1400511e0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0xf0
lea rcx, [rsp + 0x60]
call fcn.1400593c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
lea rdx, str.i.e__flint__stone
mov r8, rdi
nop
inc r8
cmp byte [rdx + r8], r14b
jne 0x1400515f0
lea rcx, [rsp + 0x38]
call fcn.14003e510
nop
mov qword [rsp + 0x60], r13
mov qword [rbp - 8], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp - 0x10], rbx
mov r14d, 1
mov dword [rsp + 0x30], r14d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.140054860
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rsp + rcx + 0x5c], edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rsi
lea ecx, [r14 + 0xf]
call fcn.1400564ec
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movzx ecx, r14b
call fcn.140057530
mov qword [rbx + 8], rax
mov qword [rbp - 0x30], rbx
lea rax, [rsp + 0x78]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x44]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x48], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x68], r15
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
lea r9d, [r14 + 1]
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140054ab0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140051746
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051741
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051e61
call fcn.14005602c
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140055270
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x1400518b5
xor sil, sil
nop word [rax + rax]
mov edx, 0xc5
mov ecx, 0x4f9
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
test sil, sil
je 0x1400517e7
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rbx, qword [rsp + 0x38]
movzx eax, byte [rbx]
test al, al
je 0x14005181c
nop
lea rbx, [rbx + 1]
movzx ecx, al
call qword [sym.imp.USER32.dll_VkKeyScanA]
movzx ecx, ax
call fcn.1400511e0
movzx eax, byte [rbx]
test al, al
jne 0x140051800
test sil, sil
je 0x14005182c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0xc5
mov ecx, 0x593
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov sil, 1
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140055270
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x1400518ae
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140051790
lea rsi, vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov edx, 0x21c
mov ecx, 0x3c0
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14005190f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051909
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051e61
call fcn.14005602c
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x70]
call fcn.1400542e0
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x5c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x10]
call fcn.140057808
nop
lea rbx, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov ecx, dword [0x1400a7cc0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140051d24
call fcn.140052110
test al, al
jne 0x1400519b7
mov ecx, 0x46
call fcn.1400511e0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0xf0
lea rcx, [rsp + 0x60]
call fcn.1400593c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
lea rdx, str.i.e__metal
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1400519e2
mov r8, rdi
lea rcx, [rsp + 0x38]
call fcn.14003e510
nop
mov qword [rsp + 0x60], r13
mov qword [rbp - 8], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp - 0x10], rbx
or r14d, 2
mov dword [rsp + 0x30], r14d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.140054860
nop
mov rax, qword [rsp + 0x60]
movsxd rdx, dword [rax + 4]
lea r14, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rdx + 0x60], r14
mov rax, qword [rsp + 0x60]
movsxd rdx, dword [rax + 4]
lea r8d, [rdx - 0x90]
mov dword [rsp + rdx + 0x5c], r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rsi
mov ecx, 0x10
call fcn.1400564ec
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov cl, 1
call fcn.140057530
mov qword [rbx + 8], rax
mov qword [rbp - 0x30], rbx
lea rax, [rsp + 0x78]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x44]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x48], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x68], r15
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
mov r9d, 2
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140054ab0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140051b3c
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051b37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051e5b
call fcn.14005602c
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov edi, 5
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140055270
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x140051c65
nop dword [rax]
mov edx, 0xc5
mov ecx, 0x4f9
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
lea rbx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rbx, qword [rsp + 0x38]
movzx eax, byte [rbx]
test al, al
je 0x140051bfc
nop dword [rax]
lea rbx, [rbx + 1]
movzx ecx, al
call qword [sym.imp.USER32.dll_VkKeyScanA]
movzx ecx, ax
call fcn.1400511e0
movzx eax, byte [rbx]
test al, al
jne 0x140051be0
mov edx, 0xc5
mov ecx, 0x562
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
add edi, 2
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140055270
mov rdx, qword [rax]
movsxd r8, dword [rdx + 4]
test byte [r8 + rax + 0x10], 6
je 0x140051b80
mov edx, 0x21c
mov ecx, 0x3c0
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140051cbf
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051cb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051e5b
call fcn.14005602c
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x60], r14
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x70]
call fcn.1400542e0
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x5c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x10]
call fcn.140057808
nop
mov ecx, 0x13
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x140051e2e
cmp dword [0x140106f00], 0
jne 0x140051d62
lea rdx, str.ArkAscended.exe
lea rcx, [rsp + 0x38]
call fcn.14003ef90
mov rcx, rax
call fcn.140051f00
mov dword [0x140106f00], eax
cmp byte [0x140106f12], 0
je 0x140051d98
mov rcx, qword [0x140106f78]
test rcx, rcx
je 0x140051d91
mov qword [rsp + 0x58], r15
mov r9d, 8
lea r8, [rsp + 0x58]
lea edx, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor al, al
jmp 0x140051e1d
mov rax, qword [0x140106f78]
test rax, rax
jne 0x140051dba
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov qword [0x140106f78], rax
test rax, rax
je 0x140051e1b
mov dword [rsp + 0x58], 5
mov dword [rsp + 0x5c], 0x12c
mov r9d, 8
lea r8, [rsp + 0x58]
lea edx, [r9 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x140051e1b
mov r8d, dword [0x140106f00]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140051e1b
mov rdx, rax
mov rcx, qword [0x140106f78]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov byte [0x140106f12], al
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140055d70
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140067d04
nop
call fcn.140067d04
int3