Function at 0x140008ac0
Capabilities:
Acquire debug privileges
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x480
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rbp + 0x420], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call fcn.1400f9408
mov r8, rax
lea rdx, [0x140148158]
lea rcx, str.CONOUT_
call fcn.1400f92b8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, str.SeSecurityPrivilege
call fcn.140008a10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [0x140148180]
call fcn.140008a10
xor edx, edx
mov r8d, 0x398
lea rcx, [rbp + 0x40]
call fcn.14012ade0
lea rcx, [rbp + 0x40]
call fcn.14007f2a0
mov ecx, 0x80
call fcn.1400f3140
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov rcx, rax
call fcn.140020710
xor r13d, r13d
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov ecx, 0x48
call fcn.1400f3140
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x20], r13
mov qword [rdi + 0x28], r13
mov ecx, 0x48
call fcn.1400f3140
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x30], r13
mov qword [rdi + 0x38], r13
mov qword [rdi + 0x40], r13
mov qword [rdi + 0x48], r13
mov qword [rdi + 0x50], r13
mov qword [rdi + 0x58], r13
mov qword [rdi + 0x60], r13
mov qword [rdi + 0x68], r13
mov qword [rdi + 0x70], r13
lea rcx, [rdi + 8]
call fcn.140021c00
mov rsi, qword [0x14022a558]
mov qword [0x14022a558], rdi
test rsi, rsi
je 0x140008c53
lea rcx, [rsi + 0x30]
call fcn.140008910
lea rcx, [rsi + 0x20]
call fcn.140009a20
lea rcx, [rsi + 0x10]
call fcn.140009a20
mov edx, 0x80
mov rcx, rsi
call fcn.1400f348c
mov ecx, 0x58
call fcn.1400f3140
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
mov qword [rbx + 0x50], rax
lea rcx, [rbx + 0x18]
movabs rax, 0x6c90b8b0ad5e633f
mov qword [rbp + 0x3e0], rax
movabs rax, 0x2621341d339e2ade
mov qword [rbp + 0x3e8], rax
movabs rax, 0x170725707690bb1b
mov qword [rbp + 0x3f0], rax
movabs rdx, 0xc4396149f5ecabce
mov qword [rbp + 0x3f8], rdx
movabs rsi, 0x5dbf978add2a1757
mov qword [rbp + 0x400], rsi
movabs r14, 0x170f043303b01dec
mov qword [rbp + 0x408], r14
movabs rax, 0x1707254046a08e21
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x418], rdx
vmovdqu ymm0, ymmword [rbp + 0x3e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x400]
vmovdqa ymmword [rbp + 0x3e0], ymm1
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], r13
lea rax, [rbp + 0x3e0]
mov r15, 0xffffffffffffffff
mov r8, r15
vzeroupper
inc r8
cmp byte [rax + r8], r13b
jne 0x140008d32
lea rdx, [rbp + 0x3e0]
call fcn.14000b230
lea rcx, [rbx + 0x38]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], r13
xor r8d, r8d
lea rdx, [0x140148098]
call fcn.14000b230
mov rdi, qword [0x14022a550]
mov qword [0x14022a550], rbx
test rdi, rdi
je 0x140008db5
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rdi + 0x38]
call fcn.14000a070
lea rcx, [rdi + 0x18]
call fcn.14000a070
mov edx, 0x58
mov rcx, rdi
call fcn.1400f348c
mov rbx, qword [0x14022a550]
lea rdx, [rbp + 8]
call fcn.140020190
mov r8, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140008dcb
mov r8, qword [rax]
movabs rax, 0xf0f16e51e94a4649
mov qword [rbp + 0x400], rax
movabs rcx, 0x92a9c7805fe082aa
mov qword [rbp + 0x408], rcx
movabs rax, 0xf0f1323d88292905
mov qword [rbp + 0x3e0], rax
mov qword [rbp + 0x3e8], rcx
movdqa xmm0, xmmword [rbp + 0x400]
xorps xmm0, xmmword [rbp + 0x3e0]
movdqa xmmword [rbp + 0x400], xmm0
lea rdi, [rbp + 0x400]
lea rcx, [rdi - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], r13b
jne 0x140008e27
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140008e40
lea rcx, [rbp + 8]
call fcn.14000a070
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
mov r8d, 4
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 8], rax
test rax, rax
je 0x140008eb7
mov qword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x14000909f
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x2fcdf2aab55e6216
mov qword [rbp + 0x400], rax
movabs rax, 0x170f043303b06f83
mov qword [rbp + 0x408], rax
mov qword [rbp + 0x3e0], rsi
mov qword [rbp + 0x3e8], r14
movdqa xmm0, xmmword [rbp + 0x400]
xorps xmm0, xmmword [rbp + 0x3e0]
movdqa xmmword [rbp + 0x400], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x3e0], xmm0
mov qword [rbp + 0x3f0], r13
mov qword [rbp + 0x3f8], r13
lea rax, [rbp + 0x400]
mov r8, r15
inc r8
cmp byte [rax + r8], r13b
jne 0x140008f20
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x3e0]
call fcn.14000b230
lea rdx, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova rdx, qword [rbp + 0x3e0]
xor r9d, r9d
lea r8, str.Tango_Logger
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp + 0x3e0]
call fcn.14000a070
lea rcx, [rbp + 0x3c8]
call fcn.14007f640
lea rcx, [rbp + 0x320]
call fcn.14007ffa0
lea rcx, [rbp + 0x280]
call fcn.140085df0
nop
lea rcx, [rbp + 0x1f8]
call fcn.140085a20
mov rbx, qword [rbp + 0x260]
test rbx, rbx
je 0x140008fd9
mov eax, r15d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140008fd9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r15d
cmp r15d, 1
jne 0x140008fd9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rbp + 0x170]
call fcn.1400863a0
lea rcx, [rbp + 0x1e8]
call fcn.14007f640
lea rcx, [rbp + 0x1d8]
call fcn.14007f640
lea rcx, [rbp + 0x1c8]
call fcn.140086540
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
lea rcx, [rbp + 0xe8]
call fcn.1400852e0
mov rcx, qword [rbp + 0x120]
test rcx, rcx
jle 0x140009035
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x100]
call fcn.14007f6e0
lea rcx, [rbp + 0xf0]
call fcn.140085450
nop
lea rcx, [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [rbp + 0x78]
call fcn.1400809d0
lea rcx, [rbp + 0x40]
call fcn.140086610
xor eax, eax
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.1400f3120
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rbx
call fcn.14000e1f0
test al, al
je 0x140008eb7
mov rcx, qword [0x14022a550]
call fcn.14000f6f0
test al, al
je 0x140008eb7
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140009303
mov esi, 0xff
movabs rdi, 0x4e94914f0000
movabs r12, 0x7fffffffffffffff
movabs r14, 0x431bde82d7b634db
movabs r15, 0x7fffffffff67697e
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [0x14022a558]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 8]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140009167
lea rcx, [rbp + 8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 8]
call qword [sym.imp.USER32.dll_DispatchMessageA]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 8]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140009135
lea rcx, [rbx + 8]
call fcn.140021040
call fcn.14002d080
call fcn.14002d5a0
movss xmm2, dword [0x14022a2f4]
movaps xmm0, xmm2
mulss xmm0, dword [0x14022a2e8]
movss dword [rbp + 0x3e0], xmm0
movss xmm1, dword [0x14022a2ec]
mulss xmm1, xmm2
movss dword [rbp + 0x3e4], xmm1
movss xmm0, dword [0x14022a2f0]
mulss xmm0, xmm2
movss dword [rbp + 0x3e8], xmm0
movss dword [rbp + 0x3ec], xmm2
mov rcx, qword [0x14022d030]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x14022cfb8]
mov edx, 1
call qword [rax + 0x108]
mov rcx, qword [0x14022d030]
mov rax, qword [rcx]
lea r8, [rbp + 0x3e0]
mov rdx, qword [0x14022cfb8]
call qword [rax + 0x190]
mov rbx, qword [0x14022d050]
cmp dword [rbx + 0x4cb8], r13d
jg 0x14000922b
mov r8d, 0x7df
lea rdx, str.E:CodecppTangoTango_tangoguiimguiimgui.h
lea rcx, str.i___0__i___Size
call fcn.1400f9f24
mov rax, qword [rbx + 0x4cc0]
mov rcx, qword [rax]
add rcx, 0xa8
mov rax, r13
cmp byte [rcx], r13b
cmovne rax, rcx
mov rcx, rax
call fcn.140065c80
mov rcx, qword [0x14022cfc0]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 1
call qword [rax + 0x40]
lea rcx, [rbp]
call fcn.140001bb0
mov rbx, qword [rbp]
cmp rbx, r15
jg 0x14000927e
add rbx, 0x989680
jmp 0x140009281
mov rbx, r12
lea rcx, [rbp + 0x400]
call fcn.140001bb0
mov rax, qword [rbp + 0x400]
cmp rbx, rax
je 0x1400092e8
mov ecx, 1
cmovl ecx, esi
test cl, cl
jle 0x1400092e8
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jge 0x1400092dc
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400092d3
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140009281
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140009281
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140009110
mov r15, 0xffffffffffffffff
mov rsi, qword [0x14022d310]
mov r14, qword [0x14022d318]
cmp rsi, r14
je 0x140009434
movabs r12, 0x1fffffffffffffff
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rax
mov rdx, rsi
lea rcx, [rbp + 8]
call fcn.140009ae0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov rdx, qword [rsi + 0x28]
sub rdx, qword [rsi + 0x20]
sar rdx, 3
test rdx, rdx
je 0x1400093a8
cmp rdx, r12
ja 0x140009462
lea rcx, [rbp + 0x28]
call fcn.14000bab0
mov rdi, qword [rbp + 0x28]
mov rbx, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x20]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call fcn.14012a740
sar rbx, 3
lea rdx, [rdi + rbx*8]
mov qword [rbp + 0x30], rdx
jmp 0x1400093ac
mov rdx, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x28]
cmp rcx, rdx
je 0x1400093d4
nop word [rax + rax]
mov rax, qword [rcx]
mov byte [rax + 0x28], r13b
add rcx, 8
cmp rcx, rdx
jne 0x1400093c0
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14000941e
mov rax, qword [rbp + 0x38]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000940d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009468
call fcn.1400f348c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
lea rcx, [rbp + 8]
call fcn.14000a070
add rsi, 0x38
cmp rsi, r14
jne 0x140009330
mov rcx, qword [0x14022a550]
call fcn.14000ec30
call fcn.140020b60
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 1
call fcn.1400f9408
mov rcx, rax
call fcn.1400f96fc
jmp 0x140008f71
call fcn.14000a780
int3
call fcn.1400fa380
int3