Function at 0x1800397f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [r11 - 0x38]
sub rsp, 0x120
movaps xmmword [r11 - 0x28], xmm6
mov rax, qword [0x180170038]
xor rax, rsp
mov qword [rbp], rax
lea rax, [0x180039f50]
mov qword [r11 + 8], rsi
xor r14d, r14d
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rbp - 0x80], r14
mov dword [rsp + 0x70], 0x50
mov dword [rsp + 0x74], 0x40
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x78], rax
lea rcx, [rsp + 0x70]
lea rax, str.CraniumGUIThreadProc
movdqa xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
mov qword [rbp - 0x50], rax
movdqa xmmword [rbp - 0x60], xmm1
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rbp - 0x78]
lea r8, str.CraniumV1
mov rdx, qword [rbp - 0x50]
mov r9d, 0xcb0000
mov qword [rsp + 0x58], r14
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 0x2d0
mov dword [rsp + 0x30], 0x500
mov dword [rsp + 0x28], 0x64
mov dword [rsp + 0x20], 0x64
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea ecx, [r14 + 0x20]
mov rsi, rax
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov qword [0x1801a9040], rax
mov rcx, rax
test rax, rax
je 0x180039df9
lea rdx, [0x1801a8930]
mov qword [0x1801a88b0], r14
mov qword [rsp + 0x30], rdx
lea r8d, [r14 + 1]
lea rdx, [0x1801a88b0]
mov qword [0x1801a88bc], r14
mov qword [rsp + 0x28], rdx
mov r9, rsi
mov dword [0x1801a88c4], r14d
xor edx, edx
mov qword [0x1801a88cc], r14
mov dword [0x1801a88d4], r14d
mov qword [0x1801a88e4], r14
mov dword [0x1801a88d8], 1
mov dword [0x1801a88c8], 1
mov dword [0x1801a88b8], r14d
mov dword [0x1801a88dc], 1
mov dword [0x1801a88e0], 0x50
mov dword [0x1801a88ec], 1
mov rax, qword [rax]
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x180039df2
call fcn.18005bc30
mov rbx, qword [0x180172ff0]
mov rcx, qword [rbx + 0x50]
mov dword [rbx + 8], 0x20
call fcn.1800791a0
movss xmm2, dword [0x180158ec4]
mov rcx, qword [rbx + 0x50]
call fcn.180079310
mov rcx, qword [rbx + 0x50]
mov qword [0x180172fc8], rax
call fcn.1800791a0
movss xmm2, dword [0x180158ecc]
mov rcx, qword [rbx + 0x50]
call fcn.180079310
mov rcx, qword [rbx + 0x50]
mov qword [0x180172fc0], rax
call fcn.1800791a0
movss xmm2, dword [0x180158ee0]
mov rcx, qword [rbx + 0x50]
call fcn.180079310
lea edx, [r14 + 0xa]
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.18005bc30
mov rdx, qword [0x180172ff0]
mov qword [rdx + 0x20], r14
mov rax, qword [rdx + 0x4088]
mov rcx, qword [rax]
movsd xmm0, qword [rcx + 0xc]
or dword [rdx + 8], 1
movsd qword [rdx + 0x10], xmm0
call fcn.180029aa0
mov rcx, rsi
call fcn.18007f910
mov rbx, qword [0x180172ff0]
mov rdi, qword [0x1801a8930]
test rbx, rbx
je 0x180039a67
inc dword [rbx + 0xec]
mov ecx, 0x28
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x180039a96
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
mov dword [rax + 0x20], 0x1388
mov dword [rax + 0x24], 0x2710
jmp 0x180039a99
mov rax, r14
or dword [rbx + 0xc], 8
lea rcx, [0x180156968]
mov qword [rbx + 0x88], rcx
mov rcx, rdi
mov qword [rbx + 0x98], rax
mov qword [rax], rdi
mov rax, qword [rdi]
call qword [rax + htons]
mov ecx, dword [0x180172ed8]
mov rax, qword gs:[0x58]
movss xmm6, dword [0x180158c44]
mov r15d, 4
mov rdi, qword [rax + rcx*8]
nop
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x180039b38
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [rbp - 0x28], 0x12
je 0x180039b38
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x180039b00
mov rax, qword [0x180172ff0]
test rax, rax
je 0x180039b4d
mov rcx, qword [rax + 0x98]
jmp 0x180039b50
mov rcx, r14
cmp qword [rcx + 0x18], r14
jne 0x180039b71
test rax, rax
je 0x180039b71
mov rcx, qword [rax + 0x98]
test rcx, rcx
je 0x180039b71
cmp qword [rcx], r14
je 0x180039b71
call fcn.18007f670
call fcn.180080290
call fcn.18005d4b0
mov rax, qword [0x180172ff0]
lea rdx, [rbp - 0x40]
mov rcx, rsi
or dword [rax + 0x3f88], 1
mov dword [rax + 0x3f98], 0xc0000000
mov dword [rax + 0x3f9c], 0xc0000000
mov qword [rax + 0x3fa0], r14
mov dword [rax + 0x3f8c], 1
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x180039c01
mov eax, dword [rbp - 0x38]
sub eax, dword [rbp - 0x40]
movd xmm1, eax
mov eax, dword [rbp - 0x34]
sub eax, dword [rbp - 0x3c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov rax, qword [0x180172ff0]
cvtdq2ps xmm0, xmm0
or dword [rax + 0x3f88], 2
mov dword [rax + 0x3f90], 1
movss dword [rax + 0x3fa8], xmm1
movss dword [rax + 0x3fac], xmm0
call fcn.180038390
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x180039c24
imul rbx, rax, 0x64
jmp 0x180039c45
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
mov ecx, dword [r15 + rdi]
cmp dword [0x1801a9c30], ecx
jle 0x180039c79
lea rcx, [0x1801a9c30]
call fcn.18011f1ac
cmp dword [0x1801a9c30], 0xffffffff
jne 0x180039c79
lea rcx, [0x1801a9c30]
mov qword [0x1801a9c38], rbx
call fcn.18011f140
mov rcx, rbx
sub rcx, qword [0x1801a9c38]
lea rax, [rcx - 0xbebc200]
cmp rax, 0xf4240
jb 0x180039ce2
cmp rcx, 0xbebc200
jl 0x180039ce2
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180039cbb
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180039ce2
cmp byte [0x180173008], r14b
mov rcx, rsi
sete al
mov byte [0x180173008], al
neg al
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [0x1801a9c38], rbx
call fcn.18005f3c0
mov rcx, qword [0x1801a8930]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x1801a8930]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x1801a8930]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x1801a8930]
mov r9d, 3
mov dword [rsp + 0x30], r14d
xor r8d, r8d
movss dword [rsp + 0x28], xmm6
xor edx, edx
mov dword [rsp + 0x20], 0xff728c99
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x1801a8930]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x180039da8
call fcn.18005f710
mov rax, qword [0x180172ff0]
mov rcx, qword [rax + 0x4088]
mov rax, qword [rcx]
mov rcx, r14
add rax, 0x48
cmp byte [rax], r14b
cmovne rcx, rax
call fcn.18007f0c0
mov rcx, qword [0x1801a8930]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x1801a8930]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x180039ae0
mov rcx, qword [0x1801a8930]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x180039ae0
call fcn.180039e80
jmp 0x180039ae0
mov rcx, qword [0x1801a9040]
mov rdx, qword [0x1801a8930]
mov rsi, qword [rsp + 0x140]
test rdx, rdx
je 0x180039e24
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x1801a9040]
mov qword [0x1801a8930], r14
test rcx, rcx
je 0x180039e36
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [0x1801a9040], r14
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.18011eb40
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret