Function at 0x140002e30
Capabilities:
Link many functions at runtime
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x37]
sub rsp, 0x100
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
mov rax, qword [0x14000c010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r12, qword [rbp + 0x5f]
mov r13, rcx
mov rdi, qword [rbp + 0x7f]
lea rcx, str.ntdll.dll
mov rsi, qword [0x14000c7b8]
mov r15, r9
mov r14, r8
mov dword [rsp + 0x30], edx
xorps xmm12, xmm12
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x68], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtReadVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtWriteVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsi + 8]
lea rdx, [rdi + 0xc0]
mov r9d, 0xc
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x60]
call rbx
movss xmm8, dword [rsp + 0x60]
movss xmm7, dword [rsp + 0x64]
movss xmm6, dword [rsp + 0x68]
subss xmm8, dword [r14]
subss xmm7, dword [r14 + 4]
subss xmm6, dword [r14 + 8]
movaps xmm0, xmm8
movaps xmm1, xmm7
xorps xmm6, xmmword [0x140009a00]
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
movaps xmm1, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2f
movaps xmm9, xmm0
movaps xmm1, xmm8
mulss xmm9, dword [0x14000998c]
movaps xmm0, xmm7
subss xmm9, dword [r15]
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2f
movaps xmm8, xmm0
xorps xmm7, xmm7
mulss xmm8, dword [0x14000998c]
movaps xmm0, xmm9
xorps xmm6, xmm6
subss xmm8, dword [r15 + 4]
movaps xmm1, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
movss xmm1, dword [r12]
comiss xmm1, xmm0
jbe 0x140002fbf
movss dword [r12], xmm0
movaps xmm7, xmm9
movaps xmm6, xmm8
movss xmm8, dword [0x140009998]
comiss xmm7, xmm8
movss xmm9, dword [0x1400099b4]
movss xmm11, dword [0x1400099c0]
movss xmm10, dword [0x1400099b0]
jbe 0x140002ff5
comiss xmm10, xmm7
jb 0x140002ff5
movaps xmm7, xmm8
jmp 0x14000300a
comiss xmm7, xmm10
jbe 0x140003000
subss xmm7, xmm9
comiss xmm11, xmm7
jbe 0x14000300a
movaps xmm7, xmm11
comiss xmm6, xmm10
jbe 0x140003015
subss xmm6, xmm9
movss xmm13, dword [0x1400099c4]
comiss xmm13, xmm6
jbe 0x140003029
addss xmm6, xmm9
ucomiss xmm7, xmm12
jp 0x14000303d
jne 0x14000303d
ucomiss xmm6, xmm12
jp 0x14000303d
je 0x1400031d3
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400031d3
mov rdi, qword [0x14000c7b8]
lea rcx, str.ntdll.dll
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x68], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtReadVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtWriteVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [r13]
xor esi, esi
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
lea r8, [rdx + rdx*2]
mov rdx, qword [r13 + 8]
lea r9d, [rsi + 0xc]
lea rdx, [rdx + r8*4]
add rdx, 0xfffffffffffffff4
lea r8, [rsp + 0x60]
call rbx
cmp dword [rsp + 0x30], 1
jle 0x140003147
movss xmm0, dword [rsp + 0x60]
mulss xmm0, dword [0x140009968]
subss xmm7, xmm0
movss xmm0, dword [rsp + 0x64]
mulss xmm0, dword [0x140009968]
comiss xmm7, xmm8
subss xmm6, xmm0
jbe 0x140003109
comiss xmm10, xmm7
jae 0x140003122
comiss xmm7, xmm10
movaps xmm8, xmm7
jbe 0x140003118
subss xmm8, xmm9
comiss xmm11, xmm8
jbe 0x140003122
movaps xmm8, xmm11
comiss xmm6, xmm10
jbe 0x14000312d
subss xmm6, xmm9
comiss xmm13, xmm6
jbe 0x140003138
addss xmm6, xmm9
mov rax, qword [rbp + 0x6f]
addss xmm8, dword [rax]
movaps xmm1, xmm8
jmp 0x140003152
mov rax, qword [rbp + 0x6f]
addss xmm7, dword [rax]
movaps xmm1, xmm7
movss xmm0, dword [rax + 8]
lea rcx, str.ntdll.dll
addss xmm6, dword [rax + 4]
mov rbx, qword [0x14000c7b8]
addss xmm0, xmm12
unpcklps xmm1, xmm6
movss dword [rsp + 0x58], xmm0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x48], eax
movsd qword [rsp + 0x40], xmm1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtReadVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtWriteVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rbp + 0x77]
lea r8, [rsp + 0x40]
mov rcx, qword [rbx + 8]
mov r9d, 0xc
mov qword [rsp + 0x20], rsi
call rax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140006fb0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret