Function at 0x14000b510
Capabilities:
Create thread
Log keystrokes via polling
Terminate process

Disassembly:
sub rsp, 0x48
mov ecx, dword [0x1400980e0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000b54b
cmp byte [0x140098bc0], 0
jne 0x14000b54b
cmp byte [0x14009a215], 0
jne 0x14000b54b
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x140098bd8], rax
mov byte [0x140098bc0], 1
mov ecx, dword [0x1400980e0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000b5e6
cmp byte [0x140098bc0], 0
je 0x14000b5e6
cmp byte [0x14009a215], 0
jne 0x14000b5e6
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x140098bd8]
cmp rax, 0x1f4
jb 0x14000b5c1
cmp byte [0x140098bc2], 0
jne 0x14000b5c1
mov ecx, dword [0x1400980f8]
xor r8d, r8d
mov eax, dword [0x1400980fc]
xor edx, edx
mov dword [0x1400980fc], ecx
lea rcx, [0x14007b530]
mov dword [0x1400980f8], eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov byte [0x140098bc2], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x140098bd8]
cmp rax, 0x1f4
jae 0x14000b5e6
cmp byte [0x140098bc2], 0
je 0x14000b5e6
mov byte [0x140098bc2], 0
mov ecx, dword [0x1400980e0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000b67d
cmp byte [0x140098bc0], al
je 0x14000b67d
cmp byte [0x14009a215], al
jne 0x14000b67d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x140098bd8]
cmp rax, 0x1f4
jae 0x14000b676
cmp byte [0x1400980e5], 0
sete al
cmp dword [0x1400980f4], 5
mov byte [0x1400980e5], al
jne 0x14000b659
cmp dword [0x1400980f8], 0
jne 0x14000b659
test al, al
je 0x14000b664
lea rcx, [0x1400980d0]
call fcn.140005fa0
movzx eax, byte [0x1400980e5]
lea rcx, [0x14007b610]
test al, al
jne 0x14000b66b
lea rcx, [0x14007b6f0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov byte [0x140098bc0], 0
mov ecx, dword [0x1400980e0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000b69e
cmp byte [0x14009a215], 0
je 0x14000b69e
mov byte [0x140098bc0], 1
mov ecx, dword [0x1400980e0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000b6cb
cmp byte [0x140098bc0], al
je 0x14000b6cb
cmp byte [0x14009a215], al
je 0x14000b6cb
mov byte [0x14009a215], al
mov byte [0x140098bc0], al
mov ecx, dword [0x1400981b0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000b702
cmp byte [0x140098bc5], 0
jne 0x14000b702
cmp byte [0x14009a215], 0
jne 0x14000b702
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x140098bd8], rax
mov byte [0x140098bc5], 1
mov ecx, dword [0x1400981b0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000b79d
cmp byte [0x140098bc5], 0
je 0x14000b79d
cmp byte [0x14009a215], 0
jne 0x14000b79d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x140098bd8]
cmp rax, 0x1f4
jb 0x14000b778
cmp byte [0x140098bc2], 0
jne 0x14000b778
mov ecx, dword [0x1400981c8]
xor r8d, r8d
mov eax, dword [0x1400981cc]
xor edx, edx
mov dword [0x1400981cc], ecx
lea rcx, [0x14007b530]
mov dword [0x1400981c8], eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov byte [0x140098bc2], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x140098bd8]
cmp rax, 0x1f4
jae 0x14000b79d
cmp byte [0x140098bc2], 0
je 0x14000b79d
mov byte [0x140098bc2], 0
mov ecx, dword [0x1400981b0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000b834
cmp byte [0x140098bc5], al
je 0x14000b834
cmp byte [0x14009a215], al
jne 0x14000b834
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x140098bd8]
cmp rax, 0x1f4
jae 0x14000b82d
cmp byte [0x1400981b5], 0
sete al
cmp dword [0x1400981c4], 5
mov byte [0x1400981b5], al
jne 0x14000b810
cmp dword [0x1400981c8], 0
jne 0x14000b810
test al, al
je 0x14000b81b
lea rcx, [0x1400981a0]
call fcn.140005fa0
movzx eax, byte [0x1400981b5]
lea rcx, [0x14007b610]
test al, al
jne 0x14000b822
lea rcx, [0x14007b6f0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov byte [0x140098bc5], 0
mov ecx, dword [0x1400981b0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000b855
cmp byte [0x14009a215], 0
je 0x14000b855
mov byte [0x140098bc5], 1
mov ecx, dword [0x1400981b0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000b882
cmp byte [0x140098bc5], al
je 0x14000b882
cmp byte [0x14009a215], al
je 0x14000b882
mov byte [0x14009a215], al
mov byte [0x140098bc5], al
mov ecx, dword [0x14009a25c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000b8ac
cmp byte [0x140098bc6], 0
jne 0x14000b8ac
cmp byte [0x14009a215], 0
jne 0x14000b8ac
mov byte [0x140098bc6], 1
mov ecx, dword [0x14009a25c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000b901
cmp byte [0x140098bc6], al
je 0x14000b901
cmp byte [0x14009a215], al
jne 0x14000b901
mov rcx, qword [0x14009a240]
test rcx, rcx
je 0x14000b8fa
movzx eax, byte [0x14009a214]
test eax, eax
sete byte [0x14009a214]
test eax, eax
jne 0x14000b8f2
lea edx, [rax + 1]
jmp 0x14000b8f4
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [0x140098bc6], 0
mov ecx, dword [0x14009a25c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000b922
cmp byte [0x14009a215], 0
je 0x14000b922
mov byte [0x140098bc6], 1
mov ecx, dword [0x14009a25c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000b94f
cmp byte [0x140098bc6], al
je 0x14000b94f
cmp byte [0x14009a215], al
je 0x14000b94f
mov byte [0x14009a215], al
mov byte [0x140098bc6], al
mov ecx, dword [0x14009a260]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000b986
cmp byte [0x140098bc3], 0
jne 0x14000b986
cmp byte [0x14009a215], 0
jne 0x14000b986
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x140098bd8], rax
mov byte [0x140098bc3], 1
mov ecx, dword [0x14009a260]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000ba5b
cmp byte [0x140098bc3], 0
je 0x14000ba5b
cmp byte [0x14009a215], 0
jne 0x14000ba5b
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x140098bd8]
cmp rax, 0x1f4
jb 0x14000ba5b
lea rdx, str.C:YoClicker2.0Lconfig.cfg
lea rcx, [rsp + 0x20]
call fcn.14000a7b0
mov rdx, rax
lea rcx, [0x1400980d0]
call fcn.1400051e0
lea rdx, str.C:YoClicker2.0Rconfig.cfg
lea rcx, [rsp + 0x20]
call fcn.14000a7b0
mov rdx, rax
lea rcx, [0x1400981a0]
call fcn.1400051e0
lea rdx, str.C:YoClicker2.0Sconfig.cfg
lea rcx, [rsp + 0x20]
call fcn.14000a7b0
mov rdx, rax
call fcn.14007d860
lea rdx, str.C:YoClicker2.0Mconfig.cfg
lea rcx, [rsp + 0x20]
call fcn.14000a7b0
mov rdx, rax
lea rcx, [0x14009a1f0]
call fcn.14007aad0
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [0x14009a260]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000ba82
cmp byte [0x140098bc3], al
je 0x14000ba82
cmp byte [0x14009a215], al
jne 0x14000ba82
mov byte [0x140098bc3], al
mov ecx, dword [0x14009a260]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000baa3
cmp byte [0x14009a215], 0
je 0x14000baa3
mov byte [0x140098bc3], 1
mov ecx, dword [0x14009a260]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000bad0
cmp byte [0x140098bc3], al
je 0x14000bad0
cmp byte [0x14009a215], al
je 0x14000bad0
mov byte [0x14009a215], al
mov byte [0x140098bc3], al
mov ecx, dword [0x14009a264]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000bafa
cmp byte [0x140098bc4], 0
jne 0x14000bafa
cmp byte [0x14009a215], 0
jne 0x14000bafa
mov byte [0x140098bc4], 1
mov ecx, dword [0x14009a264]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000bb41
cmp byte [0x140098bc4], al
je 0x14000bb41
cmp byte [0x14009a215], al
jne 0x14000bb41
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r8d, r8d
lea rcx, [0x14007b530]
xor edx, edx
mov qword [0x14009a248], rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
mov byte [0x140098bc4], 0
mov ecx, dword [0x14009a264]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000bb62
cmp byte [0x14009a215], 0
je 0x14000bb62
mov byte [0x140098bc4], 1
mov ecx, dword [0x14009a264]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000bb8f
cmp byte [0x140098bc4], al
je 0x14000bb8f
cmp byte [0x14009a215], al
je 0x14000bb8f
mov byte [0x14009a215], al
mov byte [0x140098bc4], al
add rsp, 0x48
ret