Function at 0x140021250
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x138]
sub rsp, 0x230
mov rax, qword [0x140154040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
cmp byte [0x1402102ac], 0
jne 0x1400224e3
mov rax, qword gs:[0x58]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
movabs r13, 0x7fffffffffffffff
mov qword [r11 - 0x20], r14
mov r14, qword [rax]
mov qword [r11 - 0x28], r15
xor r15d, r15d
movaps xmmword [r11 - 0x38], xmm6
movss xmm6, dword [0x1401437c4]
movaps xmmword [r11 - 0x48], xmm7
movss xmm7, dword [0x14014359c]
movaps xmmword [r11 - 0x58], xmm8
movsd xmm8, qword [0x1401436c8]
movaps xmmword [r11 - 0x68], xmm9
movsd xmm9, qword [0x140143648]
mov qword [r11 + 0x10], rsi
mov r12d, 4
mov eax, dword [0x1402102b8]
lea rcx, [rsp + 0x68]
add eax, 5
movsxd rbx, eax
call fcn.140002060
mov rcx, qword [rsp + 0x68]
mov qword [rbp - 0x60], rcx
test rbx, rbx
jle 0x140021335
imul rdx, rbx, 0xf4240
mov rax, r13
sub rax, rdx
cmp rcx, rax
jge 0x140021331
lea rax, [rdx + rcx]
mov qword [rbp - 0x60], rax
jmp 0x140021335
mov qword [rbp - 0x60], r13
lea rcx, [rbp - 0x60]
call fcn.140005230
cmp byte [0x140210280], r15b
mov rcx, qword [0x140210128]
je 0x140021353
mov r8b, 1
jmp 0x140021356
xor r8d, r8d
call fcn.140020970
mov rbx, qword [0x140210128]
movzx edi, byte [0x140210281]
test rbx, rbx
je 0x1400213fc
mov r10, qword [0x14020fc50]
test r10, r10
je 0x1400213b0
cmp dword [0x14020fbb8], r15d
je 0x1400213b0
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0xa0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
bts rcx, 8
btr rax, 8
test dil, dil
cmove rcx, rax
mov qword [rbp - 0x60], rcx
test r10, r10
je 0x1400213fc
cmp dword [0x14020fbb8], r15d
je 0x1400213fc
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp - 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x140210284]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14002141b
cmp byte [0x140210281], r15b
sete byte [0x140210281]
mov rdx, qword [0x140210128]
test rdx, rdx
je 0x1400214a9
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140021466
cmp dword [0x14020fbb8], r15d
je 0x140021466
add rdx, qword [0x14020fb40]
lea r8, [rbp + 0xa8]
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14020fc50]
mov rdx, qword [rbp + 0xa8]
test rdx, rdx
je 0x1400214a9
movss xmm0, dword [0x140210288]
movss dword [rbp - 0x68], xmm0
test rcx, rcx
je 0x1400214a9
cmp dword [0x14020fbb8], r15d
je 0x1400214a9
add rdx, qword [0x14020fb60]
lea r8, [rbp - 0x68]
mov r9d, 4
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [r12 + r14]
cmp dword [0x140210344], eax
jle 0x1400214e2
lea rcx, [0x140210344]
call fcn.140099fe8
cmp dword [0x140210344], 0xffffffff
jne 0x1400214e2
lea rcx, [0x140210368]
call fcn.140002060
lea rcx, [0x140210344]
call fcn.140099f7c
lea rcx, [rsp + 0x60]
call fcn.140002060
mov rax, qword [rsp + 0x60]
xorps xmm0, xmm0
sub rax, qword [0x140210368]
cvtsi2sd xmm0, rax
divsd xmm0, xmm8
comisd xmm0, xmm9
jb 0x140021675
mov rdx, qword [0x140210128]
mov r10, qword [0x14020fc50]
test rdx, rdx
jne 0x140021528
mov rdx, r15
jmp 0x14002155d
test r10, r10
je 0x140021559
cmp dword [0x14020fbb8], r15d
je 0x140021559
add rdx, 0x30
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
mov rdx, qword [rbp]
test r10, r10
je 0x140021631
cmp dword [0x14020fbb8], r15d
je 0x140021592
add rdx, 0x10
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
test r10, r10
je 0x140021631
cmp dword [0x14020fbb8], r15d
je 0x1400215cb
mov rdx, qword [rbp + 8]
lea r8, [rbp + 0x10]
add rdx, 0x20
mov qword [rsp + 0x20], r15
mov r9d, 8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
test r10, r10
je 0x140021631
cmp dword [0x14020fbb8], r15d
je 0x140021600
mov rdx, qword [rbp + 0x10]
lea r8, [rbp + 0x18]
add rdx, 0x70
mov qword [rsp + 0x20], r15
mov r9d, 8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
test r10, r10
je 0x140021631
cmp dword [0x14020fbb8], r15d
je 0x140021631
mov rdx, qword [rbp + 0x18]
lea r8, [rbp + 0x20]
mov r9d, 8
mov qword [rsp + 0x20], r15
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
cmp byte [0x14021028d], r15b
je 0x14002163f
movaps xmm0, xmm6
jmp 0x140021642
movaps xmm0, xmm7
movss dword [rbp - 0x38], xmm0
test r10, r10
je 0x14002167c
cmp dword [0x14020fbb8], r15d
je 0x14002167c
mov rdx, qword [rbp + 0x20]
lea r8, [rbp - 0x38]
add rdx, 0x2c
mov qword [rsp + 0x20], r15
mov r9d, 4
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x14020fc50]
movzx ecx, byte [0x14021028e]
cmp byte [0x14020fd6b], cl
je 0x140021729
test cl, cl
setne al
add al, 0xc8
mov byte [rbp - 0x80], al
test r10, r10
je 0x1400216db
cmp dword [0x14020fbb8], r15d
je 0x1400216db
mov rdx, qword [0x140210128]
lea r8, [rbp - 0x80]
add rdx, qword [0x14020fb58]
mov r9d, 1
mov rcx, r10
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [0x14021028e]
mov r10, qword [0x14020fc50]
test cl, cl
sete byte [rbp - 0x78]
test r10, r10
je 0x140021723
cmp dword [0x14020fbb8], r15d
je 0x140021723
mov rdx, qword [0x140210128]
lea r8, [rbp - 0x78]
add rdx, qword [0x14020fb68]
mov r9d, 1
mov rcx, r10
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [0x14021028e]
mov r10, qword [0x14020fc50]
mov byte [0x14020fd6b], cl
movzx ecx, byte [0x14021028f]
cmp byte [0x14020fd69], cl
je 0x14002178e
test cl, cl
mov eax, 0x20
cmovne eax, r15d
mov byte [rbp - 0x70], al
test r10, r10
je 0x140021788
cmp dword [0x14020fbb8], r15d
je 0x140021788
mov rdx, qword [0x140210128]
lea r8, [rbp - 0x70]
add rdx, qword [0x14020fb30]
mov r9d, 1
mov rcx, r10
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [0x14021028f]
mov r10, qword [0x14020fc50]
mov byte [0x14020fd69], cl
mov rcx, qword [0x140210128]
test rcx, rcx
je 0x140021839
test r10, r10
je 0x1400217d5
cmp dword [0x14020fbb8], r15d
je 0x1400217d5
mov rdx, qword [0x14020fb40]
lea r8, [rbp + 0x28]
add rdx, rcx
mov qword [rsp + 0x20], r15
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
mov rdx, qword [rbp + 0x28]
test rdx, rdx
je 0x140021839
movzx ecx, byte [0x140210290]
movzx eax, byte [0x140210291]
test cl, cl
jne 0x1400217f4
test al, al
je 0x140021839
neg cl
sbb ecx, ecx
and ecx, 0x4000
neg al
sbb eax, eax
and eax, 0x2000
or ecx, eax
mov dword [rbp - 0x68], ecx
test r10, r10
je 0x140021839
cmp dword [0x14020fbb8], r15d
je 0x140021839
add rdx, 0x218
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x68]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140210128]
call fcn.140020a50
mov rdx, qword [0x140210128]
mov r10, qword [0x14020fc50]
test al, al
je 0x140021e7a
test rdx, rdx
je 0x140021d79
test r10, r10
je 0x14002189f
cmp dword [0x14020fbb8], r15d
je 0x14002189f
add rdx, qword [0x14020fb48]
lea r8, [rbp + 0x30]
mov r9d, 8
mov qword [rsp + 0x20], r15
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140210128]
mov r10, qword [0x14020fc50]
mov rsi, qword [rbp + 0x30]
test rsi, rsi
je 0x140021d74
movzx ebx, byte [0x14021029c]
test r10, r10
je 0x1400218e7
cmp dword [0x14020fbb8], r15d
je 0x1400218e7
lea rdx, [rsi + 0x188]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x38]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
bts rcx, 8
btr rax, 8
test bl, bl
cmove rcx, rax
mov qword [rbp + 0x40], rcx
test r10, r10
je 0x140021967
cmp dword [0x14020fbb8], r15d
je 0x140021936
lea rdx, [rsi + 0x188]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x40]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x14020fc50]
test r10, r10
je 0x140021967
cmp dword [0x14020fbb8], r15d
je 0x140021967
lea rdx, [rsi + 0x20]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x48]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
mov rbx, qword [rbp + 0x48]
test r10, r10
je 0x1400219a2
cmp dword [0x14020fbb8], r15d
je 0x1400219a2
mov rdx, qword [0x14020fb38]
lea r8, [rbp - 8]
add rdx, rsi
mov qword [rsp + 0x20], r15
mov r9d, 8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
mov rdi, qword [rbp - 8]
test rdi, rdi
je 0x140021c9b
mov eax, dword [r12 + r14]
cmp dword [0x140210358], eax
jle 0x1400219e3
lea rcx, [0x140210358]
call fcn.140099fe8
cmp dword [0x140210358], 0xffffffff
jne 0x1400219dc
lea rcx, [0x140210358]
call fcn.140099f7c
mov r10, qword [0x14020fc50]
mov eax, dword [r12 + r14]
cmp dword [0x140210330], eax
jle 0x140021a56
lea rcx, [0x140210330]
call fcn.140099fe8
cmp dword [0x140210330], 0xffffffff
jne 0x140021a4f
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140021a36
cmp dword [0x14020fbb8], r15d
je 0x140021a36
mov rdx, qword [rbp - 8]
lea r8, [rbp - 0x30]
add rdx, 0x4c
mov qword [rsp + 0x20], r15
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x30]
lea rcx, [0x140210330]
movss dword [0x140210354], xmm0
call fcn.140099f7c
mov r10, qword [0x14020fc50]
mov eax, dword [r12 + r14]
cmp dword [0x140210338], eax
jle 0x140021ac8
lea rcx, [0x140210338]
call fcn.140099fe8
cmp dword [0x140210338], 0xffffffff
jne 0x140021ac1
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140021aa8
cmp dword [0x14020fbb8], r15d
je 0x140021aa8
lea rdx, [rdi + 0xf8]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x2c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x2c]
lea rcx, [0x140210338]
movss dword [0x140210374], xmm0
call fcn.140099f7c
mov r10, qword [0x14020fc50]
mov eax, dword [r12 + r14]
cmp dword [0x140210348], eax
jle 0x140021b2a
lea rcx, [0x140210348]
call fcn.140099fe8
cmp dword [0x140210348], 0xffffffff
jne 0x140021b23
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140021b17
cmp dword [0x14020fbb8], r15d
je 0x140021b17
lea rdx, [rbx + 0x38]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, [0x140210348]
call fcn.140099f7c
mov r10, qword [0x14020fc50]
mov eax, dword [r12 + r14]
cmp dword [0x140210334], eax
jle 0x140021b92
lea rcx, [0x140210334]
call fcn.140099fe8
cmp dword [0x140210334], 0xffffffff
jne 0x140021b8b
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140021b7f
cmp dword [0x14020fbb8], r15d
je 0x140021b7f
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, [0x140210334]
call fcn.140099f7c
mov r10, qword [0x14020fc50]
mov eax, dword [r12 + r14]
cmp dword [0x14021034c], eax
jle 0x140021bfa
lea rcx, [0x14021034c]
call fcn.140099fe8
cmp dword [0x14021034c], 0xffffffff
jne 0x140021bf3
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140021be7
cmp dword [0x14020fbb8], r15d
je 0x140021be7
lea rdx, [rdi + 0x88]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, [0x14021034c]
call fcn.140099f7c
mov r10, qword [0x14020fc50]
cmp byte [0x14021029d], r15b
je 0x140021c0d
movss xmm0, dword [0x1402102a0]
jmp 0x140021c15
movss xmm0, dword [0x140210354]
movss dword [rbp - 0x58], xmm0
test r10, r10
je 0x140021c4b
cmp dword [0x14020fbb8], r15d
je 0x140021c4b
lea rdx, [rdi + 0x4c]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x58]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x14020fc50]
cmp byte [0x1402102a4], r15b
je 0x140021c5a
mov dword [rbp - 0x50], r15d
jmp 0x140021c67
movss xmm0, dword [0x140210374]
movss dword [rbp - 0x50], xmm0
test r10, r10
je 0x140021ccc
cmp dword [0x14020fbb8], r15d
je 0x140021c9b
lea rdx, [rdi + 0xf8]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x50]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x14020fc50]
test r10, r10
je 0x140021ccc
cmp dword [0x14020fbb8], r15d
je 0x140021ccc
lea rdx, [rsi + 0x20]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x50]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
mov rax, qword [rbp + 0x50]
mov qword [0x14020faf8], rax
mov qword [0x14020fb00], rsi
test r10, r10
je 0x140021d12
cmp dword [0x14020fbb8], r15d
je 0x140021d12
lea rdx, [rsi + 0x30]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x88]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
mov rax, qword [rbp + 0x88]
mov qword [0x14020faf0], rax
test r10, r10
je 0x140021d55
cmp dword [0x14020fbb8], r15d
je 0x140021d55
lea rdx, [rsi + 0x90]
mov qword [rsp + 0x20], r15
mov r9d, 0xc
lea r8, [rsp + 0x54]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
movss xmm0, dword [rsp + 0x54]
movss xmm1, dword [rsp + 0x58]
movss dword [0x14020fd30], xmm0
movss xmm0, dword [rsp + 0x5c]
jmp 0x140021f7b
test rdx, rdx
jne 0x140021d7e
mov rax, r15
jmp 0x140021dba
test r10, r10
je 0x140021db6
cmp dword [0x14020fbb8], r15d
je 0x140021db6
add rdx, 0x20
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140210128]
mov r10, qword [0x14020fc50]
mov rax, qword [rbp + 0x60]
mov qword [0x14020faf8], rax
mov qword [0x14020fb00], rdx
test rdx, rdx
jne 0x140021dd2
mov rax, r15
jmp 0x140021e0e
test r10, r10
je 0x140021e0a
cmp dword [0x14020fbb8], r15d
je 0x140021e0a
add rdx, 0x30
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x68]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140210128]
mov r10, qword [0x14020fc50]
mov rax, qword [rbp + 0x68]
mov qword [0x14020faf0], rax
test rdx, rdx
jne 0x140021e26
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x38], r15d
jmp 0x140021e5b
test r10, r10
je 0x140021e5b
cmp dword [0x14020fbb8], r15d
je 0x140021e5b
add rdx, 0x90
mov qword [rsp + 0x20], r15
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
movss xmm0, dword [rsp + 0x30]
movss xmm1, dword [rsp + 0x34]
movss dword [0x14020fd30], xmm0
movss xmm0, dword [rsp + 0x38]
jmp 0x140021f7b
test rdx, rdx
jne 0x140021e84
mov rax, r15
jmp 0x140021ec0
test r10, r10
je 0x140021ebc
cmp dword [0x14020fbb8], r15d
je 0x140021ebc
add rdx, 0x20
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140210128]
mov r10, qword [0x14020fc50]
mov rax, qword [rbp + 0x70]
mov qword [0x14020faf8], rax
mov qword [0x14020fb00], rdx
test rdx, rdx
jne 0x140021ed8
mov rax, r15
jmp 0x140021f14
test r10, r10
je 0x140021f10
cmp dword [0x14020fbb8], r15d
je 0x140021f10
add rdx, 0x30
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x78]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140210128]
mov r10, qword [0x14020fc50]
mov rax, qword [rbp + 0x78]
mov qword [0x14020faf0], rax
test rdx, rdx
jne 0x140021f2c
mov qword [rsp + 0x3c], r15
mov dword [rsp + 0x44], r15d
jmp 0x140021f61
test r10, r10
je 0x140021f61
cmp dword [0x14020fbb8], r15d
je 0x140021f61
add rdx, 0x90
mov qword [rsp + 0x20], r15
mov r9d, 0xc
lea r8, [rsp + 0x3c]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
movss xmm0, dword [rsp + 0x3c]
movss xmm1, dword [rsp + 0x40]
movss dword [0x14020fd30], xmm0
movss xmm0, dword [rsp + 0x44]
mov rdx, qword [0x140210060]
movss dword [0x14020fd34], xmm1
movss dword [0x14020fd38], xmm0
test rdx, rdx
je 0x140022007
test r10, r10
je 0x140021fce
cmp dword [0x14020fbb8], r15d
je 0x140021fce
add rdx, 0x3c0
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x80]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14020fc50]
mov rdx, qword [rbp + 0x80]
test rdx, rdx
je 0x140022007
test r10, r10
je 0x140022011
cmp dword [0x14020fbb8], r15d
je 0x140022011
add rdx, 0x40
mov qword [rsp + 0x20], r15
mov r9d, 0xc
lea r8, [rsp + 0x48]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140022011
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
movsd xmm0, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
mov eax, dword [rsp + 0x50]
movsd qword [rsp + 0x70], xmm0
mov dword [rsp + 0x78], eax
call fcn.140020ae0
mov rdx, qword [0x140210128]
test rdx, rdx
je 0x14002247c
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140022073
cmp dword [0x14020fbb8], r15d
je 0x140022073
add rdx, qword [0x14020fb88]
lea r8, [rbp + 0xb8]
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xb8]
test rdx, rdx
je 0x14002247c
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x1400220b4
cmp dword [0x14020fbb8], r15d
je 0x1400220b4
add rdx, 0x20
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x90]
test rbx, rbx
je 0x14002247c
mov eax, dword [r12 + r14]
cmp dword [0x140210350], eax
jle 0x14002212c
lea rcx, [0x140210350]
call fcn.140099fe8
cmp dword [0x140210350], 0xffffffff
jne 0x14002212c
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140022113
cmp dword [0x14020fbb8], r15d
je 0x140022113
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x28]
lea rcx, [0x140210350]
movss dword [0x140210370], xmm0
call fcn.140099f7c
mov eax, dword [r12 + r14]
cmp dword [0x14021033c], eax
jle 0x140022193
lea rcx, [0x14021033c]
call fcn.140099fe8
cmp dword [0x14021033c], 0xffffffff
jne 0x140022193
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x14002217e
cmp dword [0x14020fbb8], r15d
je 0x14002217e
lea rdx, [rbx + 0x2e4]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x24]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp - 0x24]
lea rcx, [0x14021033c]
mov dword [0x14021037c], eax
call fcn.140099f7c
mov eax, dword [r12 + r14]
cmp dword [0x140210380], eax
jle 0x1400221fa
lea rcx, [0x140210380]
call fcn.140099fe8
cmp dword [0x140210380], 0xffffffff
jne 0x1400221fa
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x1400221e5
cmp dword [0x14020fbb8], r15d
je 0x1400221e5
lea rdx, [rbx + 0x2e8]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp - 0x20]
lea rcx, [0x140210380]
mov dword [0x140210378], eax
call fcn.140099f7c
mov eax, dword [r12 + r14]
cmp dword [0x140210340], eax
jle 0x140022265
lea rcx, [0x140210340]
call fcn.140099fe8
cmp dword [0x140210340], 0xffffffff
jne 0x140022265
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x14002224c
cmp dword [0x14020fbb8], r15d
je 0x14002224c
lea rdx, [rbx + 0x8c]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x1c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x1c]
lea rcx, [0x140210340]
movss dword [0x14021035c], xmm0
call fcn.140099f7c
mov eax, dword [r12 + r14]
cmp dword [0x140210360], eax
jle 0x1400222d0
lea rcx, [0x140210360]
call fcn.140099fe8
cmp dword [0x140210360], 0xffffffff
jne 0x1400222d0
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x1400222b7
cmp dword [0x14020fbb8], r15d
je 0x1400222b7
lea rdx, [rbx + 0x2f4]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x18]
lea rcx, [0x140210360]
movss dword [0x14021032c], xmm0
call fcn.140099f7c
movzx eax, byte [0x1402102a8]
cmp byte [0x14020fd6a], al
je 0x140022331
test al, al
je 0x1400222e9
mov dword [rbp - 0x48], r15d
jmp 0x1400222f6
movss xmm0, dword [0x140210370]
movss dword [rbp - 0x48], xmm0
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x14002232b
cmp dword [0x14020fbb8], r15d
je 0x14002232b
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, byte [0x1402102a8]
mov byte [0x14020fd6a], al
movzx edx, byte [0x1402102a9]
cmp byte [0x14020fd70], dl
je 0x14002247c
mov eax, dword [0x14021037c]
test dl, dl
mov rcx, qword [0x14020fc50]
cmovne eax, r15d
mov dword [rbp - 0x10], eax
test rcx, rcx
je 0x14002238b
cmp dword [0x14020fbb8], r15d
je 0x14002238b
lea rdx, [rbx + 0x2e4]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx edx, byte [0x1402102a9]
mov eax, dword [0x140210378]
test dl, dl
mov rcx, qword [0x14020fc50]
cmovne eax, r15d
mov dword [rbp - 0x60], eax
test rcx, rcx
je 0x1400223d2
cmp dword [0x14020fbb8], r15d
je 0x1400223d2
lea rdx, [rbx + 0x2e8]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx edx, byte [0x1402102a9]
test dl, dl
je 0x1400223df
mov dword [rbp - 0x40], 0x3c23d70a
jmp 0x1400223ec
movss xmm0, dword [0x14021032c]
movss dword [rbp - 0x40], xmm0
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140022424
cmp dword [0x14020fbb8], r15d
je 0x140022424
lea rdx, [rbx + 0x2f4]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx edx, byte [0x1402102a9]
test dl, dl
je 0x140022431
mov dword [rbp - 0x68], 0x43520000
jmp 0x14002243e
movss xmm0, dword [0x14021035c]
movss dword [rbp - 0x68], xmm0
mov rcx, qword [0x14020fc50]
test rcx, rcx
je 0x140022476
cmp dword [0x14020fbb8], r15d
je 0x140022476
lea rdx, [rbx + 0x8c]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx edx, byte [0x1402102a9]
mov byte [0x14020fd70], dl
cmp byte [0x1402102ac], r15b
je 0x1400212f1
movaps xmm9, xmmword [rsp + 0x1d0]
movaps xmm8, xmmword [rsp + 0x1e0]
movaps xmm7, xmmword [rsp + 0x1f0]
movaps xmm6, xmmword [rsp + 0x200]
mov r15, qword [rsp + 0x210]
mov r14, qword [rsp + 0x218]
mov r13, qword [rsp + 0x220]
mov r12, qword [rsp + 0x228]
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x248]
mov rbx, qword [rsp + 0x240]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.140099c70
add rsp, 0x230
pop rbp
ret