Function at 0x14003e720
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x1f0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x14004e010]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov ecx, 1
call fcn.14003fe2c
mov qword [rbp - 0x20], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14003f510]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14003f232
cmp dword [rsp + 0x78], r12d
jne 0x14003e7b9
lea ecx, [r12 + 1]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14003e7da
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov dword [rbp - 0x80], 0x50
mov dword [rbp - 0x7c], 0x40
lea rax, [0x14003f260]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp - 0x68], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
lea rbx, str.main
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], r12
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], r12
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x80000000
mov r8, rbx
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
mov qword [0x14004e970], rax
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rcx, rax
mov qword [0x14004e968], rax
test rax, rax
je 0x14003f1e5
mov qword [0x14004e920], r12
mov qword [0x14004e92c], r12
mov dword [0x14004e934], r12d
mov qword [0x14004e93c], r12
mov dword [0x14004e944], r12d
mov qword [0x14004e954], r12
mov dword [0x14004e948], 1
mov dword [0x14004e938], 1
mov dword [0x14004e928], r12d
mov dword [0x14004e94c], 1
mov dword [0x14004e950], 0x50
mov dword [0x14004e95c], 1
mov rax, qword [rax]
lea rdx, [0x14004e960]
mov qword [rsp + 0x30], rdx
lea rdx, [0x14004e920]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
mov r9, rbx
xor edx, edx
lea r8d, [rdx + 1]
call qword [rax + 0x80]
test eax, eax
js 0x14003f1de
xor edx, edx
mov rcx, qword [0x14004e970]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14004e970]
call qword [sym.imp.USER32.dll_UpdateWindow]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [0x14004e910]
test rax, rax
je 0x14003e986
inc dword [rax + 0x3b0]
mov rdx, qword [0x14004e900]
mov ecx, 0x40b0
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rbp - 0x20], rax
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x30], rcx
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14003e9bd
xor edx, edx
mov rcx, rax
call fcn.140001400
mov rcx, rax
jmp 0x14003e9c0
mov rcx, r12
mov rax, qword [0x14004e910]
test rax, rax
cmove rax, rcx
mov qword [0x14004e910], rax
call fcn.140007a50
mov r15, qword [0x14004e910]
mov qword [r15 + 0x20], r12
or dword [r15 + 8], 0x400
xor ecx, ecx
call fcn.140028c00
mov dword [r15 + 0x1644], r12d
mov dword [r15 + 0x1660], r12d
mov dword [r15 + 0x1678], r12d
mov dword [r15 + 0x16b4], r12d
mov dword [r15 + 0x1668], r12d
mov dword [r15 + 0x16ac], r12d
mov dword [r15 + 0x16bc], r12d
call fcn.140032cd0
mov rcx, qword [0x14004e960]
mov rbx, qword [0x14004e910]
lea rax, str.imgui_impl_dx9
mov qword [rbx + 0xe8], rax
or dword [rbx + 0xc], 0x1008
mov qword [0x14004e9b0], rcx
mov rax, qword [rcx]
call qword [rax + 8]
test dword [rbx + 8], 0x400
je 0x14003eab0
mov rax, qword [0x14004e910]
lea rcx, [fcn.140032990]
mov qword [rax + 0x15f0], rcx
lea rcx, [0x140032a60]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x140032af0]
mov qword [rax + 0x1600], rcx
lea rcx, [0x140032b50]
mov qword [rax + 0x1608], rcx
lea rcx, [0x140032ca0]
mov qword [rax + 0x1610], rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 8]
add eax, 0xfffffe98
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mulss xmm6, dword [0x1400469bc]
mov eax, dword [rbp - 4]
add eax, 0xffffff38
movd xmm7, eax
cvtdq2ps xmm7, xmm7
mulss xmm7, dword [0x1400469bc]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
lea r14, [0x140041814]
lea r13, [0x140000000]
mov esi, 0x8000
movss xmm8, dword [0x140046a00]
nop dword [rax]
cmp byte [0x14004e90a], 0
jne 0x14003f07e
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14003eb64
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14003f06c
cmp qword [0x14004e9a0], 0
jne 0x14003ebca
cmp qword [0x14004e9b0], 0
je 0x14003ebca
call fcn.140032630
test al, al
je 0x14003ebca
mov rsi, qword [0x14004e910]
mov edi, 1
cmp dword [rsi + 0x1628], edi
jle 0x14003ebc5
mov ebx, 8
nop word [rax + rax]
mov rax, qword [rsi + 0x1630]
mov rcx, qword [rbx + rax]
cmp qword [rcx + 0x38], 0
jne 0x14003ebb7
call fcn.140032990
inc edi
add rbx, 8
cmp edi, dword [rsi + 0x1628]
jl 0x14003eba0
mov esi, 0x8000
mov rdi, qword [0x14004e910]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
mov rcx, qword [0x14004e9d8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x78]
sub eax, dword [rsp + 0x70]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rsp + 0x7c]
sub eax, dword [rsp + 0x74]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
cmp byte [0x14004e053], 0
je 0x14003ec6d
mov rbx, qword [0x14004e910]
mov ecx, dword [rbx + 0x161c]
test ecx, ecx
jns 0x14003ec4b
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov edx, r12d
test eax, eax
cmovg edx, eax
lea rcx, [rbx + 0x1618]
call fcn.140021380
mov dword [rbx + 0x1618], r12d
xor r9d, r9d
lea r8, [0x140033730]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov byte [0x14004e053], 0
mov qword [rbp - 0x30], r12
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
sub rax, qword [0x14004e9e0]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14004e9e8]
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x14004e9e0], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x13c], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x13d], al
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x13e], al
mov byte [rdi + 0x13f], 0
call fcn.140033260
cmp byte [rdi + 0xcf], 0
je 0x14003ed0b
mov eax, 0xffffffff
jmp 0x14003ed18
mov rax, qword [0x14004e910]
mov eax, dword [rax + 0x20d0]
cmp dword [0x14004e05c], eax
je 0x14003ed2b
mov dword [0x14004e05c], eax
call fcn.1400330e0
call fcn.140033460
call fcn.140006760
mov rcx, qword [0x14004e910]
movss dword [rcx + 0x1dd4], xmm6
movss dword [rcx + 0x1dd8], xmm7
mov qword [rcx + 0x1ddc], r12
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
mov dword [rcx + 0x1de4], 0x43b40000
mov dword [rcx + 0x1de8], 0x43480000
mov dword [rcx + 0x1dc8], 1
or dword [rcx + 0x1dc0], 0x43
mov dword [rcx + 0x1e20], 0x3f800000
mov r8d, 0x168
lea rdx, [0x14004e050]
lea rcx, str.Cluckinbell_Tool_by_space785___unkowncheats.com
call fcn.14000ccd0
call fcn.140038730
mov dword [rbp - 0x20], 0x42f00000
mov dword [rbp - 0x1c], 0x41a00000
lea rcx, str.Skip_Key
call fcn.140036700
movsxd rax, dword [0x14004e978]
test eax, eax
je 0x14003edee
cmp byte [0x14004ea01], 0
je 0x14003ede4
mov r8, r14
jmp 0x14003ee00
mov r8, qword [r13 + rax*8 + 0x45e40]
jmp 0x14003ee00
lea r8, str.None
cmp byte [0x14004ea01], 0
cmovne r8, r14
mov r9d, 1
lea rdx, str._s_d
lea rcx, [rbp + 0x30]
call fcn.14003f490
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x30]
call fcn.140037140
test al, al
je 0x14003ee53
mov rax, r12
cmp rax, 0x100
jae 0x14003f243
mov byte [rax + r13 + 0x4ea00], 0
inc rax
cmp rax, 0x100
jl 0x14003ee30
mov byte [0x14004ea01], 1
jmp 0x14003ee5c
cmp byte [0x14004ea01], 0
je 0x14003ee8d
mov ebx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x14003ee77
inc ebx
cmp ebx, 0x7c
jb 0x14003ee61
jmp 0x14003ee8d
mov eax, r12d
cmp ebx, 0x1b
cmovne eax, ebx
mov dword [0x14004e978], eax
mov byte [0x14004ea01], 0
lea rdx, [0x140046950]
cmp byte [0x14004e051], 0
lea rax, [0x14004694c]
cmovne rdx, rax
lea rcx, str.Network_is__s
call fcn.140036700
call fcn.14000fbc0
call fcn.140008f50
mov rcx, qword [0x14004e960]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r12d
movss dword [rsp + 0x28], xmm8
mov dword [rsp + 0x20], r12d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x14004e960]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14003ef37
call fcn.1400094c0
mov rax, qword [0x14004e910]
mov rcx, qword [rax + 0x1ef8]
mov rax, qword [rcx]
add rax, 0xa8
mov rcx, r12
cmp byte [rax], r12b
cmovne rcx, rax
call fcn.140032030
mov rcx, qword [0x14004e960]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [r15 + 8], 0x400
je 0x14003f021
call fcn.140018500
mov rbx, qword [0x14004e910]
mov r14d, 1
mov eax, dword [rbx + 0x1628]
cmp eax, r14d
jle 0x14003efbc
mov esi, 8
nop word [rax + rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [rsi + rax]
test dword [rdi + 4], 0x400
jne 0x14003efaa
mov rax, qword [rbx + 0x15c0]
test rax, rax
je 0x14003ef97
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1608]
test rax, rax
je 0x14003efaa
xor edx, edx
mov rcx, rdi
call rax
inc r14d
add rsi, 8
mov eax, dword [rbx + 0x1628]
cmp r14d, eax
jl 0x14003ef70
mov r14d, 1
cmp eax, r14d
jle 0x14003f01a
mov esi, 8
nop dword [rax]
mov rax, qword [rbx + 0x1630]
mov rdi, qword [rsi + rax]
test dword [rdi + 4], 0x400
jne 0x14003f00a
mov rax, qword [rbx + 0x15c8]
test rax, rax
je 0x14003eff7
xor edx, edx
mov rcx, rdi
call rax
mov rax, qword [rbx + 0x1610]
test rax, rax
je 0x14003f00a
xor edx, edx
mov rcx, rdi
call rax
inc r14d
add rsi, 8
cmp r14d, dword [rbx + 0x1628]
jl 0x14003efd0
lea r14, [0x140041814]
mov rcx, qword [0x14004e960]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14003f05e
mov rcx, qword [0x14004e960]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14003f05e
call fcn.14003e4b0
cmp byte [0x14004e050], 0
je 0x14003f077
mov esi, 0x8000
cmp dword [rbp + 8], 0x12
je 0x14003f07e
jmp 0x14003eb20
mov dword [rbp + 8], 0x12
call fcn.140018ac0
call fcn.140032850
mov rcx, qword [0x14004e9b0]
test rcx, rcx
je 0x14003f0a1
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e9b0], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rcx, qword [0x14004e9c0]
test rcx, rcx
je 0x14003f0cb
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14004e9c0], r12
mov qword [0x14004e9c8], r12
mov qword [0x14004e9d0], r12
mov qword [0x14004e9d8], r12
mov qword [0x14004e9e0], r12
mov qword [0x14004e9e8], r12
mov dword [0x14004e05c], 9
mov byte [0x14004e97c], 0
mov byte [0x14004e052], 1
mov rbx, qword [0x14004e910]
mov rcx, rbx
call fcn.140007dc0
mov rax, qword [0x14004e910]
cmp rax, rbx
cmove rax, r12
mov qword [0x14004e910], rax
test rbx, rbx
je 0x14003f15f
mov rcx, rbx
call fcn.140021b50
mov rax, qword [0x14004e910]
test rax, rax
je 0x14003f150
dec dword [rax + 0x3b0]
mov rdx, qword [0x14004e900]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [0x14004e960]
test rcx, rcx
je 0x14003f178
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e960], r12
mov rcx, qword [0x14004e968]
test rcx, rcx
je 0x14003f191
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e968], r12
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14003f570
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [0x14004e968]
mov rdx, qword [0x14004e960]
test rdx, rdx
je 0x14003f208
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov qword [0x14004e960], r12
mov rcx, qword [0x14004e968]
test rcx, rcx
je 0x14003f21a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x14004e968], r12
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x14003f19f
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.14003fc98
int3
jmp 0x14003e720