Function at 0x14001ea30
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x210
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x188], 0xfffffffffffffffe
cmp byte [0x1401792ca], 0
jne 0x14001f0f7
cmp byte [0x140208b10], 0
je 0x14001f0f7
mov rsi, rcx
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rbp + 0x160], ymm0
mov rdi, qword [rcx + 0xb0]
cmp qword [rcx + 0xb8], 0x10
jb 0x14001ea97
mov r14, qword [rsi + 0xa0]
jmp 0x14001ea9e
lea r14, [rsi + 0xa0]
test rdi, rdi
js 0x14001f10a
cmp rdi, 0xf
ja 0x14001eadb
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], 0xf
vmovups xmm0, xmmword [r14]
vmovaps xmmword [rbp + 0x160], xmm0
mov r15d, 0xf
mov rbx, qword [rbp + 0x160]
jmp 0x14001eb49
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp r15, 0xfff
jb 0x14001eb16
lea rcx, [r15 + 0x28]
vzeroupper
call fcn.1400f4cf4
mov rbx, rax
add rbx, 0x27
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14001eb25
lea rcx, [r15 + 1]
vzeroupper
call fcn.1400f4cf4
mov rbx, rax
mov qword [rbp + 0x160], rbx
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], r15
lea r8, [rdi + 1]
mov rcx, rbx
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r14, qword [0x140209000]
cmp qword [0x140208ff8], rdi
jne 0x14001eb8d
cmp r14, 0x10
jb 0x14001eb68
mov rcx, qword [0x140208fe8]
jmp 0x14001eb6f
lea rcx, [0x140208fe8]
cmp r15, 0x10
lea rdx, [rbp + 0x160]
cmovae rdx, rbx
mov r8, rdi
vzeroupper
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001ebee
mov byte [0x140209010], 0
cmp r15, 0x10
lea r9, [rbp + 0x160]
cmovae r9, rbx
cmp r14, rdi
jae 0x14001ebbc
lea rcx, [0x140208fe8]
mov rdx, rdi
vzeroupper
call fcn.140017910
jmp 0x14001ebee
cmp r14, 0x10
jb 0x14001ebcb
mov rbx, qword [0x140208fe8]
jmp 0x14001ebd2
lea rbx, [0x140208fe8]
mov qword [0x140208ff8], rdi
mov rcx, rbx
mov rdx, r9
mov r8, rdi
vzeroupper
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
vmovaps ymm0, ymmword [str.smokegre]
vmovups ymmword [rbp - 0x50], ymm0
mov dword [rbp - 0x48], 0x6564616e
vmovaps ymm0, ymmword [str.flashban]
vmovups ymmword [rbp - 0x30], ymm0
mov byte [rbp - 0x28], 0x67
vmovaps ymm0, ymmword [str.hegrenad]
vmovups ymmword [rbp - 0x10], ymm0
mov byte [rbp - 8], 0x65
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x28], 0xf
mov dword [rbp + 0x13], 0x766f746f
mov dword [rbp + 0x10], 0x6f6c6f6d
mov byte [rbp + 0x17], 0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], 5
mov qword [rbp + 0x48], 0xf
mov dword [rbp + 0x30], 0x6f636564
mov byte [rbp + 0x34], 0x79
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0xa
mov qword [rbp + 0x68], 0xf
movabs rax, 0x616e657267636e69
mov qword [rbp + 0x50], rax
mov word [rbp + 0x58], 0x6564
vmovups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], 3
mov qword [rbp + 0x88], 0xf
mov word [rbp + 0x70], 0x7761
mov byte [rbp + 0x72], 0x70
vmovups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], 5
mov qword [rbp + 0xa8], 0xf
mov dword [rbp + 0x90], 0x30677373
mov byte [rbp + 0x94], 0x38
vmovups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], 3
mov qword [rbp + 0xc8], 0xf
mov word [rbp + 0xb0], 0x7561
mov byte [rbp + 0xb2], 0x67
vmovups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], 5
mov qword [rbp + 0xe8], 0xf
mov dword [rbp + 0xd0], 0x35356773
mov byte [rbp + 0xd4], 0x36
vmovups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], 5
mov qword [rbp + 0x108], 0xf
mov dword [rbp + 0xf0], 0x66696e6b
mov byte [rbp + 0xf4], 0x65
vmovups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], 2
mov qword [rbp + 0x128], 0xf
mov word [rbp + 0x110], 0x3463
lea rax, [rbp + 0x130]
vmovaps xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x150], rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0x158], rax
lea rcx, [rbp + 0x130]
lea r8, [rbp + 0x158]
lea r9, [rbp + 0x150]
mov edx, 0xc
vzeroupper
call fcn.1400158f0
mov edi, 0x160
jmp 0x14001ee26
call fcn.1400f4d38
mov qword [rbp + rdi - 0x40], 0
mov qword [rbp + rdi - 0x38], 0xf
mov byte [rbp + rdi - 0x50], 0
add rdi, 0xffffffffffffffe0
cmp rdi, 0xffffffffffffffe0
je 0x14001ee64
mov rax, qword [rbp + rdi - 0x38]
cmp rax, 0x10
jb 0x14001ee05
mov rcx, qword [rbp + rdi - 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14001ee00
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001f076
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x14001ee00
mov rdi, qword [rbp + 0x130]
mov r15, qword [rbp + 0x138]
cmp rdi, r15
je 0x14001eed9
cmp qword [rbp + 0x178], 0x10
jb 0x14001ee8a
mov rbx, qword [rbp + 0x160]
jmp 0x14001ee91
lea rbx, [rbp + 0x160]
mov r14, qword [rbp + 0x170]
mov r12, rdi
jmp 0x14001eeb8
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001eed0
add r12, 0x20
cmp r12, r15
je 0x14001eed9
cmp qword [r12 + 0x10], r14
jne 0x14001eeaf
cmp qword [r12 + 0x18], 0x10
mov rcx, r12
jb 0x14001eea0
mov rcx, qword [r12]
jmp 0x14001eea0
cmp r12, r15
jne 0x14001f001
mov rcx, qword [0x140207ee0]
mov eax, dword [0x140207ee8]
test rcx, rcx
je 0x14001ef1e
test eax, eax
je 0x14001ef1e
mov edx, 0x12f8
add rdx, qword [rsi + 0x48]
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x50]
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140207ee0]
mov eax, dword [0x140207ee8]
test rcx, rcx
je 0x14001ef4c
test eax, eax
je 0x14001ef4c
mov edx, 0x1744
add rdx, qword [rbp - 0x50]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x158]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp + 0x158], 0
je 0x14001ef5c
mov byte [0x140209010], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x140179304], 0
jne 0x14001efa3
mov edi, eax
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001efa3
mov eax, edi
sub eax, dword [0x140209008]
cmp eax, 0x1f4
jb 0x14001efa3
movzx eax, byte [0x140209010]
xor al, 1
mov byte [0x140209010], al
mov dword [0x140209008], edi
jmp 0x14001efaa
movzx eax, byte [0x140209010]
test al, al
je 0x14001effa
mov dword [rbp + 0x150], 0x2d
cmp byte [0x1401792ca], 0
jne 0x14001effa
mov rcx, qword [0x140207ee0]
test rcx, rcx
je 0x14001effa
cmp dword [0x140207ee8], 0
je 0x14001effa
mov edx, 0x6cc
add rdx, qword [rsi]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x150]
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdi, qword [rbp + 0x130]
test rdi, rdi
je 0x14001f0b6
mov rsi, qword [rbp + 0x138]
cmp rdi, rsi
jne 0x14001f04b
jmp 0x14001f083
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400f4d38
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
add rdi, 0x20
cmp rdi, rsi
je 0x14001f07c
mov rax, qword [rdi + 0x18]
cmp rax, 0x10
jb 0x14001f02f
mov rcx, qword [rdi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14001f02a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x14001f020
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov rdi, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x140]
sub rdx, rdi
cmp rdx, 0x1000
jb 0x14001f0ae
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x14001f076
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
call fcn.1400f4d38
mov rax, qword [rbp + 0x178]
cmp rax, 0x10
jb 0x14001f0f7
mov rcx, qword [rbp + 0x160]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14001f0f2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14001f076
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400f4d38
nop
add rsp, 0x210
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
vzeroupper
call fcn.1400155f0
int3