Function at 0x140001e50
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0xb8]
sub rsp, 0x1b8
mov rax, qword [0x140067040]
xor rax, rsp
mov qword [rbp + 0x38], rax
lea rcx, [rbp - 0x70]
call fcn.14004bd00
mov ecx, dword [rbp - 0x50]
lea rax, [rsp + 0x50]
xorps xmm0, xmm0
mov qword [rbp + 8], rax
movdqu xmmword [rbp + 0x18], xmm0
lea rax, [rbp - 0x70]
mov byte [rsp + 0x50], 1
mov qword [rbp + 0x10], rax
xorps xmm1, xmm1
mov eax, ecx
sar eax, 0x10
movzx eax, al
movdqu xmmword [rbp + 0x28], xmm1
movss xmm1, dword [0x14005dc0c]
movd xmm0, eax
mov eax, ecx
cvtdq2ps xmm0, xmm0
sar eax, 8
movzx eax, al
divss xmm0, xmm1
movss dword [rbp - 0x38], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movzx eax, cl
mov ecx, 0x10
divss xmm0, xmm1
movss dword [rbp - 0x34], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
movss dword [rbp - 0x30], xmm0
call fcn.140054150
lea rcx, [rbp + 8]
xor ebx, ebx
mov r9, rax
lea r8, [0x140007190]
xor edx, edx
mov qword [rax], rcx
lea rcx, [0x1400029e0]
mov qword [rax + 8], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x1400024c6
cmp dword [rbp - 0x78], ebx
je 0x1400024ba
movaps xmm0, xmmword [rbp - 0x80]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400024ba
mov qword [rsp + 0x1d0], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x1e0], r12
mov ecx, 0x3e8
mov qword [rsp + 0x1b0], r13
mov qword [rsp + 0x1a8], r14
mov qword [rsp + 0x1a0], r15
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm7
movaps xmmword [rsp + 0x150], xmm10
movaps xmmword [rsp + 0x140], xmm11
movdqa xmmword [rbp - 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._FastFind__Starting_n
mov byte [rbp - 0x23], 1
mov r14d, ebx
mov esi, ebx
call fcn.1400024e0
lea rcx, str..FastFind64.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp - 0x80], rax
mov r13, rax
test rax, rax
jne 0x140002016
lea rdx, str.Could_not_load_the_dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400024e0
lea rdx, [0x140002730]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000206b
lea rdx, str.SnapShot
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GenericColorSearch
mov rcx, r13
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test r14, r14
jne 0x14000204a
lea rdx, str.Could_not_locate_SnapShot
jmp 0x140001ff8
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x14000205f
lea rdx, str.Could_not_locate_GenericColorSearch
jmp 0x140001fff
lea rdx, str._FastFind__Started_n
call fcn.1400024e0
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.1400071c0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 1
sub eax, edx
sar eax, 1
mov r15d, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [rbp - 0x2c]
cdq
sub eax, edx
movd xmm10, r15d
sar eax, 1
mov r12d, eax
mov eax, dword [rbp - 0x5c]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
movd xmm11, r12d
add ecx, r15d
mov dword [rsp + 0x54], ecx
mov ecx, dword [rbp - 0x28]
sub ecx, eax
add ecx, r12d
cvtdq2ps xmm10, xmm10
mov dword [rsp + 0x58], ecx
cvtdq2ps xmm11, xmm11
movaps xmm6, xmm10
movaps xmm7, xmm11
cmp byte [rsp + 0x50], bl
je 0x140002446
mov qword [rsp + 0x1d8], rdi
mov r13d, 0x14
movaps xmmword [rsp + 0x170], xmm8
movss xmm8, dword [0x14005db08]
movaps xmmword [rsp + 0x160], xmm9
movss xmm9, dword [0x14005db50]
nop dword [rax + rax]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbp - 0x67], 0
je 0x14000225a
mov ecx, dword [rbp - 0x64]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000225a
mov eax, dword [rbp - 0x5c]
test eax, eax
jns 0x14000214e
inc eax
mov edx, dword [0x140067a54]
mov ecx, dword [0x140067a50]
sar eax, 1
mov dword [rsp + 0x20], 1
lea r9d, [rax + rdx]
sub edx, eax
lea r8d, [rax + rcx]
sub ecx, eax
call r14
test eax, eax
jne 0x14000218f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str._nScreenshot_failed
call fcn.1400024e0
jmp 0x140002248
mov eax, dword [rbp - 0x3c]
lea r9, [rsp + 0x58]
mov ecx, dword [rbp - 0x40]
lea r8, [rsp + 0x54]
mov dword [rsp + 0x5c], eax
lea rdx, [rsp + 0x5c]
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x20], eax
call rsi
test eax, eax
jne 0x1400021e7
mov eax, dword [rbp - 0x48]
lea rdx, str._nPixelsearch_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [rsp + 0x54], eax
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x58], eax
call fcn.1400024e0
jmp 0x140002248
xorps xmm0, xmm0
mov dword [rbp - 0x20], ebx
xorps xmm1, xmm1
mov dword [rbp - 0xc], 2
mov r8d, 0x28
lea rdx, [rbp - 0x20]
mov ecx, 1
movdqu xmmword [rbp - 0x1c], xmm0
movdqu xmmword [rbp - 8], xmm1
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rbp - 0xc], 4
lea rdx, [rbp - 0x20]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [rbp - 0x64]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140002145
mov ecx, dword [rbp - 0x70]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000241d
nop dword [rax]
mov eax, dword [rbp - 0x5c]
test eax, eax
jns 0x140002279
inc eax
mov edx, dword [0x140067a54]
mov ecx, dword [0x140067a50]
sar eax, 1
mov dword [rsp + 0x20], 1
lea r9d, [rax + rdx]
sub edx, eax
lea r8d, [rax + rcx]
sub ecx, eax
call r14
test eax, eax
jne 0x1400022ba
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str._nScreenshot_failed
call fcn.1400024e0
jmp 0x14000240b
mov eax, dword [rbp - 0x3c]
lea r9, [rsp + 0x58]
mov ecx, dword [rbp - 0x40]
lea r8, [rsp + 0x54]
mov dword [rsp + 0x5c], eax
lea rdx, [rsp + 0x5c]
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x20], eax
call rsi
test eax, eax
jne 0x140002315
mov eax, dword [rbp - 0x48]
lea rdx, str._nPixelsearch_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov dword [rsp + 0x54], eax
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x58], eax
call fcn.1400024e0
jmp 0x14000240b
mov edx, dword [rbp - 0x58]
mov ecx, dword [rbp - 0x54]
sub edx, r15d
add edx, dword [rsp + 0x54]
sub ecx, r12d
mov r8d, dword [rsp + 0x58]
add r8d, 0xfffffffa
add r8d, ecx
lea eax, [rdx + 0xa]
cmp eax, r13d
ja 0x140002342
cmp r8d, r13d
jbe 0x14000240b
movss xmm2, dword [rbp - 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, edx
xorps xmm1, xmm1
subss xmm0, xmm6
cvtsi2ss xmm1, r8d
mulss xmm0, xmm8
subss xmm1, xmm7
addss xmm6, xmm0
movaps xmm0, xmm2
mulss xmm1, xmm8
mulss xmm0, xmm6
addss xmm7, xmm1
cvttss2si edi, xmm0
mulss xmm2, xmm7
cvttss2si ebx, xmm2
cmp edi, 0xffffffec
jge 0x14000238f
mov edi, 0xffffffec
jmp 0x140002396
cmp edi, r13d
cmovg edi, r13d
cmp ebx, 0xffffffec
jge 0x1400023a2
mov ebx, 0xffffffec
jmp 0x1400023a9
cmp ebx, r13d
cmovg ebx, r13d
movaps xmm1, xmm7
movaps xmm0, xmm6
subss xmm1, xmm11
subss xmm0, xmm10
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
comiss xmm0, xmm9
mov edx, dword [rsp + 0x68]
lea r8, [rsp + 0x6c]
mov rcx, qword [rsp + 0x60]
mov r9d, 1
jbe 0x1400023f5
xor eax, eax
mov dword [rsp + 0x74], edi
mov word [rsp + 0x6e], ax
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x78], ebx
call qword [sym.imp.interception.dll_interception_send]
xor ebx, ebx
jmp 0x14000240b
xor ebx, ebx
mov word [rsp + 0x6e], bx
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x74], ebx
call qword [sym.imp.interception.dll_interception_send]
mov ecx, dword [rbp - 0x70]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140002270
cmp byte [rsp + 0x50], 0
jne 0x140002120
movaps xmm9, xmmword [rsp + 0x160]
movaps xmm8, xmmword [rsp + 0x170]
mov rdi, qword [rsp + 0x1d8]
mov r13, qword [rbp - 0x80]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rbp - 0x70]
call fcn.14004d500
movaps xmm11, xmmword [rsp + 0x140]
xor eax, eax
movaps xmm10, xmmword [rsp + 0x150]
movaps xmm7, xmmword [rsp + 0x180]
movaps xmm6, xmmword [rsp + 0x190]
mov r15, qword [rsp + 0x1a0]
mov r14, qword [rsp + 0x1a8]
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1e0]
mov rsi, qword [rsp + 0x1d0]
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.140054130
add rsp, 0x1b8
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x78], ebx
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3