Function at 0x140084920
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x9b0
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14015d040]
xor rax, rsp
mov qword [rbp + 0x948], rax
mov qword [rbp + 0x90], rcx
movabs rax, 0x85bdf14db358b274
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs r14, 0x9287ca9979433164
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs r15, 0x85d889289d6ac117
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x770], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x778], rax
movdqa xmm0, xmmword [rbp + 0x770]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x50], xmm0
lea rax, [rbp + 0x50]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400849d0
cmp qword [0x14015d388], 0
jne 0x140084ab8
nop word [rax + rax]
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x604]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x600], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
lea rdx, [rbp + 0x600]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140084a9c
lea rax, [rbp + 0x62c]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140084a40
mov r8, rdi
cmp rbx, rdi
cmovb r8, rbx
lea rdx, [rbp + 0x62c]
lea rcx, [rbp + 0x50]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140084a6e
cmp rdi, rbx
jb 0x140084a6e
jbe 0x140084a84
lea rdx, [rbp + 0x600]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140084a30
jmp 0x140084a9c
mov ecx, dword [rbp + 0x608]
mov dword [0x14015d380], ecx
call fcn.140082d60
mov qword [0x14015d388], rax
test rsi, rsi
je 0x140084aaa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x14015d388], 0
je 0x1400849f0
movabs r12, 0xe0acfa51ee1ca079
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs r13, 0x9287caf515271f09
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
movdqa xmm0, xmmword [rbp + 0x730]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
lea rax, [rbp + 0x20]
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140084b26
mov qword [rbp + 0x38], rax
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0xa0], xmm0
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x380]
call fcn.1400830e0
mov rbx, qword [rax]
lea rcx, [rbp + 0x380]
call fcn.14004e290
test rbx, rbx
jne 0x140084cd8
movabs rdi, 0x4e94914effff
movabs rsi, 0x431bde82d7b634db
movabs r15, 0x7fffffffe2329afe
movabs r14, 0x7fffffffffffffff
lea rcx, [rbp + 0x120]
call fcn.140049d70
mov rax, qword [rbp + 0x120]
cmp rax, r15
lea rbx, [rax + 0x1dcd6500]
jle 0x140084bb4
mov rbx, r14
lea rcx, [rbp + 0x128]
call fcn.140049d70
mov rax, qword [rbp + 0x128]
cmp rbx, rax
je 0x140084c11
jl 0x140084c11
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jg 0x140084c05
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140084bfc
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140084bb4
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140084bb4
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x85d889289d6ac117
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
movabs rax, 0x9287ca9979433164
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
movdqa xmm0, xmmword [rbp + 0x730]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
lea rax, [rbp + 0x20]
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x20]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140084c80
mov qword [rbp + 0x38], rax
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0xa0], xmm0
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x380]
call fcn.1400830e0
mov rbx, qword [rax]
lea rcx, [rbp + 0x380]
call fcn.14004e290
test rbx, rbx
je 0x140084b92
movabs r14, 0x9287ca9979433164
movabs r15, 0x85d889289d6ac117
movabs rax, 0xe1f6fd46f803ad74
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x9287ca9979435d08
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x760], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x768], rax
movdqa xmm0, xmmword [rbp + 0x760]
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x70], xmm0
lea rax, [rbp + 0x70]
mov qword [rbp + 0x220], rax
lea rcx, [rbp + 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140084d50
mov qword [rbp + 0x228], rax
movaps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x370], xmm0
lea rdx, [rbp + 0x370]
lea rcx, [0x14015efc0]
call fcn.140083800
test al, al
je 0x140085d17
movabs rax, 0xabeaec46f40daf72
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x9287ca99792f5d00
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x750], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x758], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x750]
movdqa xmmword [rbp + 0x40], xmm0
lea rax, [rbp + 0x40]
mov qword [rbp + 0x230], rax
lea rcx, [rbp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140084e00
mov qword [rbp + 0x238], rax
movaps xmm0, xmmword [rbp + 0x230]
movdqa xmmword [rbp + 0x360], xmm0
lea rdx, [rbp + 0x360]
lea rcx, [0x14015ef38]
call fcn.140083800
test al, al
je 0x140085e0c
movabs rax, 0xfcabe845f802a264
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xfeebaeb714264517
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rdi, 0x54faae060c813759
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs r13, 0x7b586a77d8fb2496
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x840], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x848], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x850], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x858], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x840]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x240], rax
lea rcx, [rbp + 0xc0]
mov rax, 0xffffffffffffffff
vzeroupper
inc rax
cmp byte [rcx + rax], 0
jne 0x140084f11
mov qword [rbp + 0x248], rax
movaps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x350], xmm0
lea rdx, [rbp + 0x350]
lea rcx, [0x14015efe8]
call fcn.140083800
test al, al
je 0x140085f69
movabs rax, 0xabace55dfc0ca453
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x9287ca99172c420e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x780], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x788], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x780]
movdqa xmmword [rbp + 0x60], xmm0
lea rax, [rbp + 0x60]
mov qword [rbp + 0x250], rax
lea rcx, [rbp + 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140084fc0
mov qword [rbp + 0x258], rax
movaps xmm0, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x340], xmm0
lea rcx, [rbp + 0x340]
call fcn.14004e870
test al, al
je 0x1400860bc
movabs rax, 0x85bd89409d09c144
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x92f3cab779223109
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x54faae060cf53721
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x880], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x888], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x890], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x898], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x880]
vmovdqu ymmword [rbp + 0x160], ymm1
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.140088b80
test al, al
je 0x140086193
call fcn.140083b60
test al, al
je 0x14008626a
cmp byte [0x14015ec41], 0
jne 0x1400850d3
call fcn.140081a70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, 0x80
mov rcx, qword [0x14015ec38]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.14007d2d0
movabs rax, 0xe6f6e844e808a459
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xf3f3afdb596e1107
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3a95d4422cf85579
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x1a311e1eb69204ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0xee90f5902ceef527
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0x9a627ce3028ea609
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs r9, 0xc7743412b13319fd
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs r8, 0x9c04f8b3883abd0a
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x8e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x8e8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x8f0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x8f8], rax
movabs rdx, 0x86b0d9f449949c4b
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x900], rax
movabs rcx, 0xbb0c098522ebd068
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x908], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x910], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x918], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x8e0]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x900]
vpxor ymm0, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x200], ymm0
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x260], rax
lea rcx, [rbp + 0x1e0]
mov rax, 0xffffffffffffffff
vzeroupper
inc rax
cmp byte [rcx + rax], 0
jne 0x1400852a1
mov qword [rbp + 0x268], rax
movaps xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x330], xmm0
lea rcx, [rbp + 0x330]
call fcn.140086480
xor r15d, r15d
movabs rsi, 0xdccf003ada4c08e3
lea r14, [0x14015f038]
mov r12d, 0xee6b2800
movabs rbx, 0xf1f8ed4df103a071
cmp byte [0x14015ec40], 0
jne 0x140085ce5
lea rcx, [rbp + 0x300]
call fcn.140049d70
mov rcx, qword [rax]
sub rcx, qword [0x14015e9a8]
cmp rcx, r12
jl 0x14008551e
call fcn.14007d2d0
test al, al
jne 0x14008542b
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xf7f3abfd0936110b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x2796cf6463ed5079
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x85d889289d6ac117
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x920], rax
movabs rax, 0x9287ca9979433164
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x928], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x930], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x938], rax
vmovdqu ymm0, ymmword [rbp + 0x920]
vpxor ymm0, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x100], ymm0
lea rax, [rbp + 0x100]
mov qword [rbp + 0x270], rax
lea rcx, [rbp + 0x100]
mov rax, 0xffffffffffffffff
vzeroupper
inc rax
cmp byte [rcx + rax], 0
jne 0x140085400
mov qword [rbp + 0x278], rax
movaps xmm0, xmmword [rbp + 0x270]
movdqa xmmword [rbp + 0x320], xmm0
lea rcx, [rbp + 0x320]
call fcn.140086480
mov qword [rbp + 0x5e8], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x5e8]
mov rdx, qword [0x14015ee90]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp + 0x450]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r15
mov r9d, 0x190
lea r8, [rbp + 0x450]
mov rdx, qword [rbp + 0x5e8]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rax, [0x14015ecf0]
lea rcx, [rbp + 0x450]
mov edx, 3
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x1400854b0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x310]
call fcn.140049d70
mov rcx, qword [rax]
mov qword [0x14015e9a8], rcx
mov rbx, qword [0x14015eb00]
mov r12d, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r12 + rcx]
cmp dword [0x14015eec4], eax
jle 0x14008557a
lea rcx, [0x14015eec4]
call fcn.1400f63ec
cmp dword [0x14015eec4], 0xffffffff
jne 0x14008557a
movabs rcx, 0xc08c21b68a2c746d
call fcn.14008a4b0
mov qword [0x14015eee0], rax
lea rcx, [0x14015eec4]
call fcn.1400f6380
mov rdx, qword [0x14015eee0]
add rdx, rbx
mov dword [rbp + 0x5e4], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x5e4]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
mov eax, dword [rbp + 0x5e4]
mov dword [0x14015ecc4], eax
cmp eax, dword [0x14015ecc8]
je 0x140085974
call fcn.1400846d0
mov rsi, qword [0x14015d368]
mov r14, qword [0x14015d370]
cmp rsi, r14
je 0x14008594d
mov rbx, qword [rsi]
test rbx, rbx
je 0x140085917
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [r12 + rdi]
cmp dword [0x14015eed8], eax
jle 0x14008563a
lea rcx, [0x14015eed8]
call fcn.1400f63ec
cmp dword [0x14015eed8], 0xffffffff
jne 0x14008563a
movabs rcx, 0xdccf003ada4c08e3
call fcn.14008a4b0
mov qword [0x14015ecd0], rax
lea rcx, [0x14015eed8]
call fcn.1400f6380
mov rdx, qword [0x14015ecd0]
add rdx, rbx
mov byte [rbp + 0x5e0], 0
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp + 0x5e0]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
cmp byte [rbp + 0x5e0], 0
je 0x140085917
mov eax, dword [r12 + rdi]
cmp dword [0x14015eec0], eax
jle 0x1400856bb
lea rcx, [0x14015eec0]
call fcn.1400f63ec
cmp dword [0x14015eec0], 0xffffffff
jne 0x1400856bb
movabs rcx, 0x5252226c300e74d9
call fcn.14008a4b0
mov qword [0x14015eed0], rax
lea rcx, [0x14015eec0]
call fcn.1400f6380
mov rdx, qword [0x14015eed0]
add rdx, rbx
mov byte [rbp + 0x5e3], 0
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp + 0x5e3]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
cmp byte [rbp + 0x5e3], 0
jne 0x140085917
mov eax, dword [r12 + rdi]
cmp dword [0x14015ec00], eax
jle 0x14008573c
lea rcx, [0x14015ec00]
call fcn.1400f63ec
cmp dword [0x14015ec00], 0xffffffff
jne 0x14008573c
movabs rcx, 0x737ddda9e99e0b5d
call fcn.14008a4b0
mov qword [0x14015ec08], rax
lea rcx, [0x14015ec00]
call fcn.1400f6380
mov rdx, qword [0x14015ec08]
add rdx, rbx
mov dword [rbp + 0x10], 0xffffffff
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x10]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
lea rcx, [rbp + 0x10]
call fcn.14007d420
test rax, rax
je 0x140085917
mov r8d, dword [0x14015efa0]
mov rcx, qword [0x14015d240]
sub rcx, qword [0x14015d238]
movabs rdi, 0x6666666666666667
mov rax, rdi
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jbe 0x140086341
lea rbx, [r8 + r8*4]
shl rbx, 4
add rbx, 0x10
add rbx, qword [0x14015d238]
je 0x1400857ec
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x1400857ec
add rcx, 8
lea rdx, [0x14015d920]
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x1400857ef
mov rbx, r15
cmp byte [rbx], 0
je 0x14008585e
mov ecx, dword [0x14015efa4]
call fcn.1400794a0
mov ecx, dword [rax]
test ecx, ecx
je 0x14008585e
mov eax, dword [rax + 4]
test eax, eax
jne 0x140085814
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x14008581f
cmp eax, 1
jne 0x14008582b
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
test al, al
je 0x14008585e
jmp 0x140085830
cmp eax, 2
jne 0x14008585e
mov ecx, dword [0x14015efac]
call fcn.140079410
movss xmm0, dword [rax]
movss dword [0x14015eeb8], xmm0
mov ecx, dword [0x14015efa8]
call fcn.140079410
movss xmm0, dword [rax]
movss dword [0x14015eebc], xmm0
mov r8d, dword [0x14015efb0]
mov rcx, qword [0x14015d240]
sub rcx, qword [0x14015d238]
mov rax, rdi
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jbe 0x140086346
lea rbx, [r8 + r8*4]
shl rbx, 4
add rbx, 0x10
add rbx, qword [0x14015d238]
je 0x1400858c4
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x1400858c4
add rcx, 8
lea rdx, [0x14015d920]
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x1400858c7
mov rbx, r15
cmp byte [rbx], 0
je 0x140085917
mov ecx, dword [0x14015efb4]
call fcn.1400794a0
mov ecx, dword [rax]
test ecx, ecx
je 0x140085901
mov eax, dword [rax + 4]
test eax, eax
jne 0x1400858ec
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x1400858f7
cmp eax, 1
jne 0x140085920
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
test al, al
jne 0x140085925
lea rcx, [rbp + 0xe0]
call fcn.140049d70
mov rcx, qword [rax]
mov qword [0x14015d258], rcx
add rsi, 0x10
jmp 0x1400855d6
cmp eax, 2
jne 0x140085901
mov ecx, dword [0x14015efb8]
call fcn.140079530
mov eax, dword [rax]
mov dword [0x14015d250], eax
lea rcx, [rbp + 0x308]
call fcn.140049d70
add rsi, 0x10
jmp 0x1400855d6
mov eax, dword [0x14015ecc4]
mov dword [0x14015ecc8], eax
movabs rdi, 0x54faae060c813759
movabs rsi, 0xdccf003ada4c08e3
lea r14, [0x14015f038]
cmp qword [0x14015f058], 0
je 0x140085986
mov rcx, r14
call fcn.140057040
cmp byte [0x14015ec41], 0
je 0x140085be4
mov r14, qword [0x14015d368]
mov r15, qword [0x14015d370]
cmp r14, r15
je 0x140085bd0
mov rdi, qword [r14]
test rdi, rdi
je 0x140085bbd
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov eax, dword [r12 + rbx]
cmp dword [0x14015eed8], eax
jle 0x1400859fe
lea rcx, [0x14015eed8]
call fcn.1400f63ec
cmp dword [0x14015eed8], 0xffffffff
jne 0x1400859fe
mov rcx, rsi
call fcn.14008a4b0
mov qword [0x14015ecd0], rax
lea rcx, [0x14015eed8]
call fcn.1400f6380
mov rdx, qword [0x14015ecd0]
add rdx, rdi
mov byte [rbp + 0x5e2], 0
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 1]
lea r8, [rbp + 0x5e2]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
cmp byte [rbp + 0x5e2], sil
je 0x140085bbd
mov eax, dword [r12 + rbx]
cmp dword [0x14015eec0], eax
jle 0x140085a7f
lea rcx, [0x14015eec0]
call fcn.1400f63ec
cmp dword [0x14015eec0], 0xffffffff
jne 0x140085a7f
movabs rcx, 0x5252226c300e74d9
call fcn.14008a4b0
mov qword [0x14015eed0], rax
lea rcx, [0x14015eec0]
call fcn.1400f6380
mov rdx, qword [0x14015eed0]
add rdx, rdi
mov byte [rbp + 0x5e1], 0
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp + 0x5e1]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
cmp byte [rbp + 0x5e1], 0
jne 0x140085bbd
mov eax, dword [r12 + rbx]
cmp dword [0x14015ec00], eax
jle 0x140085b00
lea rcx, [0x14015ec00]
call fcn.1400f63ec
cmp dword [0x14015ec00], 0xffffffff
jne 0x140085b00
movabs rcx, 0x737ddda9e99e0b5d
call fcn.14008a4b0
mov qword [0x14015ec08], rax
lea rcx, [0x14015ec00]
call fcn.1400f6380
mov rdx, qword [0x14015ec08]
add rdx, rdi
mov dword [rbp + 0x14], 0xffffffff
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x14]
mov rcx, qword [0x14015d388]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
lea rcx, [rbp + 0x14]
call fcn.14007d420
mov rsi, rax
test rax, rax
je 0x140085bbd
mov r8d, dword [0x14015ef68]
mov rcx, qword [0x14015d240]
mov r9, qword [0x14015d238]
sub rcx, r9
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 5
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
cmp rdx, r8
jbe 0x14008634b
lea rbx, [r8 + r8*4]
shl rbx, 4
add rbx, 0x10
add rbx, r9
je 0x140085bab
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x140085bab
add rcx, 8
lea rdx, [0x14015d920]
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x140085bad
xor ebx, ebx
cmp byte [rbx], 0
je 0x140085bbd
mov r8, rsi
mov rdx, rdi
call fcn.140079ad0
add r14, 0x10
movabs rsi, 0xdccf003ada4c08e3
jmp 0x1400859a1
movabs rdi, 0x54faae060c813759
xor r15d, r15d
lea r14, [0x14015f038]
xorps xmm0, xmm0
movups xmmword [rbp + 0x5f0], xmm0
lea r12, [0x14015ef00]
mov qword [rbp + 0x5f0], r12
mov rcx, r12
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov byte [rbp + 0x5f8], 1
lea rdx, [0x14015f010]
cmp r14, rdx
je 0x140085cbe
mov rax, qword [0x14015f038]
mov rcx, qword [0x14015f010]
mov qword [0x14015f038], rcx
mov qword [0x14015f010], rax
test rcx, rcx
je 0x140085c46
mov qword [rcx], r14
mov rax, qword [0x14015f010]
test rax, rax
je 0x140085c4e
mov qword [rax], rdx
mov rcx, qword [0x14015f040]
mov rax, qword [0x14015f018]
mov qword [0x14015f040], rax
mov qword [0x14015f018], rcx
mov rcx, qword [0x14015f048]
mov rax, qword [0x14015f020]
mov qword [0x14015f048], rax
mov qword [0x14015f020], rcx
mov rcx, qword [0x14015f050]
mov rax, qword [0x14015f028]
mov qword [0x14015f050], rax
mov qword [0x14015f028], rcx
mov rcx, qword [0x14015f058]
mov rax, qword [0x14015f030]
mov qword [0x14015f058], rax
mov qword [0x14015f030], rcx
mov rcx, r12
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
call fcn.140081690
test al, al
je 0x140085ce7
mov qword [rbp + 8], 1
lea rcx, [rbp + 8]
call fcn.1400863b0
jmp 0x1400852e0
xor al, al
mov rcx, qword [rbp + 0x948]
xor rcx, rsp
call fcn.1400f6010
lea r11, [rsp + 0x9b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movabs rax, 0xf1f8ed4df103a071
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xfee4eaed1c24110b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x3896ca2878ef5230
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x7b3d0602bc9449b6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x820], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x828], rax
movabs rax, 0x54faae060c813759
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x830], rax
movabs r13, 0x7b586a77d8fb2496
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x838], rax
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x820]
vmovdqa ymmword [rbp + 0x1a0], ymm1
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x3d8]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a360]
lea rcx, [rbp + 0x3d8]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0xf1f8ed4df103a071
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
movabs rax, 0xfce2eaed1c24110b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movabs rax, 0x389e803469ef5e3e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
movabs rax, 0x1e341f13b79604fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movabs rdx, 0x86b0d9f449949c4b
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
movabs rcx, 0xbb0c098522ebd068
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7a8], rax
movabs rax, 0x54faae060c813759
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7b0], rax
movabs r13, 0x7b586a77d8fb2496
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7b8], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x7c0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x7c8], rax
vmovdqu ymm0, ymmword [rbp + 0x2c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x7a0]
vmovdqa ymmword [rbp + 0x2c0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x7c0]
vxorps xmm0, xmm0, xmmword [rbp + 0x2e0]
vmovdqa xmmword [rbp + 0x2e0], xmm0
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x3c0]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a360]
lea rcx, [rbp + 0x3c0]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0xf1f8ed4df103a071
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0xf1f4eaed1c24110b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
movabs rax, 0x2089d7756dec5231
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
movabs rax, 0x1678061bbcd549f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
movabs rax, 0x86b0d99125e1f824
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
movabs rcx, 0xbb0c098522ebd068
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x7e8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7f0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x7f8], rax
movabs rdx, 0x86b0d9f449949c4b
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x800], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x808], rax
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0x7e0]
vmovdqa ymmword [rbp + 0x280], ymm1
vmovdqa xmm0, xmmword [rbp + 0x800]
vxorps xmm0, xmm0, xmmword [rbp + 0x2a0]
vmovdqa xmmword [rbp + 0x2a0], xmm0
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x3f0]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a360]
lea rcx, [rbp + 0x3f0]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0xf1f8ed4df103a071
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0xb2f7bfed1c30110b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x54fac96f6aef583a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x860], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x868], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x870], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x878], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x860]
vmovdqa ymmword [rbp + 0x180], ymm1
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x408]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a360]
lea rcx, [rbp + 0x408]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0xf1f8ed4df103a071
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xe1a7baf40c27110b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x54fadd6761e45f3a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x8a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x8a8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x8b0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x8b8], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x8a0]
vmovdqa ymmword [rbp + 0x140], ymm1
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x420]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a360]
lea rcx, [rbp + 0x420]
call sub.VCRUNTIME140.dll__CxxThrowException
movabs rax, 0xf1f8ed4df103a071
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xb2f7bfed1c30110b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x5489da637fe75136
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x8c0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x8c8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x8d0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x8d8], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x8c0]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x3a8]
vzeroupper
call fcn.140049470
lea rdx, [0x14015a360]
lea rcx, [rbp + 0x3a8]
call sub.VCRUNTIME140.dll__CxxThrowException
call fcn.140057020
call fcn.140057020
call fcn.140057020
int3