Function at 0x1400375f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
movaps xmmword [rsp + 0x3c0], xmm6
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov dword [rsp + 0x60], r9d
mov r13, rcx
mov qword [rsp + 0x68], rcx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x1400406bc]
lea rdx, str.CONOUT_
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400376c2
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x70], eax
je 0x1400376c2
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x1400406bc]
lea rdx, str.CONOUT_
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
xor r15d, r15d
mov qword [rbp - 0x30], 0x50
xorps xmm0, xmm0
mov qword [rbp - 0x20], r15
lea rax, [0x140038010]
mov qword [rbp - 0x10], r15
mov edx, 0x7f00
movdqa xmmword [rbp], xmm0
xor ecx, ecx
mov qword [rbp + 0x18], r15
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], r13
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
lea rax, str.External_Overlay_Class
mov qword [rbp + 0x10], rax
call qword [sym.imp.USER32.dll_RegisterClassExA]
xor edx, edx
mov qword [rbp + 0x270], r15
mov r8d, 0x12c
mov qword [rbp + 0x278], r15
lea rcx, [rbp + 0x24]
mov r12d, r15d
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rbp + 0x20], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400377d5
nop
lea rax, [rbp + 0x4c]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140037770
mov r8d, 7
lea rdx, [rbp + 0x4c]
cmp rbx, r8
lea rcx, str.cs2.exe
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400377a0
cmp rbx, 7
je 0x1400377b3
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140037760
jmp 0x1400377d5
mov r12d, dword [rbp + 0x28]
xor edx, edx
mov r8d, r12d
mov qword [rbp + 0x270], r12
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x278], rax
test rdi, rdi
je 0x1400377e3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsd xmm6, qword [0x140040800]
movabs r13, 0x311cdad160000
movabs r14, 0x7fffffffffffffff
nop
xor edx, edx
lea rcx, [rbp + 0x24]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
mov edx, r12d
mov dword [rbp + 0x20], 0x238
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x20]
mov rsi, r15
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x140037897
nop dword [rax]
lea rax, [rbp + 0x50]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140037850
mov r8d, 0xa
lea rdx, [rbp + 0x50]
cmp rbx, r8
lea rcx, str.client.dll
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140037880
cmp rbx, 0xa
je 0x140037893
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140037840
jmp 0x140037897
mov rsi, qword [rbp + 0x38]
test rdi, rdi
je 0x1400378a5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400476b8], rsi
test rsi, rsi
jne 0x1400379ba
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rdi, rcx, 0x3b9aca00
cqo
idiv rbx
add rdi, rax
movabs rax, 0x7fffffffc46535fe
cmp rdi, rax
jg 0x1400378fa
add rdi, 0x3b9aca00
jmp 0x1400378fd
mov rdi, r14
movabs r15, 0x112e0be826d694b3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rbx, rcx, 0x3b9aca00
add rbx, rax
cmp rdi, rbx
je 0x1400379a6
jl 0x1400379a6
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x140037962
mov rax, r13
lea r8, [rcx + r13]
jmp 0x140037966
lea r8, [rcx + rax]
add rcx, rax
mov rax, r15
imul rcx
lea rcx, [rbp + 0x260]
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rbp + 0x260], rdx
sub r8d, eax
mov dword [rbp + 0x268], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140037907
cmp qword [0x1400476b8], 0
mov r15d, 0
je 0x140037800
mov r13, qword [rsp + 0x68]
lea r8, [0x14003a67e]
mov rdx, qword [rbp + 0x10]
mov r9d, 0x80000000
mov qword [rsp + 0x58], r15
mov ecx, 0x80028
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 0x438
mov dword [rsp + 0x30], 0x780
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
mov qword [0x1400476d8], rax
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rax, qword [0x1400476d8]
xor r9d, r9d
mov qword [rbp - 0x50], rax
xor r8d, r8d
lea rax, [0x1400476c0]
mov qword [rbp - 0x78], r15
mov qword [rsp + 0x58], rax
xor ecx, ecx
mov qword [rsp + 0x50], r15
lea rax, [0x1400476e0]
mov qword [rsp + 0x48], rax
lea edx, [r9 + 1]
lea rax, [0x1400476c8]
mov qword [rbp - 0x6c], r15
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov dword [rbp - 0x60], r15d
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x44], r15
mov dword [rbp - 0x3c], r15d
mov dword [rbp - 0x80], 0x780
mov dword [rbp - 0x7c], 0x438
mov dword [rbp - 0x70], 0x1c
mov dword [rbp - 0x5c], 0x20
mov dword [rbp - 0x64], 1
mov dword [rbp - 0x48], 1
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
mov r14, qword [rbp + 0x278]
test eax, eax
jne 0x140037fbe
mov rcx, qword [0x1400476c8]
lea r9, [rsp + 0x68]
lea r8, [0x1400406f8]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [0x1400476e0]
lea r9, [0x1400476d0]
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400476c0]
lea r8, [0x1400476d0]
xor r9d, r9d
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rbx, qword [0x1400476a8]
test rbx, rbx
je 0x140037b4c
inc dword [rbx + 0xf4]
mov rdx, qword [0x140047698]
mov ecx, 0x5e28
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x140037b6e
xor edx, edx
mov rcx, rax
call fcn.140001320
jmp 0x140037b71
mov rax, r15
mov qword [0x1400476a8], rax
call fcn.140004a00
mov rax, qword [0x1400476a8]
test rbx, rbx
mov rcx, qword [0x1400476d8]
cmovne rax, rbx
mov qword [0x1400476a8], rax
mov qword [rax + 0x20], r15
call fcn.14002aca0
mov rdi, qword [0x1400476a8]
mov r14, qword [0x1400476c0]
mov rsi, qword [0x1400476e0]
test rdi, rdi
je 0x140037bc2
inc dword [rdi + 0xf4]
mov rdx, qword [0x140047698]
mov ecx, 0x78
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbx, rax
test rax, rax
je 0x140037c09
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov dword [rax + 0x70], 0x1388
mov dword [rax + 0x74], 0x2710
jmp 0x140037c0c
mov rbx, r15
or dword [rdi + 0xc], 8
lea rax, str.imgui_impl_dx11
mov qword [rdi + 0x90], rax
lea r8, [rsp + 0x70]
mov qword [rdi + 0xa0], rbx
lea rdx, [0x140040428]
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x68], r15
mov qword [rbp + 0x260], r15
call qword [rax]
test eax, eax
jne 0x140037c98
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x68]
lea rdx, [0x140040438]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x140037c98
mov rcx, qword [rsp + 0x68]
lea r8, [rbp + 0x260]
lea rdx, [0x140040448]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x140037c98
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov rax, qword [rbp + 0x260]
mov qword [rbx + 0x10], rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140037ca8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140037cb8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 8]
mov edx, dword [rsp + 0x60]
mov rcx, qword [0x1400476d8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400476d8]
call qword [sym.imp.USER32.dll_UpdateWindow]
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x280]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140037d41
lea rcx, [rbp + 0x280]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x280]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x140037e52
mov rcx, qword [0x1400476c0]
lea r8, [0x140040680]
mov rdx, qword [0x1400476d0]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140037d9b
cmp byte [0x140047710], 0
jne 0x140037d9b
cmp byte [0x140047711], 0
mov rcx, qword [0x1400476d8]
sete byte [0x140047711]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov byte [0x140047710], 1
jmp 0x140037ddd
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140037ddd
mov rcx, qword [0x1400476d8]
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov rcx, qword [0x1400476d8]
mov edx, 0xffffffec
or rax, 0x20
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov byte [0x140047710], 0
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140037fb5
lea rcx, [rbp + 0x270]
call fcn.1400372c0
mov rcx, qword [0x1400476c0]
lea r8, [0x1400476d0]
xor r9d, r9d
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rax, qword [0x1400476a8]
mov rcx, qword [rax + 0x48a8]
mov rax, qword [rcx]
mov rcx, r15
add rax, 0x48
cmp byte [rax], 0
cmovne rcx, rax
call fcn.140029be0
mov rcx, qword [0x1400476c8]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 1]
call qword [rax + 0x40]
cmp dword [rbp + 0x288], 0x12
jne 0x140037d01
mov rbx, qword [0x1400476a8]
test rbx, rbx
je 0x140037e74
mov rdi, qword [rbx + 0xa0]
jmp 0x140037e77
mov rdi, r15
call fcn.14002ab80
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140037e8b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140037e99
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140037ea8
mov rax, qword [rcx]
call qword [rax + 0x10]
and dword [rbx + 0xc], 0xfffffff7
mov rax, qword [0x1400476a8]
mov qword [rbx + 0x90], r15
mov qword [rbx + 0xa0], r15
test rax, rax
je 0x140037ecc
dec dword [rax + 0xf4]
mov rdx, qword [0x140047698]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, qword [0x1400476a8]
test rax, rax
je 0x140037ef0
mov rdi, qword [rax + 0x98]
jmp 0x140037ef3
mov rdi, r15
mov rcx, qword [rdi + 0x30]
lea rbx, [rax + 8]
test rcx, rcx
je 0x140037f0d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1400476a8]
and dword [rbx + 4], 0xfffffff8
mov qword [rbx + 0x80], r15
mov qword [rbx + 0x90], r15
test rax, rax
je 0x140037f2a
dec dword [rax + 0xf4]
mov rdx, qword [0x140047698]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rbx, qword [0x1400476a8]
call fcn.140004e30
mov qword [0x1400476a8], r15
test rbx, rbx
je 0x140037f7a
mov rcx, rbx
call fcn.14001a090
mov rax, qword [0x1400476a8]
test rax, rax
je 0x140037f6b
dec dword [rax + 0xf4]
mov rdx, qword [0x140047698]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [0x1400476d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400476c8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400476c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1400476e0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r15d, dword [rbp + 0x290]
mov r14, qword [rbp + 0x278]
jmp 0x140037fc4
mov r15d, 0xffffffff
test r14, r14
je 0x140037fd2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1400380b0
mov rbx, qword [rsp + 0x418]
movaps xmm6, xmmword [rsp + 0x3c0]
add rsp, 0x3d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret