Function at 0x1400089d0
Capabilities:
Create thread
Log keystrokes via polling
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
mov ecx, dword [0x14008a0b8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008a0d
cmp byte [0x14008ab80], 0
jne 0x140008a0d
cmp byte [0x14008a05c], 0
jne 0x140008a0d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x14008ab98], rax
mov byte [0x14008ab80], 1
mov ecx, dword [0x14008a0b8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
test ax, ax
je 0x140008ab4
cmp byte [0x14008ab80], bl
je 0x140008ab4
cmp byte [0x14008a05c], bl
jne 0x140008ab4
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x14008ab98]
cmp rax, 0x1f4
jb 0x140008a91
cmp byte [0x14008ab82], bl
jne 0x140008a91
mov ecx, dword [0x14008a0d0]
lea r8, [0x140072f80]
mov eax, dword [0x14008a0d4]
xor r9d, r9d
mov dword [0x14008a0d4], ecx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [0x14008a0d0], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x14008ab82], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x14008ab98]
cmp rax, 0x1f4
jae 0x140008ab4
cmp byte [0x14008ab82], bl
je 0x140008ab4
mov byte [0x14008ab82], bl
mov ecx, dword [0x14008a0b8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008b27
cmp byte [0x14008ab80], bl
je 0x140008b27
cmp byte [0x14008a05c], bl
jne 0x140008b27
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x14008ab98]
cmp rax, 0x1f4
jae 0x140008b21
cmp byte [0x14008a0bd], bl
lea r8, [0x140072fa0]
mov qword [rsp + 0x28], rbx
sete al
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov byte [0x14008a0bd], al
xor edx, edx
xor ecx, ecx
test al, al
jne 0x140008b1b
lea r8, [0x140072fc0]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x14008ab80], bl
mov ecx, dword [0x14008a0b8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008b47
cmp byte [0x14008a05c], bl
je 0x140008b47
mov byte [0x14008ab80], 1
mov ecx, dword [0x14008a0b8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008b74
cmp byte [0x14008ab80], bl
je 0x140008b74
cmp byte [0x14008a05c], bl
je 0x140008b74
mov byte [0x14008a05c], bl
mov byte [0x14008ab80], bl
mov ecx, dword [0x14008a178]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008ba9
cmp byte [0x14008ab85], bl
jne 0x140008ba9
cmp byte [0x14008a05c], bl
jne 0x140008ba9
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x14008ab98], rax
mov byte [0x14008ab85], 1
mov ecx, dword [0x14008a178]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008c4e
cmp byte [0x14008ab85], bl
je 0x140008c4e
cmp byte [0x14008a05c], bl
jne 0x140008c4e
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x14008ab98]
cmp rax, 0x1f4
jb 0x140008c2b
cmp byte [0x14008ab82], bl
jne 0x140008c2b
mov ecx, dword [0x14008a190]
lea r8, [0x140072f80]
mov eax, dword [0x14008a194]
xor r9d, r9d
mov dword [0x14008a194], ecx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [0x14008a190], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x14008ab82], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x14008ab98]
cmp rax, 0x1f4
jae 0x140008c4e
cmp byte [0x14008ab82], bl
je 0x140008c4e
mov byte [0x14008ab82], bl
mov ecx, dword [0x14008a178]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008cc1
cmp byte [0x14008ab85], bl
je 0x140008cc1
cmp byte [0x14008a05c], bl
jne 0x140008cc1
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x14008ab98]
cmp rax, 0x1f4
jae 0x140008cbb
cmp byte [0x14008a17d], bl
lea r8, [0x140072fa0]
mov qword [rsp + 0x28], rbx
sete al
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov byte [0x14008a17d], al
xor edx, edx
xor ecx, ecx
test al, al
jne 0x140008cb5
lea r8, [0x140072fc0]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x14008ab85], bl
mov ecx, dword [0x14008a178]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008ce1
cmp byte [0x14008a05c], bl
je 0x140008ce1
mov byte [0x14008ab85], 1
mov ecx, dword [0x14008a178]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008d0e
cmp byte [0x14008ab85], bl
je 0x140008d0e
cmp byte [0x14008a05c], bl
je 0x140008d0e
mov byte [0x14008a05c], bl
mov byte [0x14008ab85], bl
mov ecx, dword [0x14008a060]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008d36
cmp byte [0x14008ab86], bl
jne 0x140008d36
cmp byte [0x14008a05c], bl
jne 0x140008d36
mov byte [0x14008ab86], 1
mov ecx, dword [0x14008a060]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008d8a
cmp byte [0x14008ab86], bl
je 0x140008d8a
cmp byte [0x14008a05c], bl
jne 0x140008d8a
mov rcx, qword [0x14008a070]
test rcx, rcx
je 0x140008d84
movzx eax, byte [0x14008a059]
test eax, eax
sete byte [0x14008a059]
test eax, eax
jne 0x140008d7c
lea edx, [rax + 1]
jmp 0x140008d7e
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [0x14008ab86], bl
mov ecx, dword [0x14008a060]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008daa
cmp byte [0x14008a05c], bl
je 0x140008daa
mov byte [0x14008ab86], 1
mov ecx, dword [0x14008a060]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008dd7
cmp byte [0x14008ab86], bl
je 0x140008dd7
cmp byte [0x14008a05c], bl
je 0x140008dd7
mov byte [0x14008a05c], bl
mov byte [0x14008ab86], bl
mov ecx, dword [0x14008a064]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008e0c
cmp byte [0x14008ab83], bl
jne 0x140008e0c
cmp byte [0x14008a05c], bl
jne 0x140008e0c
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x14008ab98], rax
mov byte [0x14008ab83], 1
mov ecx, dword [0x14008a064]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008ed8
cmp byte [0x14008ab83], bl
je 0x140008ed8
cmp byte [0x14008a05c], bl
jne 0x140008ed8
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x14008ab98]
cmp rax, 0x1f4
jb 0x140008ed8
lea rdx, str.C:YoClicker2.0Lconfig.cfg
lea rcx, [rsp + 0x30]
call fcn.1400090f0
mov rdx, rax
lea rcx, [0x14008a0b0]
call fcn.140004190
lea rdx, str.C:YoClicker2.0Rconfig.cfg
lea rcx, [rsp + 0x30]
call fcn.1400090f0
mov rdx, rax
lea rcx, [0x14008a170]
call fcn.140004190
lea rdx, str.C:YoClicker2.0Sconfig.cfg
lea rcx, [rsp + 0x30]
call fcn.1400090f0
mov rdx, rax
call fcn.140073110
lea rdx, str.C:YoClicker2.0Mconfig.cfg
lea rcx, [rsp + 0x30]
call fcn.1400090f0
mov rdx, rax
call fcn.140072be0
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [0x14008a064]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008eff
cmp byte [0x14008ab83], bl
je 0x140008eff
cmp byte [0x14008a05c], bl
jne 0x140008eff
mov byte [0x14008ab83], bl
mov ecx, dword [0x14008a064]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008f1f
cmp byte [0x14008a05c], bl
je 0x140008f1f
mov byte [0x14008ab83], 1
mov ecx, dword [0x14008a064]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008f4c
cmp byte [0x14008ab83], bl
je 0x140008f4c
cmp byte [0x14008a05c], bl
je 0x140008f4c
mov byte [0x14008a05c], bl
mov byte [0x14008ab83], bl
mov ecx, dword [0x14008a068]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008f74
cmp byte [0x14008ab84], bl
jne 0x140008f74
cmp byte [0x14008a05c], bl
jne 0x140008f74
mov byte [0x14008ab84], 1
mov ecx, dword [0x14008a068]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140008fc5
cmp byte [0x14008ab84], bl
je 0x140008fc5
cmp byte [0x14008a05c], bl
jne 0x140008fc5
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140072f80]
mov qword [0x14008a078], rax
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x14008ab84], bl
mov ecx, dword [0x14008a068]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140008fe5
cmp byte [0x14008a05c], bl
je 0x140008fe5
mov byte [0x14008ab84], 1
mov ecx, dword [0x14008a068]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140009012
cmp byte [0x14008ab84], bl
je 0x140009012
cmp byte [0x14008a05c], bl
je 0x140009012
mov byte [0x14008a05c], bl
mov byte [0x14008ab84], bl
add rsp, 0x50
pop rbx
ret