Function at 0x140023480
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x278]
sub rsp, 0x350
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword [0x140309080]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r13d, r13d
mov r12d, r13d
mov dword [rbp + 0x28], r13d
cmp byte [0x14032b678], r13b
jne 0x140024dbb
movabs rbx, 0x8000000000000000
movss xmm11, dword [0x1402f47cc]
movss xmm7, dword [0x1402f47a0]
movss xmm9, dword [0x1402f47c8]
movss xmm10, dword [0x1402f45d0]
xorps xmm8, xmm8
mov r10, qword [0x14032cd88]
mov r14, qword [rbp + 0x30]
nop dword [rax]
mov rdx, qword [0x14032cc98]
add rdx, 0x20
test r10, r10
je 0x14002356b
cmp dword [0x14032cce4], 0
je 0x14002356b
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1d8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14032cd88]
mov rdx, qword [0x14032d4e0]
add rdx, qword [0x14032cc78]
test r10, r10
je 0x1400235a9
cmp dword [0x14032cce4], 0
je 0x1400235a9
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x98]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x14032cd88]
mov r15, qword [rbp + 0x98]
mov rdx, qword [0x14032d4e0]
test rdx, rdx
je 0x140024dae
cmp byte [0x14032b658], 0
je 0x14002360d
movd xmm0, dword [0x14032b654]
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x10], xmm0
test r10, r10
je 0x140023606
cmp dword [0x14032cce4], 0
je 0x140023606
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x10]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14032b658], 0
mov ecx, dword [0x14032b650]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400238dc
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 8], rbx
mov byte [rbp - 0x20], 0
mov dword [rbp + 8], 0xffffffff
movaps xmm6, xmm11
cmp qword [0x14032d4e0], 0
je 0x140023822
lea rdx, [0x14032d500]
lea rcx, [rbp + 0x1b8]
call fcn.140024f10
or r12d, 1
mov rsi, qword [rbp + 0x1c0]
mov rax, qword [rbp + 0x1b8]
cmp rax, rsi
je 0x1400237d2
lea rbx, [rax + 0x28]
nop word [rax + rax]
mov rax, qword [rbx - 0x28]
mov qword [rbp - 0x60], rax
lea rdx, [rbx - 0x20]
lea rcx, [rbp - 0x58]
call fcn.140014ac0
mov rax, qword [rbx]
mov qword [rbp - 0x38], rax
mov eax, dword [rbx + 8]
mov dword [rbp - 0x30], eax
mov rdi, qword [rbp - 0x60]
test rdi, rdi
je 0x140023782
mov rcx, qword [0x14032cd88]
test rcx, rcx
je 0x1400236f1
cmp dword [0x14032cce4], 0
je 0x1400236f1
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], r13
mov r9d, recvfrom
lea r8, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm1, dword [rsp + 0x48]
subss xmm1, dword [0x14032d4f4]
movss xmm2, dword [rsp + 0x4c]
subss xmm2, dword [0x14032d4f8]
movss xmm0, dword [rsp + 0x50]
subss xmm0, dword [0x14032d4fc]
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
mulss xmm0, xmm0
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x140023740
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x140023748
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
comiss xmm6, xmm0
jbe 0x140023782
comiss xmm7, xmm0
jbe 0x140023782
movaps xmm6, xmm0
mov qword [rbp - 0x28], rdi
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
lea rcx, [rbp - 0x20]
call fcn.140015d10
mov rax, qword [rbp - 0x38]
mov qword [rbp], rax
mov eax, dword [rbp - 0x30]
mov dword [rbp + 8], eax
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x1400237bd
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400237b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024e09
call fcn.1400e95d4
add rbx, 0x38
lea rax, [rbx - 0x28]
cmp rax, rsi
jne 0x140023690
mov rbx, qword [rbp - 8]
lea rcx, [rbp + 0x1b8]
call fcn.1400035a0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140023822
mov dword [rbp + 0x38], 1
mov rdx, qword [0x14032cca0]
add rdx, rcx
mov rcx, qword [0x14032cd88]
test rcx, rcx
je 0x140023829
cmp dword [0x14032cce4], 0
je 0x140023829
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14032cd88]
cmp rbx, 0xf
jbe 0x140023868
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002385c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024e10
call fcn.1400e95d4
mov rcx, qword [0x14032cd88]
movabs rbx, 0x8000000000000000
cmp byte [0x14032b63a], 0
je 0x1400238e5
test rcx, rcx
je 0x1400238b6
cmp dword [0x14032cce4], 0
je 0x1400238b6
mov rdx, qword [0x14032d4e0]
add rdx, 0x10c8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov dword [rbp + 0x10], 0xbf800000
test rcx, rcx
je 0x140023958
cmp dword [0x14032cce4], 0
je 0x140023958
mov rdx, qword [rbp + 0xa0]
jmp 0x14002393c
mov rcx, qword [0x14032cd88]
jmp 0x140023872
test rcx, rcx
je 0x140023920
cmp dword [0x14032cce4], 0
je 0x140023920
mov rdx, qword [0x14032d4e0]
add rdx, 0x10c8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov dword [rbp + 0x10], 0x42c80000
test rcx, rcx
je 0x140023958
cmp dword [0x14032cce4], 0
je 0x140023958
mov rdx, qword [rbp + 0xa8]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x10]
add rdx, 0xcf4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, 0xdf
mov rcx, qword [0x14032d4e0]
cmp byte [0x14032b638], 0
je 0x140023972
mov r8b, 1
jmp 0x140023975
xor r8d, r8d
call fcn.140022ed0
cmp byte [0x14032b65a], 0
je 0x1400239cf
mov ecx, dword [0x14032b64c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400239cf
mov rcx, qword [0x14032d4e0]
add rcx, 0x189
cmp byte [0x14032b659], 0
je 0x1400239af
xor dl, dl
jmp 0x1400239b1
mov dl, 1
call fcn.140025090
cmp byte [0x14032b659], 0
sete byte [0x14032b659]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14032cd88]
cmp qword [0x14032cc28], 0
jne 0x140023a8b
mov rdx, qword [0x14032d4e0]
test rdx, rdx
jne 0x1400239f5
mov rdx, r13
jmp 0x140023a30
test rcx, rcx
je 0x140023a29
cmp dword [0x14032cce4], 0
je 0x140023a29
add rdx, qword [0x14032cc78]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0xb0]
test rcx, rcx
je 0x140023a61
cmp dword [0x14032cce4], 0
je 0x140023a61
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
xor edx, edx
movss xmm0, dword [rbp + 0x40]
comiss xmm0, xmm9
jb 0x140023a7c
subss xmm0, xmm9
comiss xmm0, xmm9
jae 0x140023a7c
mov rdx, rbx
cvttss2si rax, xmm0
add rax, rdx
mov qword [0x14032cc28], rax
cmp byte [0x14032b639], 0
je 0x140023bb2
mov rdx, qword [0x14032d4e0]
test rdx, rdx
jne 0x140023aa9
mov rdx, r13
jmp 0x140023ae4
test rcx, rcx
je 0x140023add
cmp dword [0x14032cce4], 0
je 0x140023add
add rdx, qword [0x14032cc78]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0xb8]
test rcx, rcx
je 0x140023b15
cmp dword [0x14032cce4], 0
je 0x140023b15
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
movzx eax, byte [0x14032b639]
neg al
sbb ebx, ebx
and ebx, 0x4000
cvttss2si rax, dword [rbp + 0x44]
or ebx, eax
mov rdx, qword [0x14032d4e0]
test rdx, rdx
jne 0x140023b3f
mov rdx, r13
jmp 0x140023b7a
test rcx, rcx
je 0x140023b73
cmp dword [0x14032cce4], 0
je 0x140023b73
add rdx, qword [0x14032cc78]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x1a8]
mov dword [rbp + 0x48], ebx
test rcx, rcx
je 0x140023c1f
cmp dword [0x14032cce4], 0
je 0x140023bb2
add rdx, 0x270
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14032cd88]
test rcx, rcx
je 0x140023c1f
cmp dword [0x14032cce4], 0
je 0x140023be6
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1a0]
mov rdx, qword [0x14032d1f0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
test rcx, rcx
je 0x140023c1f
cmp dword [0x14032cce4], 0
je 0x140023c1f
mov rdx, qword [rbp + 0x1a0]
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov r14, qword [rbp + 0x30]
mov rbx, r14
mov rax, qword [0x14032d0f0]
mov rdx, qword [0x14032d0f8]
cmp rax, rdx
je 0x140023c43
cmp qword [rax], r14
je 0x140023cb8
add rax, 0x10
cmp rax, rdx
jne 0x140023c35
mov qword [rsp + 0x68], r14
test rcx, rcx
je 0x140023c81
cmp dword [0x14032cce4], 0
je 0x140023c81
lea rdx, [r14 + 0x30]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14032d0f8]
mov rcx, qword [0x14032cd88]
mov r14, qword [rbp + 0x30]
movss xmm0, dword [rbp + 0x50]
movss dword [rsp + 0x70], xmm0
cmp rdx, qword [0x14032d100]
je 0x140023ca7
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rdx], xmm0
add qword [0x14032d0f8], 0x10
jmp 0x140023cb8
lea r8, [rsp + 0x68]
call fcn.140025120
mov rcx, qword [0x14032cd88]
cmp byte [0x14032b644], 0
je 0x140023cd0
movss xmm0, dword [0x14032b648]
movss dword [rbp + 0x10], xmm0
jmp 0x140023cd7
mov dword [rbp + 0x10], 0x42480000
test rcx, rcx
je 0x140023d02
cmp dword [0x14032cce4], 0
je 0x140023d02
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x10]
lea rdx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14, qword [rbp + 0x30]
mov edx, 0x59
mov rcx, qword [0x14032d4e0]
cmp byte [0x14032b63d], 0
je 0x140023e57
mov r8b, 1
call fcn.140022ed0
mov r8b, 1
mov edx, 0x6a
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, WSAGetLastError
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, WSAGetLastError
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, WSAGetLastError
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, WSAGetLastError
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, reloc.WS2_32.dll___WSAFDIsSet
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, 0xa0
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, 0xa1
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, 0xa2
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, 0xa3
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, 0xa4
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, 0xa5
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, Ordinal_200
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, Ordinal_200
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
mov edx, 0xa3
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov r8b, 1
jmp 0x140023f8e
xor r8d, r8d
call fcn.140022ed0
xor r8d, r8d
mov edx, 0x6a
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, WSAGetLastError
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, WSAGetLastError
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, WSAGetLastError
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, WSAGetLastError
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, reloc.WS2_32.dll___WSAFDIsSet
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, 0xa0
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, 0xa1
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, 0xa2
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, 0xa3
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, 0xa4
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, 0xa5
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, Ordinal_200
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, Ordinal_200
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, 0xa3
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
xor r8d, r8d
mov edx, 0xa3
mov rcx, qword [0x14032d4e0]
call fcn.140022ed0
mov rcx, qword [0x14032cd88]
cmp byte [0x14032b63c], 0
je 0x140024107
test rcx, rcx
je 0x140023feb
cmp dword [0x14032cce4], 0
je 0x140023feb
mov rdx, qword [0x14032d4e0]
add rdx, 0x30
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x198]
test rdx, rdx
je 0x140024275
test rcx, rcx
je 0x14002402c
cmp dword [0x14032cce4], 0
je 0x14002402c
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x190]
test rdx, rdx
je 0x140024275
test rcx, rcx
je 0x14002406d
cmp dword [0x14032cce4], 0
je 0x14002406d
add rdx, 0x20
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x188]
test rdx, rdx
je 0x140024275
test rcx, rcx
je 0x1400240ae
cmp dword [0x14032cce4], 0
je 0x1400240ae
add rdx, 0x70
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x140024275
test rcx, rcx
je 0x1400240eb
cmp dword [0x14032cce4], 0
je 0x1400240eb
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x170]
test rdx, rdx
je 0x140024275
mov dword [rbp + 0x10], 0xbf800000
jmp 0x14002424e
test rcx, rcx
je 0x14002413f
cmp dword [0x14032cce4], 0
je 0x14002413f
mov rdx, qword [0x14032d4e0]
add rdx, 0x30
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x148]
test rdx, rdx
je 0x140024275
test rcx, rcx
je 0x140024180
cmp dword [0x14032cce4], 0
je 0x140024180
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x178]
test rdx, rdx
je 0x140024275
test rcx, rcx
je 0x1400241c1
cmp dword [0x14032cce4], 0
je 0x1400241c1
add rdx, 0x20
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x140024275
test rcx, rcx
je 0x140024202
cmp dword [0x14032cce4], 0
je 0x140024202
add rdx, 0x70
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0xc8]
test rdx, rdx
je 0x140024275
test rcx, rcx
je 0x14002423b
cmp dword [0x14032cce4], 0
je 0x14002423b
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0xd0]
test rdx, rdx
je 0x140024275
mov dword [rbp + 0x10], 0x3e800000
test rcx, rcx
je 0x140024275
cmp dword [0x14032cce4], 0
je 0x140024275
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x10]
add rdx, 0x2c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14032b659], 0
je 0x14002429c
mov rcx, qword [0x14032d4e0]
add rcx, 0x189
mov dl, 1
call fcn.140025090
cmp byte [0x14032b659], 0
jne 0x1400242b1
mov rcx, qword [0x14032d4e0]
add rcx, 0x189
xor edx, edx
call fcn.140025090
mov edx, 2
mov rcx, qword [0x14032d4e0]
cmp byte [0x14032b63b], 0
je 0x1400242cb
mov r8b, 1
jmp 0x1400242ce
xor r8d, r8d
call fcn.140022ed0
mov rdx, qword [0x14032d4e0]
mov rcx, qword [0x14032cd88]
test rdx, rdx
jne 0x1400242ee
mov rbx, r13
jmp 0x140024459
test rcx, rcx
je 0x140024322
cmp dword [0x14032cce4], 0
je 0x140024322
add rdx, qword [0x14032cc80]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rbx, qword [rbp + 0xd8]
test rbx, rbx
je 0x140024459
test rcx, rcx
je 0x140024369
cmp dword [0x14032cce4], 0
je 0x140024369
mov rdx, qword [0x14032cc90]
add rdx, rbx
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rax, qword [0x14032d4e0]
cmp qword [rbp + 0xe0], rax
jne 0x140024452
mov byte [0x14032cc38], 1
test rcx, rcx
je 0x1400243b5
cmp dword [0x14032cce4], 0
je 0x1400243b5
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rax, qword [rbp + 0xe8]
mov qword [0x14032cc30], rax
mov qword [0x14032cc40], rbx
test rcx, rcx
je 0x1400243fb
cmp dword [0x14032cce4], 0
je 0x1400243fb
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rax, qword [rbp + 0xf0]
mov qword [0x14032cc20], rax
test rcx, rcx
je 0x14002443a
cmp dword [0x14032cce4], 0
je 0x14002443a
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], r13
mov r9d, recvfrom
lea r8, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
movsd xmm0, qword [rbp - 0x70]
movsd qword [0x14032d108], xmm0
mov eax, dword [rbp - 0x68]
mov dword [0x14032d110], eax
jmp 0x140024459
mov byte [0x14032cc38], 0
mov rax, qword [0x14032d118]
mov rdx, qword [0x14032d120]
cmp rax, rdx
je 0x140024482
nop dword [rax]
cmp qword [rax], rbx
je 0x14002464d
add rax, 0x10
cmp rax, rdx
jne 0x140024470
mov qword [rsp + 0x58], rbx
mov rdx, qword [0x14032d4e0]
test rdx, rdx
je 0x140024510
test rcx, rcx
je 0x1400244c7
cmp dword [0x14032cce4], 0
je 0x1400244c7
add rdx, qword [0x14032cc80]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x140024510
test rcx, rcx
je 0x140024507
cmp dword [0x14032cce4], 0
je 0x140024507
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x100]
jmp 0x140024513
mov rdx, r13
test rcx, rcx
je 0x140024547
cmp dword [0x14032cce4], 0
je 0x140024547
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
movss xmm0, dword [rbp + 0x88]
movss dword [rsp + 0x64], xmm0
mov rdx, qword [0x14032d4e0]
test rdx, rdx
je 0x1400245de
test rcx, rcx
je 0x140024595
cmp dword [0x14032cce4], 0
je 0x140024595
add rdx, qword [0x14032cc80]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x108]
test rdx, rdx
je 0x1400245de
test rcx, rcx
je 0x1400245d5
cmp dword [0x14032cce4], 0
je 0x1400245d5
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x110]
jmp 0x1400245e1
mov rdx, r13
test rcx, rcx
je 0x14002460f
cmp dword [0x14032cce4], 0
je 0x14002460f
add rdx, 0x4c
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x54]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
movss xmm0, dword [rbp + 0x54]
movss dword [rsp + 0x60], xmm0
mov rdx, qword [0x14032d120]
cmp rdx, qword [0x14032d128]
je 0x14002463c
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rdx], xmm0
add qword [0x14032d120], 0x10
jmp 0x14002464d
lea r8, [rsp + 0x58]
call fcn.1400252e0
mov rcx, qword [0x14032cd88]
test rcx, rcx
je 0x140024681
cmp dword [0x14032cce4], 0
je 0x140024681
lea rdx, [rbx + 0x960]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
cmp byte [0x14032b66c], 0
je 0x140024810
movss xmm6, dword [0x14032b674]
mov rdx, qword [0x14032d4e0]
test rdx, rdx
je 0x14002471f
test rcx, rcx
je 0x1400246d6
cmp dword [0x14032cce4], 0
je 0x1400246d6
add rdx, qword [0x14032cc80]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x118]
test rdx, rdx
je 0x14002471f
test rcx, rcx
je 0x140024716
cmp dword [0x14032cce4], 0
je 0x140024716
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x120]
jmp 0x140024722
mov rdx, r13
movss dword [rbp + 0x58], xmm6
test rcx, rcx
je 0x140024758
cmp dword [0x14032cce4], 0
je 0x140024758
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14032cd88]
movss xmm6, dword [0x14032b670]
mov rdx, qword [0x14032d4e0]
test rdx, rdx
je 0x1400247e9
test rcx, rcx
je 0x1400247a0
cmp dword [0x14032cce4], 0
je 0x1400247a0
add rdx, qword [0x14032cc80]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x128]
test rdx, rdx
je 0x1400247e9
test rcx, rcx
je 0x1400247e0
cmp dword [0x14032cce4], 0
je 0x1400247e0
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x130]
jmp 0x1400247ec
mov rdx, r13
movss dword [rbp + 0x60], xmm6
test rcx, rcx
je 0x1400249e5
cmp dword [0x14032cce4], 0
je 0x1400249e5
lea r8, [rbp + 0x60]
jmp 0x1400249c9
mov rax, qword [0x14032d118]
mov rdx, qword [0x14032d120]
cmp rax, rdx
je 0x140024831
cmp qword [rax], rbx
je 0x140024834
add rax, 0x10
cmp rax, rdx
jne 0x140024823
mov rax, r13
movss xmm6, dword [rax + 0xc]
mov rdx, qword [0x14032d4e0]
test rdx, rdx
je 0x1400248c2
test rcx, rcx
je 0x140024879
cmp dword [0x14032cce4], 0
je 0x140024879
add rdx, qword [0x14032cc80]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x138]
test rdx, rdx
je 0x1400248c2
test rcx, rcx
je 0x1400248b9
cmp dword [0x14032cce4], 0
je 0x1400248b9
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x140]
jmp 0x1400248c5
mov rdx, r13
movss dword [rbp + 0x68], xmm6
test rcx, rcx
je 0x1400248fb
cmp dword [0x14032cce4], 0
je 0x1400248fb
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14032cd88]
mov rax, qword [0x14032d118]
mov rdx, qword [0x14032d120]
cmp rax, rdx
je 0x14002491e
nop
cmp qword [rax], rbx
je 0x140024921
add rax, 0x10
cmp rax, rdx
jne 0x140024910
mov rax, r13
movss xmm6, dword [rax + 8]
mov rdx, qword [0x14032d4e0]
test rdx, rdx
je 0x1400249af
test rcx, rcx
je 0x140024966
cmp dword [0x14032cce4], 0
je 0x140024966
add rdx, qword [0x14032cc80]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x1b0]
test rdx, rdx
je 0x1400249af
test rcx, rcx
je 0x1400249a6
cmp dword [0x14032cce4], 0
je 0x1400249a6
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x150]
jmp 0x1400249b2
mov rdx, r13
movss dword [rbp + 0x70], xmm6
test rcx, rcx
je 0x1400249e5
cmp dword [0x14032cce4], 0
je 0x1400249e5
lea r8, [rbp + 0x70]
mov qword [rsp + 0x20], r13
mov r9d, 4
add rdx, 0x4c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14032cd88]
cmp byte [0x14032b62e], 0
je 0x140024ab6
test rcx, rcx
je 0x140024a2a
cmp dword [0x14032cce4], 0
je 0x140024a2a
mov rdx, qword [0x14032d4e0]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
movss xmm0, dword [rbp + 0x78]
comiss xmm0, xmm10
jbe 0x140024a6e
mov rdx, qword [0x14032d4e0]
test rdx, rdx
je 0x140024aa9
mov byte [rbp + 0x18], 1
test rcx, rcx
je 0x140024aa9
cmp dword [0x14032cce4], 0
je 0x140024aa9
add rdx, 0x2c
mov qword [rsp + 0x20], r13
mov r9d, 1
lea r8, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140024aa2
test rcx, rcx
je 0x140024aa9
cmp dword [0x14032cce4], 0
je 0x140024aa9
mov rdx, qword [0x14032d4e0]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x8c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
cmp byte [0x14032b62e], 0
jne 0x140024b6d
test rcx, rcx
je 0x140024aee
cmp dword [0x14032cce4], 0
je 0x140024aee
mov rdx, qword [0x14032d4e0]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x7c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
movss xmm0, dword [rbp + 0x7c]
comiss xmm0, xmm10
jbe 0x140024b32
mov rdx, qword [0x14032d4e0]
test rdx, rdx
je 0x140024b6d
mov byte [rbp + 0x20], gethostname
test rcx, rcx
je 0x140024b6d
cmp dword [0x14032cce4], 0
je 0x140024b6d
add rdx, 0x2c
mov qword [rsp + 0x20], r13
mov r9d, 1
lea r8, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140024b66
test rcx, rcx
je 0x140024b6d
cmp dword [0x14032cce4], 0
je 0x140024b6d
mov rdx, qword [0x14032d4e0]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
cmp byte [0x14032b63e], 0
je 0x140024b9d
movss xmm0, dword [0x14032b640]
movss dword [rbp + 0x80], xmm0
test rcx, rcx
je 0x140024bd5
cmp dword [0x14032cce4], 0
je 0x140024bd5
lea r8, [rbp + 0x80]
jmp 0x140024bb6
mov dword [rbp + 0x28], 0x3f800000
test rcx, rcx
je 0x140024bd5
cmp dword [0x14032cce4], 0
je 0x140024bd5
lea r8, [rbp + 0x28]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea rdx, [r15 + 0xd40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14032cd88]
cmp byte [0x14032cc38], 0
jne 0x140024cfb
mov rdx, qword [0x14032d4e0]
test rdx, rdx
jne 0x140024bf3
mov rax, r13
jmp 0x140024c2b
test rcx, rcx
je 0x140024c24
cmp dword [0x14032cce4], 0
je 0x140024c24
add rdx, 0x20
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rax, qword [rbp + 0x158]
mov qword [0x14032cc30], rax
mov rdx, qword [0x14032d4e0]
mov qword [0x14032cc40], rdx
test rdx, rdx
jne 0x140024c4a
mov rax, r13
jmp 0x140024c82
test rcx, rcx
je 0x140024c7b
cmp dword [0x14032cce4], 0
je 0x140024c7b
add rdx, 0x30
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rax, qword [rbp + 0x160]
mov qword [0x14032cc20], rax
cmp qword [0x14032d4e0], 0
jne 0x140024caa
movss dword [rsp + 0x38], xmm8
movaps xmm0, xmm8
unpcklps xmm0, xmm8
movsd qword [rsp + 0x30], xmm0
jmp 0x140024ce3
test rcx, rcx
je 0x140024ce3
cmp dword [0x14032cce4], 0
je 0x140024ce3
mov rdx, qword [0x14032d4e0]
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, recvfrom
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
movsd xmm0, qword [rsp + 0x30]
movsd qword [0x14032d108], xmm0
mov eax, dword [rsp + 0x38]
mov dword [0x14032d110], eax
mov rdx, qword [0x14032d418]
test rdx, rdx
je 0x140024d71
test rcx, rcx
je 0x140024d3b
cmp dword [0x14032cce4], 0
je 0x140024d3b
add rdx, 0x3c0
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14032cd88]
mov rdx, qword [rbp + 0x168]
test rdx, rdx
je 0x140024d71
test rcx, rcx
je 0x140024d82
cmp dword [0x14032cce4], 0
je 0x140024d82
add rdx, 0x40
mov qword [rsp + 0x20], r13
mov r9d, recvfrom
lea r8, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140024d82
mov qword [rsp + 0x3c], 0
mov dword [rsp + 0x44], 0
movsd xmm0, qword [rsp + 0x3c]
movsd qword [rbp - 0x80], xmm0
mov eax, dword [rsp + 0x44]
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x80]
call fcn.140023020
mov r10, qword [0x14032cd88]
movabs rbx, 0x8000000000000000
cmp byte [0x14032b678], 0
je 0x140023530
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1400e9330
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3