Function at 0x14002a2b0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x14006db18]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r12, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
lea rcx, [0x1400460f0]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
lea ecx, [rdi + 0x2d]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14002a30c
inc dword [0x14006f1f4]
lea rcx, str.ImGui_Platform
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringW]
mov qword [rsp + 0x50], rax
lea r14, [rsp + 0x50]
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_FindWindowW]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
lea rdx, [rsp + 0x24]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test rsi, rsi
je 0x14002a637
mov r8d, 0x64
lea rdx, [rbp - 0x60]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetClassNameW]
mov r8, 0xffffffffffffffff
mov rdx, r12
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt6Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__long_long___int64__]
mov rbx, rax
or edi, 1
mov dword [rsp + 0x20], edi
lea rcx, str.Rust
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.Qt6Core.dll_public:_bool___cdecl_QString::operator_char_const____ptr64_const___ptr64]
test al, al
je 0x14002a3e1
mov r8, 0xffffffffffffffff
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt6Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__long_long___int64__]
mov rbx, rax
or edi, 2
mov dword [rsp + 0x20], edi
lea rcx, str.UnityWndClass
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.Qt6Core.dll_public:_bool___cdecl_QString::operator_char_const____ptr64_const___ptr64]
test al, al
je 0x14002a3e1
mov bl, 1
jmp 0x14002a3e3
xor bl, bl
test dil, 2
je 0x14002a3fc
and edi, 0xfffffffd
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
test dil, 1
je 0x14002a414
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x38]
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test bl, bl
je 0x14002a47e
cmp dword [0x14006ebb0], 0
je 0x14002a43f
lea rdx, [rsp + 0x24]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x24]
cmp r8d, dword [0x14006ebb0]
je 0x14002a47e
jmp 0x14002a457
mov eax, dword [0x14006f220]
inc eax
mov dword [0x14006f220], eax
cmp eax, 0x3c
jl 0x14002a47e
mov r8d, dword [rsp + 0x24]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, rax
je 0x14002a47e
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x24]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r9d, dword [rsp + 0x24]
mov rax, qword [0x14006f1e8]
test rax, rax
jle 0x14002a4ce
mov r10, qword [0x14006f1e0]
lea rcx, [r10 + rax*4]
mov rax, r10
cmp r10, rcx
je 0x14002a4ce
mov r8, rax
mov rdx, rax
cmp dword [rax], r9d
je 0x14002a65c
lea rax, [r8 + 4]
mov r8, rax
mov rdx, rax
cmp rax, rcx
jne 0x14002a4b6
mov rdx, 0xffffffffffffffff
cmp rdx, 0xffffffffffffffff
jne 0x14002a637
mov edx, r9d
lea rcx, [rsp + 0x38]
call fcn.140029760
nop
cmp qword [rsp + 0x48], 2
jge 0x14002a56b
nop word [rax + rax]
lea rcx, [0x140046128]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::constructor_char_const____ptr64____ptr64]
nop
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140005e80
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14002a541
mov eax, dword [rax]
cmp eax, 1
jle 0x14002a554
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140006690
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
cmp qword [rsp + 0x48], 2
jl 0x14002a500
mov edi, dword [rsp + 0x20]
mov r8, qword [rsp + 0x40]
lea r9, [r8 + 0x18]
lea rdx, [rbp - 0x78]
lea rcx, [0x14006f210]
call fcn.14002a720
mov r8, 0xffffffffffffffff
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt6Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__long_long___int64__]
mov rbx, rax
mov r8, 0xffffffffffffffff
mov rdx, r12
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt6Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__long_long___int64__]
nop
mov r9, rbx
mov r8, rax
lea rdx, [rbp - 0x70]
lea rcx, [0x14006f218]
call fcn.14002a720
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x28]
mov rdx, qword [0x14006f1e8]
lea rcx, [0x14006f1d8]
call fcn.14001f640
mov rax, qword [0x14006f1d8]
test rax, rax
je 0x14002a618
mov eax, dword [rax]
mov edi, dword [rsp + 0x20]
cmp eax, 1
jle 0x14002a62d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x14006f1d8]
call fcn.140022a60
nop
lea rcx, [rsp + 0x38]
call fcn.1400060f0
test r15, r15
jne 0x14002a668
mov byte [0x14006f1f0], 1
add r14, 8
lea rax, [rsp + 0x58]
cmp r14, rax
jne 0x14002a323
xor al, al
jmp 0x14002a6e8
sub rdx, r10
sar rdx, 2
jmp 0x14002a4d5
mov r8d, 0x64
lea rdx, [rbp + 0x70]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x30]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002a6b5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, 0xffffffffffffffff
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt6Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__long_long___int64__]
mov rdx, rax
lea rcx, [0x14006f1f8]
call qword [sym.imp.Qt6Core.dll_public:_class_QString____ptr64___cdecl_QString::operator_class_QString____ptr64____ptr64]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Qt6Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14002e8a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret