Function at 0x14001e9d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x1a0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
mov rax, qword [0x14030b0c0]
xor rax, rsp
mov qword [rbp + 0x58], rax
xor r12d, r12d
mov r15d, r12d
mov dword [rbp - 0x18], r12d
cmp byte [0x140352944], r12b
jne 0x14001f1df
movss xmm9, dword [0x1402f4b30]
movss xmm7, dword [0x1402f4b10]
xorps xmm8, xmm8
mov r10, qword [0x1403541e8]
nop dword [rax]
mov rdx, qword [0x140354110]
add rdx, 0x20
test r10, r10
je 0x14001ea88
cmp dword [0x140354154], 0
je 0x14001ea88
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x50]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1403541e8]
mov rdx, qword [0x140355530]
add rdx, qword [0x140354118]
test r10, r10
je 0x14001eac3
cmp dword [0x140354154], 0
je 0x14001eac3
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp - 8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1403541e8]
mov r14, qword [rbp - 8]
mov rdx, qword [0x140355530]
test rdx, rdx
je 0x14001f1d2
cmp byte [0x14035292c], 0
je 0x14001eb24
movd xmm0, dword [0x140352928]
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x20], xmm0
test r10, r10
je 0x14001eb1d
cmp dword [0x140354154], 0
je 0x14001eb1d
add rdx, 0x280
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp - 0x20]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14035292c], 0
mov ecx, dword [0x140352924]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001ed61
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x38], rbx
mov byte [rbp - 0x50], 0
mov dword [rbp - 0x28], 0xffffffff
movaps xmm6, xmm9
cmp qword [0x140355530], 0
je 0x14001ed29
lea rdx, [0x140355550]
lea rcx, [rbp + 0x38]
call fcn.14001f230
or r15d, 1
mov rsi, qword [rbp + 0x40]
mov rax, qword [rbp + 0x38]
cmp rax, rsi
je 0x14001ecdb
lea rbx, [rax + 0x28]
mov rax, qword [rbx - 0x28]
mov qword [rsp + 0x70], rax
lea rdx, [rbx - 0x20]
lea rcx, [rsp + 0x78]
call fcn.14000f330
mov rax, qword [rbx]
mov qword [rbp - 0x68], rax
mov eax, dword [rbx + 8]
mov dword [rbp - 0x60], eax
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x14001ec8a
mov rcx, qword [0x1403541e8]
test rcx, rcx
je 0x14001ebf7
cmp dword [0x140354154], 0
je 0x14001ebf7
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], r12
mov r9d, ntohs
lea r8, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm2, dword [rsp + 0x48]
subss xmm2, dword [0x140355544]
movss xmm0, dword [rsp + 0x4c]
subss xmm0, dword [0x140355548]
movss xmm1, dword [rsp + 0x50]
subss xmm1, dword [0x14035554c]
mulss xmm2, xmm2
mulss xmm0, xmm0
addss xmm2, xmm0
mulss xmm1, xmm1
addss xmm2, xmm1
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x14001ec46
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x14001ec4e
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
comiss xmm6, xmm0
jbe 0x14001ec8a
comiss xmm7, xmm0
jbe 0x14001ec8a
movaps xmm6, xmm0
mov qword [rbp - 0x58], rdi
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [rbp - 0x50]
call fcn.1400105d0
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x30], rax
mov eax, dword [rbp - 0x60]
mov dword [rbp - 0x28], eax
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14001ecc6
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ecc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f220
call fcn.1400e81f4
add rbx, 0x38
lea rax, [rbx - 0x28]
cmp rax, rsi
jne 0x14001eb93
mov rbx, qword [rbp - 0x38]
lea rcx, [rbp + 0x38]
call fcn.140003540
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14001ed29
mov dword [rbp - 0x20], 1
mov rdx, qword [0x140354138]
add rdx, rcx
mov rcx, qword [0x1403541e8]
test rcx, rcx
je 0x14001ed29
cmp dword [0x140354154], 0
je 0x14001ed29
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
cmp rbx, 0xf
jbe 0x14001ed61
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ed5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f227
call fcn.1400e81f4
mov ecx, dword [0x14035291c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001edad
mov rcx, qword [0x140355530]
add rcx, 0x189
cmp byte [0x14035292d], 0
je 0x14001ed8d
xor dl, dl
jmp 0x14001ed8f
mov dl, 1
call fcn.14001f3b0
cmp byte [0x14035292d], 0
sete byte [0x14035292d]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x140352920]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001edc3
call fcn.14001e660
mov edx, 0xdf
mov rcx, qword [0x140355530]
cmp byte [0x140352910], 0
je 0x14001eddd
mov r8b, 1
jmp 0x14001ede0
xor r8d, r8d
call fcn.14001e120
mov edx, 2
mov rcx, qword [0x140355530]
cmp byte [0x140352918], 0
je 0x14001edff
mov r8b, 1
jmp 0x14001ee02
xor r8d, r8d
call fcn.14001e120
cmp byte [0x14035292d], 0
je 0x14001ee2e
mov rcx, qword [0x140355530]
add rcx, 0x189
mov dl, 1
call fcn.14001f3b0
cmp byte [0x14035292d], 0
jne 0x14001ee43
mov rcx, qword [0x140355530]
add rcx, 0x189
xor edx, edx
call fcn.14001f3b0
mov rdx, qword [0x140355530]
mov rcx, qword [0x1403541e8]
test rdx, rdx
je 0x14001efb0
test rcx, rcx
je 0x14001ee8b
cmp dword [0x140354154], 0
je 0x14001ee8b
add rdx, qword [0x140354120]
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403541e8]
mov rbx, qword [rbp]
test rbx, rbx
je 0x14001efb0
test rcx, rcx
je 0x14001eecc
cmp dword [0x140354154], 0
je 0x14001eecc
mov rdx, qword [0x140354130]
add rdx, rbx
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403541e8]
mov rax, qword [0x140355530]
cmp qword [rbp + 8], rax
jne 0x14001efa9
mov byte [0x1403540d0], 1
test rcx, rcx
je 0x14001ef12
cmp dword [0x140354154], 0
je 0x14001ef12
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403541e8]
mov rax, qword [rbp + 0x10]
mov qword [0x1403540c8], rax
mov qword [0x1403540d8], rbx
test rcx, rcx
je 0x14001ef52
cmp dword [0x140354154], 0
je 0x14001ef52
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403541e8]
mov rax, qword [rbp + 0x18]
mov qword [0x1403540c0], rax
test rcx, rcx
je 0x14001ef8f
cmp dword [0x140354154], 0
je 0x14001ef8f
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], r12
mov r9d, ntohs
lea r8, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403541e8]
movsd xmm0, qword [rsp + 0x54]
movsd qword [0x140354590], xmm0
mov eax, dword [rsp + 0x5c]
mov dword [0x140354598], eax
jmp 0x14001efb0
mov byte [0x1403540d0], 0
cmp byte [0x140352912], 0
je 0x14001efda
movss xmm0, dword [0x140352914]
movss dword [rbp - 0x10], xmm0
test rcx, rcx
je 0x14001f012
cmp dword [0x140354154], 0
je 0x14001f012
lea r8, [rbp - 0x10]
jmp 0x14001eff3
mov dword [rbp - 0x18], 0x3f800000
test rcx, rcx
je 0x14001f012
cmp dword [0x140354154], 0
je 0x14001f012
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea rdx, [r14 + 0xd40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x1403541e8]
cmp byte [0x1403540d0], 0
jne 0x14001f12c
mov rdx, qword [0x140355530]
test rdx, rdx
jne 0x14001f030
mov rax, r12
jmp 0x14001f062
test rcx, rcx
je 0x14001f05e
cmp dword [0x140354154], 0
je 0x14001f05e
add rdx, 0x20
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403541e8]
mov rax, qword [rbp + 0x20]
mov qword [0x1403540c8], rax
mov rdx, qword [0x140355530]
mov qword [0x1403540d8], rdx
test rdx, rdx
jne 0x14001f081
mov rax, r12
jmp 0x14001f0b3
test rcx, rcx
je 0x14001f0af
cmp dword [0x140354154], 0
je 0x14001f0af
add rdx, 0x30
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403541e8]
mov rax, qword [rbp + 0x28]
mov qword [0x1403540c0], rax
cmp qword [0x140355530], 0
jne 0x14001f0db
movss dword [rsp + 0x38], xmm8
movaps xmm0, xmm8
unpcklps xmm0, xmm8
movsd qword [rsp + 0x30], xmm0
jmp 0x14001f114
test rcx, rcx
je 0x14001f114
cmp dword [0x140354154], 0
je 0x14001f114
mov rdx, qword [0x140355530]
add rdx, 0x90
mov qword [rsp + 0x20], r12
mov r9d, ntohs
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403541e8]
movsd xmm0, qword [rsp + 0x30]
movsd qword [0x140354590], xmm0
mov eax, dword [rsp + 0x38]
mov dword [0x140354598], eax
mov rdx, qword [0x140355468]
test rdx, rdx
je 0x14001f19c
test rcx, rcx
je 0x14001f169
cmp dword [0x140354154], 0
je 0x14001f169
add rdx, 0x3c0
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403541e8]
mov rdx, qword [rbp + 0x30]
test rdx, rdx
je 0x14001f19c
test rcx, rcx
je 0x14001f1ad
cmp dword [0x140354154], 0
je 0x14001f1ad
add rdx, 0x40
mov qword [rsp + 0x20], r12
mov r9d, ntohs
lea r8, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14001f1ad
mov qword [rsp + 0x3c], 0
mov dword [rsp + 0x44], 0
movsd xmm0, qword [rsp + 0x3c]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x60]
call fcn.14001e220
mov r10, qword [0x1403541e8]
cmp byte [0x140352944], 0
je 0x14001ea50
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.1400e7f50
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3