Function at 0x140002880
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x1f0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov rax, qword [0x14014a040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rdx
mov rdi, rcx
mov rdx, qword [0x14014a118]
add rdx, qword [0x14014b570]
xor r12d, r12d
mov qword [rbp + 0x90], r12
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x90]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r14, qword [rbp + 0x90]
xorps xmm6, xmm6
mov qword [rbp + 0x70], r12
mov dword [rbp + 0x78], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0xc
lea r8, [rbp + 0x70]
lea rdx, [r14 + 0x3d0]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [r14 + 0x60]
mov qword [rbp + 0x60], r12
mov dword [rbp + 0x68], r12d
mov qword [rsp + 0x20], r12
mov r9d, 0xc
lea r8, [rbp + 0x60]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14014a130]
add rdx, qword [rdi]
mov qword [rbp + 0x50], r12
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x50]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x50]
add rdx, 0x78
mov qword [rbp + 0x40], r12
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x40]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x40]
add rdx, 0x320
mov qword [rbp + 0x98], r12
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x98]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14014a188]
add rdx, qword [rbx]
mov byte [rbp + 0x30], r12b
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0x30]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp + 0x30]
test al, 0xdb
jne 0x140002a1b
cmp al, 0x20
je 0x140002a1b
xor r15b, r15b
jmp 0x140002a1e
mov r15b, 1
mov ecx, dword [0x14014a25c]
test ecx, ecx
je 0x140002a4a
sub ecx, 1
je 0x140002a3e
cmp ecx, 1
jne 0x140002a51
mov dword [0x14014b410], 8
jmp 0x140002a51
mov dword [0x14014b410], 7
jmp 0x140002a51
mov dword [0x14014b410], r12d
lea rdx, [r14 + 0x10]
mov qword [rbp + 0x40], r12
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x40]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rsi, qword [rbp + 0x40]
mov rdx, qword [0x14014a178]
add rdx, qword [rdi]
mov byte [rbp + 0x30], r12b
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0x30]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test byte [rbp + 0x30], 0x40
je 0x140002b5f
mov dword [rbp + 0x50], r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x50]
lea rdx, [rsi + 0x2ac]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x50]
ucomiss xmm0, dword [0x1401334b8]
jp 0x140002b5f
jne 0x140002b5f
mov dword [rbp + 0x50], r12d
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x50]
lea rdx, [rsi + 0x2ac]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x50], 0x42de0000
lea rdx, [rsi + 0x2c0]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x50]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x50], 0x42de0000
lea rdx, [rsi + 0x2c4]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x50]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14014a24c], 0
je 0x140002b71
test r15b, r15b
je 0x1400030d2
cmp byte [0x14014a24a], 0
je 0x140002d81
mov rdx, qword [0x14014a178]
add rdx, qword [rbx]
mov byte [rbp + 0x30], 0
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0x30]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 0xc
mov rcx, qword [0x14014b568]
test byte [rbp + 0x30], 0x40
je 0x140002bee
mov rdx, qword [0x14014a1a0]
add rdx, qword [rbx + 8]
mov qword [rbp + 0x40], 0
mov dword [rbp + 0x48], 0
lea r8, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsd xmm0, qword [rbp + 0x40]
mov eax, dword [rbp + 0x48]
jmp 0x140002c19
mov rdx, qword [0x14014a160]
add rdx, qword [rbx]
mov qword [rbp + 0x50], 0
mov dword [rbp + 0x58], 0
lea r8, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsd xmm0, qword [rbp + 0x50]
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x58], 0
movaps xmm8, xmm0
movss xmm0, dword [rbp + 0x48]
movlhps xmm8, xmm0
xorps xmm0, xmm0
unpcklps xmm0, xmm6
xorps xmm2, xmm2
movsd xmm2, xmm0
movss xmm0, dword [rbp + 0x58]
movlhps xmm2, xmm0
cmpeqps xmm2, xmm8
movmskps eax, xmm2
and eax, 7
cmp al, 7
je 0x140002d2a
movsd xmm1, qword [rdi + 0x30]
movsd xmm0, qword [rbx + 0x48]
movaps xmm3, xmm0
subss xmm3, xmm1
movaps xmm2, xmm0
shufps xmm2, xmm2, 0x55
movsd qword [rbp + 0x40], xmm0
movaps xmm0, xmm1
shufps xmm0, xmm0, 0x55
movsd qword [rbp + 0x40], xmm1
subss xmm2, xmm0
movss xmm1, dword [rbx + 0x50]
subss xmm1, dword [rdi + 0x38]
mulss xmm3, xmm3
mulss xmm2, xmm2
addss xmm3, xmm2
mulss xmm1, xmm1
addss xmm3, xmm1
xorps xmm0, xmm0
ucomiss xmm0, xmm3
ja 0x140002cb4
xorps xmm7, xmm7
sqrtss xmm7, xmm3
jmp 0x140002cbf
movaps xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm7, xmm0
mov rdx, qword [rdi + 0x18]
add rdx, 0xe0
mov dword [rbp + 0x50], 0
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x50]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x50]
ucomiss xmm0, xmm6
jp 0x140002cf9
je 0x140002d2a
divss xmm7, xmm0
movaps xmm2, xmm7
shufps xmm2, xmm2, 0
mulps xmm2, xmm8
mov qword [rbp + 0x40], 0
movaps xmm0, xmm2
shufps xmm0, xmm2, 0xaa
movaps xmm4, xmm2
shufps xmm4, xmm4, 0x55
movsd qword [rbp + 0x40], xmm2
movss dword [rbp + 0x48], xmm0
jmp 0x140002d37
xorps xmm2, xmm2
xorps xmm4, xmm4
mov dword [rbp + 0x48], 0
movsxd rax, dword [0x14014b410]
add rax, 6
lea rcx, [rax + rax*2]
movsd xmm3, qword [rbx + rcx*4]
movss xmm0, dword [rbx + rcx*4 + 8]
movlhps xmm3, xmm0
movaps xmm0, xmm2
unpcklps xmm0, xmm4
xorps xmm2, xmm2
movsd xmm2, xmm0
movss xmm0, dword [rbp + 0x48]
movlhps xmm2, xmm0
addps xmm2, xmm3
mov qword [rbp + 0x40], 0
movaps xmm0, xmm2
shufps xmm2, xmm2, 0xaa
movd eax, xmm2
jmp 0x140002d99
movsxd rax, dword [0x14014b410]
add rax, 6
lea rcx, [rax + rax*2]
movsd xmm0, qword [rbx + rcx*4]
mov eax, dword [rbx + rcx*4 + 8]
movsd qword [rbp + 0x40], xmm0
movss xmm1, dword [rbp + 0x60]
movss xmm8, dword [rbp + 0x40]
subss xmm1, xmm8
movss xmm2, dword [rbp + 0x64]
movss xmm9, dword [rbp + 0x44]
subss xmm2, xmm9
movss xmm0, dword [rbp + 0x68]
movd xmm7, eax
subss xmm0, xmm7
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
mulss xmm0, xmm0
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x140002df0
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x140002df8
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
subss xmm8, dword [rbp + 0x60]
divss xmm8, xmm0
subss xmm9, dword [rbp + 0x64]
divss xmm9, xmm0
subss xmm7, dword [rbp + 0x68]
divss xmm7, xmm0
unpcklps xmm8, xmm9
xorps xmm2, xmm2
movsd xmm2, xmm8
movss dword [rbp + 0x48], xmm7
movlhps xmm2, xmm7
movsd xmm4, qword [rbp + 0x70]
movss xmm0, dword [rbp + 0x78]
movlhps xmm4, xmm0
subps xmm2, xmm4
mov qword [rbp + 0x40], 0
movaps xmm0, xmm2
shufps xmm2, xmm2, 0xaa
xorps xmm1, xmm1
movsd xmm1, xmm0
movss dword [rbp + 0x48], xmm2
xorps xmm0, xmm0
movss xmm0, xmm2
movlhps xmm1, xmm0
movss xmm2, dword [0x14013339c]
divss xmm2, dword [0x14014a254]
shufps xmm2, xmm2, 0
mulps xmm2, xmm1
mov qword [rbp + 0x40], 0
movaps xmm0, xmm2
shufps xmm2, xmm2, 0xaa
xorps xmm1, xmm1
movsd xmm1, xmm0
movss dword [rbp + 0x48], xmm2
xorps xmm0, xmm0
movss xmm0, xmm2
movlhps xmm1, xmm0
addps xmm4, xmm1
mov qword [rbp + 0x80], 0
movaps xmm0, xmm4
movsd qword [rbp + 0x80], xmm4
shufps xmm4, xmm4, 0xaa
mov dword [rbp + 0x48], 0
xorps xmm3, xmm3
movsd xmm3, xmm0
movss dword [rbp + 0x88], xmm4
xorps xmm0, xmm0
movss xmm0, xmm4
movlhps xmm3, xmm0
xorps xmm0, xmm0
unpcklps xmm0, xmm6
xorps xmm2, xmm2
movsd xmm2, xmm0
movss xmm0, dword [rbp + 0x48]
movlhps xmm2, xmm0
cmpeqps xmm2, xmm3
movmskps eax, xmm2
and eax, 7
cmp al, 7
je 0x140002f74
cmp byte [0x14014a248], 0
je 0x140002f74
mov ecx, dword [0x14014a298]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x140002f2b
mov ecx, dword [0x14014a29c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x140002f74
lea rdx, [r14 + 0x40]
mov qword [rsp + 0x20], r12
mov r9d, 0xc
lea r8, [rbp + 0x80]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 0xc
lea r8, [rbp + 0x80]
lea rdx, [r14 + 0x3d0]
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14014a24d], 0
je 0x140002fb3
mov rdx, qword [rbp + 0x98]
add rdx, 0x20
movsxd rax, dword [0x14014b410]
add rax, 6
lea rax, [rax + rax*2]
lea r8, [rbx + rax*4]
mov qword [rsp + 0x20], r12
mov r9d, 0xc
mov rcx, qword [0x14014b568]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rsp + 0x78], xmm1
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x68], xmm1
movups xmmword [rbp - 0x58], xmm1
movups xmmword [rbp - 0x48], xmm1
movups xmmword [rbp - 0x38], xmm1
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], eax
mov dword [rbp + 0x24], eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov ecx, 9
lea rax, [rbp - 0x80]
mov qword [rax - 8], 0
mov dword [rax], r12d
lea rax, [rax + 0xc]
sub rcx, 1
jne 0x140003000
mov qword [rbp - 0x1c], 0x3f800000
mov dword [rbp - 0x14], ecx
movdqa xmm0, xmmword [0x140133620]
movups xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x140133880]
movups xmmword [rbp], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], 0x3f800000
lea rax, [rsp + 0x30]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rbx + 0x60], xmm0
sub rbx, 0xffffffffffffff80
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rbx - 0x10], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rax]
movups xmmword [rbx], xmm1
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rbx + 0x40], xmm1
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rbx + 0x50], xmm0
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rbx + 0x60], xmm1
mov rax, qword [rax + 0x70]
mov qword [rbx + 0x70], rax
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400ebef0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret