Function at 0x18001b040
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x288]
sub rsp, 0x380
mov rax, qword [0x18027d040]
xor rax, rsp
mov qword [rbp + 0x1d8], rax
cmp byte [0x1802b3b10], 0
jne 0x18001cf8f
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
movabs rsi, 0x7fffffffffffffff
mov qword [r11 + 0x18], rdi
xor edi, edi
mov qword [r11 - 0x10], r12
mov r12d, dword [0x1802b4a90]
mov qword [r11 - 0x18], r13
mov r13, qword gs:[0x58]
mov qword [r11 - 0x20], r14
mov r14d, 0xff
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
xorps xmm6, xmm6
movaps xmmword [r11 - 0x48], xmm7
movss xmm7, dword [0x18026ff0c]
movaps xmmword [r11 - 0x58], xmm8
movss xmm8, dword [0x18026fcf8]
movaps xmmword [r11 - 0x68], xmm9
movsd xmm9, qword [0x18026fe38]
movaps xmmword [r11 - 0x78], xmm10
movsd xmm10, qword [0x18026fd88]
movaps xmmword [r11 - 0x88], xmm11
movss xmm11, dword [0x18026fe70]
movaps xmmword [r11 - 0x98], xmm12
movss xmm12, dword [0x18026fdbc]
movaps xmmword [r11 - 0xa8], xmm13
movss xmm13, dword [0x18026fdb0]
mov r15d, 4
nop word [rax + rax]
mov eax, dword [0x1802b3b20]
lea rcx, [rbp - 0x68]
inc eax
movsxd rbx, eax
call fcn.180001690
mov rcx, qword [rbp - 0x68]
mov qword [rbp - 0x40], rcx
test rbx, rbx
je 0x18001b182
js 0x18001b182
imul rdx, rbx, 0xf4240
mov rax, rsi
sub rax, rdx
cmp rcx, rax
je 0x18001b17e
mov r8d, 1
cmovl r8d, r14d
test r8b, r8b
jns 0x18001b17e
lea rax, [rcx + rdx]
mov qword [rbp - 0x40], rax
jmp 0x18001b182
mov qword [rbp - 0x40], rsi
lea rcx, [rbp - 0x40]
call fcn.180004800
cmp qword [0x1802b5648], 0
je 0x18001cf04
mov ecx, dword [0x1802b3aac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18001b2d2
mov rdx, qword [0x1802b5648]
test rdx, rdx
je 0x18001b2d2
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001b204
cmp dword [0x1802b4c60], 0
je 0x18001b204
mov rax, qword [0x1802b4b48]
lea r8, [rbp + 0x78]
add rax, 4
mov qword [rsp + 0x20], rdi
add rdx, rax
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1802b5648]
mov rcx, qword [0x1802b4c68]
test dword [rbp + 0x78], 0x40000000
je 0x18001b2d2
test rdx, rdx
je 0x18001b2d2
test rcx, rcx
je 0x18001b255
cmp dword [0x1802b4c60], 0
je 0x18001b255
add rdx, qword [0x1802b4b30]
lea r8, [rbp + 0x130]
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1802b5648]
mov rcx, qword [0x1802b4c68]
cmp qword [rbp + 0x130], 0
je 0x18001b2d2
test rdx, rdx
je 0x18001b2d2
test rcx, rcx
je 0x18001b298
cmp dword [0x1802b4c60], 0
je 0x18001b298
add rdx, qword [0x1802b4b30]
lea r8, [rbp + 0x188]
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov rdx, qword [rbp + 0x188]
test rdx, rdx
je 0x18001b2d2
mov byte [rbp - 0x50], 0x17
test rcx, rcx
je 0x18001b2d2
cmp dword [0x1802b4c60], 0
je 0x18001b2d2
add rdx, qword [0x1802b4b78]
lea r8, [rbp - 0x50]
mov r9d, 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14d, r15d
mov r15, qword [r13 + r12*8]
mov eax, dword [r14 + r15]
cmp dword [0x1802b5824], eax
jle 0x18001b313
lea rcx, [0x1802b5824]
call fcn.180074dc0
cmp dword [0x1802b5824], 0xffffffff
jne 0x18001b313
lea rcx, [0x1802b5808]
call fcn.180001690
lea rcx, [0x1802b5824]
call fcn.180074d54
lea rcx, [rbp - 0x70]
call fcn.180001690
mov rax, qword [rbp - 0x70]
xorps xmm0, xmm0
sub rax, qword [0x1802b5808]
cvtsi2sd xmm0, rax
divsd xmm0, xmm9
comisd xmm0, xmm10
jb 0x18001b4c3
mov rdx, qword [0x1802b5648]
mov r10, qword [0x1802b4c68]
test rdx, rdx
jne 0x18001b357
mov rdx, rdi
jmp 0x18001b392
test r10, r10
je 0x18001b38b
cmp dword [0x1802b4c60], 0
je 0x18001b38b
add rdx, 0x30
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x190]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rdx, qword [rbp + 0x190]
test r10, r10
je 0x18001b47b
cmp dword [0x1802b4c60], 0
je 0x18001b3ca
add rdx, 0x10
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x198]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
test r10, r10
je 0x18001b47b
cmp dword [0x1802b4c60], 0
je 0x18001b409
mov rdx, qword [rbp + 0x198]
lea r8, [rbp + 0x1a0]
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
test r10, r10
je 0x18001b47b
cmp dword [0x1802b4c60], 0
je 0x18001b444
mov rdx, qword [rbp + 0x1a0]
lea r8, [rbp + 0x1a8]
add rdx, 0x70
mov qword [rsp + 0x20], rdi
mov r9d, 8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
test r10, r10
je 0x18001b47b
cmp dword [0x1802b4c60], 0
je 0x18001b47b
mov rdx, qword [rbp + 0x1a8]
lea r8, [rbp + 0x1b0]
mov r9d, 8
mov qword [rsp + 0x20], rdi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3abb], 0
je 0x18001b489
movaps xmm0, xmm7
jmp 0x18001b48d
movaps xmm0, xmm8
movss dword [rbp + 0x70], xmm0
test r10, r10
je 0x18001b4ca
cmp dword [0x1802b4c60], 0
je 0x18001b4ca
mov rdx, qword [rbp + 0x1b0]
lea r8, [rbp + 0x70]
add rdx, 0x2c
mov qword [rsp + 0x20], rdi
mov r9d, 4
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3a8d], 0
je 0x18001b567
mov rcx, qword [0x1802b5648]
test rcx, rcx
jne 0x18001b4e8
mov rcx, rdi
jmp 0x18001b529
test r10, r10
je 0x18001b522
cmp dword [0x1802b4c60], 0
je 0x18001b522
mov rdx, qword [0x1802b4b20]
lea r8, [rbp + 0x1b8]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rcx, qword [rbp + 0x1b8]
mov dword [rbp + 0x68], 0x42c40000
test r10, r10
je 0x18001b567
cmp dword [0x1802b4c60], 0
je 0x18001b567
mov rdx, qword [0x1802b4b50]
lea r8, [rbp + 0x68]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, r10
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3ab8], 0
je 0x18001b6ee
mov rcx, qword [0x1802b5648]
test rcx, rcx
je 0x18001b607
test r10, r10
je 0x18001b5be
cmp dword [0x1802b4c60], 0
je 0x18001b5be
mov rdx, qword [0x1802b4b98]
lea r8, [rbp + 0x88]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rdx, qword [rbp + 0x88]
test rdx, rdx
je 0x18001b607
test r10, r10
je 0x18001b5fe
cmp dword [0x1802b4c60], 0
je 0x18001b5fe
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x90]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rbx, qword [rbp + 0x90]
jmp 0x18001b60a
mov rbx, rdi
test r10, r10
je 0x18001b675
cmp dword [0x1802b4c60], 0
je 0x18001b63e
lea rdx, [rbx + 0x60]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x1d0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
test r10, r10
je 0x18001b675
cmp dword [0x1802b4c60], 0
je 0x18001b675
lea rdx, [rbx + 0x8d]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x98]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rbx, qword [rbp + 0x98]
test r10, r10
je 0x18001b6af
cmp dword [0x1802b4c60], 0
je 0x18001b6af
mov r9d, 8
mov qword [rsp + 0x20], rdi
lea r8, [rbp + 0x1c8]
mov rdx, rbx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov qword [rbp + 0xa0], 0x270f
test r10, r10
je 0x18001b6ee
cmp dword [0x1802b4c60], 0
je 0x18001b6ee
lea rdx, [rbx + 0x18]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xa0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3a8e], 0
je 0x18001b77b
test r10, r10
je 0x18001b739
cmp dword [0x1802b4c60], 0
je 0x18001b739
mov rdx, qword [0x1802b5648]
lea r8, [rbp + 0xa8]
add rdx, qword [0x1802b4b18]
mov r9d, 8
mov rcx, r10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov dword [rbp + 0x60], 0
test r10, r10
je 0x18001b77b
cmp dword [0x1802b4c60], 0
je 0x18001b77b
mov rdx, qword [rbp + 0xa8]
lea r8, [rbp + 0x60]
add rdx, qword [0x1802b4b88]
mov r9d, 4
mov rcx, r10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
movzx eax, byte [0x1802b3ab7]
cmp byte [0x1802b4ce3], al
je 0x18001b8f0
mov rcx, qword [0x1802b5648]
test rcx, rcx
je 0x18001b821
test r10, r10
je 0x18001b7d8
cmp dword [0x1802b4c60], 0
je 0x18001b7d8
mov rdx, qword [0x1802b4b98]
lea r8, [rbp + 0xb0]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
je 0x18001b821
test r10, r10
je 0x18001b818
cmp dword [0x1802b4c60], 0
je 0x18001b818
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xb8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rbx, qword [rbp + 0xb8]
jmp 0x18001b824
mov rbx, rdi
mov eax, dword [r14 + r15]
cmp dword [0x1802b57e8], eax
jle 0x18001b893
lea rcx, [0x1802b57e8]
call fcn.180074dc0
cmp dword [0x1802b57e8], 0xffffffff
jne 0x18001b88c
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001b873
cmp dword [0x1802b4c60], 0
je 0x18001b873
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x54]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x54]
lea rcx, [0x1802b57e8]
movss dword [0x1802b581c], xmm0
call fcn.180074d54
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3ab7], 0
je 0x18001b8a5
mov dword [rbp - 0x38], 0
jmp 0x18001b8b2
movss xmm0, dword [0x1802b581c]
movss dword [rbp - 0x38], xmm0
test r10, r10
je 0x18001b8e3
cmp dword [0x1802b4c60], 0
je 0x18001b8e3
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp - 0x38]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
movzx eax, byte [0x1802b3ab7]
mov byte [0x1802b4ce3], al
mov rdx, qword [0x1802b5648]
test rdx, rdx
je 0x18001ba4a
test r10, r10
je 0x18001b934
cmp dword [0x1802b4c60], 0
je 0x18001b934
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rbx, qword [rbp + 0xc0]
test rbx, rbx
je 0x18001ba4a
mov eax, dword [r14 + r15]
cmp dword [0x1802b5820], eax
jle 0x18001b978
lea rcx, [0x1802b5820]
call fcn.180074dc0
cmp dword [0x1802b5820], 0xffffffff
jne 0x18001b971
lea rcx, [0x1802b5820]
call fcn.180074d54
mov r10, qword [0x1802b4c68]
mov eax, dword [r14 + r15]
cmp dword [0x1802b57dc], eax
jle 0x18001b9e7
lea rcx, [0x1802b57dc]
call fcn.180074dc0
cmp dword [0x1802b57dc], 0xffffffff
jne 0x18001b9e0
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001b9c7
cmp dword [0x1802b4c60], 0
je 0x18001b9c7
lea rdx, [rbx + 0x38]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x50]
lea rcx, [0x1802b57dc]
movss dword [0x1802b57c4], xmm0
call fcn.180074d54
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3ab9], 0
je 0x18001ba0c
movd xmm0, dword [0x1802b3ab0]
cvtdq2ps xmm0, xmm0
divss xmm0, xmm11
mulss xmm0, xmm12
subss xmm0, xmm13
jmp 0x18001ba14
movss xmm0, dword [0x1802b57c4]
movss dword [rbp - 0x30], xmm0
test r10, r10
je 0x18001ba4a
cmp dword [0x1802b4c60], 0
je 0x18001ba4a
lea rdx, [rbx + 0x38]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp - 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
mov rdx, qword [0x1802b5648]
test rdx, rdx
je 0x18001c1af
test r10, r10
je 0x18001ba95
cmp dword [0x1802b4c60], 0
je 0x18001ba95
mov rax, qword [0x1802b4b48]
lea r8, [rbp + 0x4c]
add rax, 4
mov qword [rsp + 0x20], rdi
add rdx, rax
mov r9d, 4
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
test dword [rbp + 0x4c], 0x40000000
je 0x18001c1af
mov rcx, qword [0x1802b5648]
test rcx, rcx
je 0x18001c087
test r10, r10
je 0x18001baec
cmp dword [0x1802b4c60], 0
je 0x18001baec
mov rdx, qword [0x1802b4b30]
lea r8, [rbp + 0xc8]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rsi, qword [rbp + 0xc8]
test rsi, rsi
je 0x18001c087
test r10, r10
je 0x18001bb30
cmp dword [0x1802b4c60], 0
je 0x18001bb30
lea rdx, [rsi + 0x20]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xd0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rbx, qword [rbp + 0xd0]
test r10, r10
je 0x18001bb71
cmp dword [0x1802b4c60], 0
je 0x18001bb71
mov rdx, qword [0x1802b4b28]
lea r8, [rbp + 0x80]
add rdx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rdi, qword [rbp + 0x80]
test rdi, rdi
je 0x18001bfb2
mov eax, dword [r14 + r15]
cmp dword [0x1802b5818], eax
jle 0x18001bbb5
lea rcx, [0x1802b5818]
call fcn.180074dc0
cmp dword [0x1802b5818], 0xffffffff
jne 0x18001bbae
lea rcx, [0x1802b5818]
call fcn.180074d54
mov r10, qword [0x1802b4c68]
mov eax, dword [r14 + r15]
cmp dword [0x1802b57d0], eax
jle 0x18001bc2f
lea rcx, [0x1802b57d0]
call fcn.180074dc0
cmp dword [0x1802b57d0], 0xffffffff
jne 0x18001bc28
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001bc0f
cmp dword [0x1802b4c60], 0
je 0x18001bc0f
mov rdx, qword [rbp + 0x80]
lea r8, [rbp + 0x48]
add rdx, 0x4c
mov qword [rsp + 0x20], 0
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x48]
lea rcx, [0x1802b57d0]
movss dword [0x1802b5810], xmm0
call fcn.180074d54
mov r10, qword [0x1802b4c68]
mov eax, dword [r14 + r15]
cmp dword [0x1802b582c], eax
jle 0x18001bca5
lea rcx, [0x1802b582c]
call fcn.180074dc0
cmp dword [0x1802b582c], 0xffffffff
jne 0x18001bc9e
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001bc85
cmp dword [0x1802b4c60], 0
je 0x18001bc85
lea rdx, [rdi + 0xf8]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x44]
lea rcx, [0x1802b582c]
movss dword [0x1802b5828], xmm0
call fcn.180074d54
mov r10, qword [0x1802b4c68]
mov eax, dword [r14 + r15]
cmp dword [0x1802b57e0], eax
jle 0x18001bd18
lea rcx, [0x1802b57e0]
call fcn.180074dc0
cmp dword [0x1802b57e0], 0xffffffff
jne 0x18001bd11
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001bcf8
cmp dword [0x1802b4c60], 0
je 0x18001bcf8
lea rdx, [rbx + 0x38]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x40]
lea rcx, [0x1802b57e0]
movss dword [0x1802b57e4], xmm0
call fcn.180074d54
mov r10, qword [0x1802b4c68]
mov eax, dword [r14 + r15]
cmp dword [0x1802b57cc], eax
jle 0x18001bd8e
lea rcx, [0x1802b57cc]
call fcn.180074dc0
cmp dword [0x1802b57cc], 0xffffffff
jne 0x18001bd87
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001bd6e
cmp dword [0x1802b4c60], 0
je 0x18001bd6e
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x58]
lea rcx, [0x1802b57cc]
movss dword [0x1802b5830], xmm0
call fcn.180074d54
mov r10, qword [0x1802b4c68]
mov eax, dword [r14 + r15]
cmp dword [0x1802b57fc], eax
jle 0x18001be04
lea rcx, [0x1802b57fc]
call fcn.180074dc0
cmp dword [0x1802b57fc], 0xffffffff
jne 0x18001bdfd
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001bde4
cmp dword [0x1802b4c60], 0
je 0x18001bde4
lea rdx, [rdi + 0x88]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x10]
lea rcx, [0x1802b57fc]
movss dword [0x1802b57f8], xmm0
call fcn.180074d54
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3ad8], 0
je 0x18001be1a
movd xmm0, dword [0x1802b3adc]
cvtdq2ps xmm0, xmm0
jmp 0x18001be22
movss xmm0, dword [0x1802b5810]
xor ebx, ebx
movss dword [rbp - 0x28], xmm0
test r10, r10
je 0x18001be59
cmp dword [0x1802b4c60], ebx
je 0x18001be59
lea rdx, [rdi + 0x4c]
mov qword [rsp + 0x20], rbx
mov r9d, 4
lea r8, [rbp - 0x28]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3ae0], 0
je 0x18001be6f
movd xmm0, dword [0x1802b3ae4]
cvtdq2ps xmm0, xmm0
jmp 0x18001be77
movss xmm0, dword [0x1802b5830]
movss dword [rbp + 8], xmm0
test r10, r10
je 0x18001beb0
cmp dword [0x1802b4c60], 0
je 0x18001beb0
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], rbx
mov r9d, 4
lea r8, [rbp + 8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3ae8], 0
je 0x18001bec6
movd xmm0, dword [0x1802b3aec]
cvtdq2ps xmm0, xmm0
jmp 0x18001bece
movss xmm0, dword [0x1802b57f8]
movss dword [rbp - 0x20], xmm0
test r10, r10
je 0x18001bf07
cmp dword [0x1802b4c60], 0
je 0x18001bf07
lea rdx, [rdi + 0x88]
mov qword [rsp + 0x20], rbx
mov r9d, 4
lea r8, [rbp - 0x20]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3af0], 0
je 0x18001bf1d
movd xmm0, dword [0x1802b3af4]
cvtdq2ps xmm0, xmm0
jmp 0x18001bf25
movss xmm0, dword [0x1802b57e4]
movss dword [rbp - 0x18], xmm0
test r10, r10
je 0x18001bf5b
cmp dword [0x1802b4c60], 0
je 0x18001bf5b
lea rdx, [rdi + 0x38]
mov qword [rsp + 0x20], rbx
mov r9d, 4
lea r8, [rbp - 0x18]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3af8], 0
je 0x18001bf6d
mov dword [rbp - 0x10], 0
jmp 0x18001bf7a
movss xmm0, dword [0x1802b5828]
movss dword [rbp - 0x10], xmm0
test r10, r10
je 0x18001bfb2
cmp dword [0x1802b4c60], 0
je 0x18001bfb2
lea rdx, [rdi + 0xf8]
mov r9d, 4
xor edi, edi
lea r8, [rbp - 0x10]
mov rcx, r10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
jmp 0x18001bfb4
xor edi, edi
mov byte [0x1802b4ae0], 1
test r10, r10
je 0x18001bfef
cmp dword [0x1802b4c60], 0
je 0x18001bfef
lea rdx, [rsi + 0x20]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xd8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rax, qword [rbp + 0xd8]
mov qword [0x1802b4ad8], rax
mov qword [0x1802b4ae8], rsi
test r10, r10
je 0x18001c038
cmp dword [0x1802b4c60], 0
je 0x18001c038
lea rdx, [rsi + 0x30]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xe0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rax, qword [rbp + 0xe0]
mov qword [0x1802b4ad0], rax
test r10, r10
je 0x18001c07a
cmp dword [0x1802b4c60], 0
je 0x18001c07a
lea rdx, [rsi + 0x90]
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rbp - 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
movsd xmm0, qword [rbp - 0x60]
mov eax, dword [rbp - 0x58]
jmp 0x18001c2c7
mov rdx, qword [0x1802b5648]
mov byte [0x1802b4ae0], 0
test rdx, rdx
jne 0x18001c09f
mov rax, rdi
jmp 0x18001c0da
test r10, r10
je 0x18001c0d3
cmp dword [0x1802b4c60], 0
je 0x18001c0d3
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xe8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rax, qword [rbp + 0xe8]
mov rdx, qword [0x1802b5648]
mov qword [0x1802b4ad8], rax
mov qword [0x1802b4ae8], rdx
test rdx, rdx
jne 0x18001c0f9
mov rax, rdi
jmp 0x18001c134
test r10, r10
je 0x18001c12d
cmp dword [0x1802b4c60], 0
je 0x18001c12d
add rdx, 0x30
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xf0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rax, qword [rbp + 0xf0]
cmp qword [0x1802b5648], 0
mov qword [0x1802b4ad0], rax
jne 0x18001c164
movaps xmm0, xmm6
movss dword [rsp + 0x50], xmm6
mov eax, dword [rsp + 0x50]
unpcklps xmm0, xmm6
movsd qword [rsp + 0x48], xmm0
movq xmm0, xmm0
jmp 0x18001c2c7
test r10, r10
je 0x18001c1a0
cmp dword [0x1802b4c60], 0
je 0x18001c1a0
mov rdx, qword [0x1802b5648]
lea r8, [rsp + 0x48]
add rdx, 0x90
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
movsd xmm0, qword [rsp + 0x48]
mov eax, dword [rsp + 0x50]
jmp 0x18001c2c7
mov rdx, qword [0x1802b5648]
mov byte [0x1802b4ae0], 0
test rdx, rdx
jne 0x18001c1c7
mov rax, rdi
jmp 0x18001c202
test r10, r10
je 0x18001c1fb
cmp dword [0x1802b4c60], 0
je 0x18001c1fb
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xf8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rax, qword [rbp + 0xf8]
mov rdx, qword [0x1802b5648]
mov qword [0x1802b4ad8], rax
mov qword [0x1802b4ae8], rdx
test rdx, rdx
jne 0x18001c221
mov rax, rdi
jmp 0x18001c25c
test r10, r10
je 0x18001c255
cmp dword [0x1802b4c60], 0
je 0x18001c255
add rdx, 0x30
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x100]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rax, qword [rbp + 0x100]
cmp qword [0x1802b5648], 0
mov qword [0x1802b4ad0], rax
jne 0x18001c281
movaps xmm0, xmm6
movss dword [rsp + 0x44], xmm6
unpcklps xmm0, xmm6
movsd qword [rsp + 0x3c], xmm0
jmp 0x18001c2bd
test r10, r10
je 0x18001c2bd
cmp dword [0x1802b4c60], 0
je 0x18001c2bd
mov rdx, qword [0x1802b5648]
lea r8, [rsp + 0x3c]
add rdx, 0x90
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
movsd xmm0, qword [rsp + 0x3c]
mov eax, dword [rsp + 0x44]
mov dword [0x1802b4cb8], eax
movzx eax, byte [0x1802b3aba]
cmp byte [0x1802b4ce2], al
movsd qword [0x1802b4cb0], xmm0
je 0x18001c67f
mov rcx, qword [0x1802b5648]
test rcx, rcx
je 0x18001c37b
test r10, r10
je 0x18001c332
cmp dword [0x1802b4c60], 0
je 0x18001c332
mov rdx, qword [0x1802b4b98]
lea r8, [rbp + 0x108]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rdx, qword [rbp + 0x108]
test rdx, rdx
je 0x18001c37b
test r10, r10
je 0x18001c372
cmp dword [0x1802b4c60], 0
je 0x18001c372
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x110]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rbx, qword [rbp + 0x110]
jmp 0x18001c37e
mov rbx, rdi
mov eax, dword [r14 + r15]
cmp dword [0x1802b57ec], eax
jle 0x18001c3ec
lea rcx, [0x1802b57ec]
call fcn.180074dc0
cmp dword [0x1802b57ec], 0xffffffff
jne 0x18001c3e5
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001c3d0
cmp dword [0x1802b4c60], 0
je 0x18001c3d0
lea rdx, [rbx + 0x2e4]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x14]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x14]
lea rcx, [0x1802b57ec]
mov dword [0x1802b5800], eax
call fcn.180074d54
mov r10, qword [0x1802b4c68]
mov eax, dword [r14 + r15]
cmp dword [0x1802b57f0], eax
jle 0x18001c45a
lea rcx, [0x1802b57f0]
call fcn.180074dc0
cmp dword [0x1802b57f0], 0xffffffff
jne 0x18001c453
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001c43e
cmp dword [0x1802b4c60], 0
je 0x18001c43e
lea rdx, [rbx + 0x2e8]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x18]
lea rcx, [0x1802b57f0]
mov dword [0x1802b57c8], eax
call fcn.180074d54
mov r10, qword [0x1802b4c68]
mov eax, dword [r14 + r15]
cmp dword [0x1802b5814], eax
jle 0x18001c4cc
lea rcx, [0x1802b5814]
call fcn.180074dc0
cmp dword [0x1802b5814], 0xffffffff
jne 0x18001c4c5
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001c4ac
cmp dword [0x1802b4c60], 0
je 0x18001c4ac
lea rdx, [rbx + 0x8c]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x1c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x1c]
lea rcx, [0x1802b5814]
movss dword [0x1802b57d4], xmm0
call fcn.180074d54
mov r10, qword [0x1802b4c68]
mov eax, dword [r14 + r15]
cmp dword [0x1802b57d8], eax
jle 0x18001c53e
lea rcx, [0x1802b57d8]
call fcn.180074dc0
cmp dword [0x1802b57d8], 0xffffffff
jne 0x18001c537
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001c51e
cmp dword [0x1802b4c60], 0
je 0x18001c51e
lea rdx, [rbx + 0x2f4]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x20]
lea rcx, [0x1802b57d8]
movss dword [0x1802b57f4], xmm0
call fcn.180074d54
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3aba], 0
mov eax, dword [0x1802b5800]
cmovne eax, edi
mov dword [rbp + 0x28], eax
test r10, r10
je 0x18001c585
cmp dword [0x1802b4c60], 0
je 0x18001c585
lea rdx, [rbx + 0x2e4]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x28]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3aba], 0
mov eax, dword [0x1802b57c8]
cmovne eax, edi
mov dword [rbp + 0x30], eax
test r10, r10
je 0x18001c5cc
cmp dword [0x1802b4c60], 0
je 0x18001c5cc
lea rdx, [rbx + 0x2e8]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3aba], 0
je 0x18001c5de
mov dword [rbp - 8], 0x3c23d70a
jmp 0x18001c5eb
movss xmm0, dword [0x1802b57f4]
movss dword [rbp - 8], xmm0
test r10, r10
je 0x18001c61f
cmp dword [0x1802b4c60], 0
je 0x18001c61f
lea rdx, [rbx + 0x2f4]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp - 8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
cmp byte [0x1802b3aba], 0
je 0x18001c631
mov dword [rbp], 0x43520000
jmp 0x18001c63e
movss xmm0, dword [0x1802b57d4]
movss dword [rbp], xmm0
test r10, r10
je 0x18001c672
cmp dword [0x1802b4c60], 0
je 0x18001c672
lea rdx, [rbx + 0x8c]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
movzx eax, byte [0x1802b3aba]
mov byte [0x1802b4ce2], al
movzx ecx, byte [0x1802b3a8c]
cmp byte [0x1802b4ac2], cl
je 0x18001c6dc
test cl, cl
mov eax, 0x20
cmovne eax, edi
mov byte [rbp - 0x50], al
test r10, r10
je 0x18001c6d6
cmp dword [0x1802b4c60], 0
je 0x18001c6d6
mov rdx, qword [0x1802b5648]
lea r8, [rbp - 0x50]
add rdx, qword [0x1802b4b40]
mov r9d, 1
mov rcx, r10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ecx, byte [0x1802b3a8c]
mov byte [0x1802b4ac2], cl
mov ecx, dword [0x1802b3a94]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18001c6f2
call fcn.18001acc0
mov rcx, qword [0x1802b5648]
mov r10, qword [0x1802b4c68]
test rcx, rcx
je 0x18001c7b1
test r10, r10
je 0x18001c743
cmp dword [0x1802b4c60], 0
je 0x18001c743
mov rdx, qword [0x1802b4b20]
lea r8, [rbp + 0x118]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rdx, qword [rbp + 0x118]
test rdx, rdx
je 0x18001c7b1
movzx ecx, byte [0x1802b3ab6]
movzx eax, byte [0x1802b3ab5]
test cl, cl
jne 0x18001c765
test al, al
je 0x18001c7b1
neg cl
sbb ecx, ecx
and ecx, 0x4000
neg al
sbb eax, eax
and eax, 0x2000
or ecx, eax
mov dword [rbp + 0x38], ecx
test r10, r10
je 0x18001c7b1
cmp dword [0x1802b4c60], 0
je 0x18001c7b1
add rdx, 0x218
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp + 0x38]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x1802b4c68]
mov rbx, qword [0x1802b5648]
movzx edi, byte [0x1802b3a85]
test rbx, rbx
je 0x18001c850
test r10, r10
je 0x18001c801
cmp dword [0x1802b4c60], 0
je 0x18001c801
xor eax, eax
lea rdx, [rbx + 0x188]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x120]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x1802b4c68]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
bts rcx, 9
btr rax, 9
test dil, dil
cmove rcx, rax
mov qword [rbp - 0x40], rcx
test r10, r10
je 0x18001c850
xor edi, edi
cmp dword [0x1802b4c60], edi
je 0x18001c852
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp - 0x40]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x18001c852
xor edi, edi
mov ecx, dword [0x1802b3a88]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18001c870
cmp byte [0x1802b3a85], 0
sete byte [0x1802b3a85]
cmp byte [0x1802b3abb], 0
je 0x18001c9b5
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001c9a2
mov eax, dword [0x1802b4c60]
test eax, eax
je 0x18001c8c7
mov rdx, qword [0x1802b5648]
lea r8, [rbp + 0x128]
add rdx, 0x30
mov qword [rsp + 0x20], rdi
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov eax, dword [0x1802b4c60]
test rcx, rcx
je 0x18001c9a2
test eax, eax
je 0x18001c904
mov rdx, qword [rbp + 0x128]
lea r8, [rbp + 0x180]
add rdx, 0x10
mov qword [rsp + 0x20], rdi
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov eax, dword [0x1802b4c60]
test rcx, rcx
je 0x18001c9a2
test eax, eax
je 0x18001c941
mov rdx, qword [rbp + 0x180]
lea r8, [rbp + 0x138]
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov eax, dword [0x1802b4c60]
test rcx, rcx
je 0x18001c9a2
test eax, eax
je 0x18001c97a
mov rdx, qword [rbp + 0x138]
lea r8, [rbp + 0x140]
add rdx, 0x70
mov qword [rsp + 0x20], rdi
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov eax, dword [0x1802b4c60]
test rcx, rcx
je 0x18001c9a2
test eax, eax
je 0x18001c9a2
mov rdx, qword [rbp + 0x140]
lea r8, [rbp + 0x148]
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0x148]
movaps xmm1, xmm7
add rcx, 0x2c
call fcn.18001d130
movzx edx, byte [0x1802b3af9]
cmp byte [0x1802b4ce1], dl
je 0x18001ca62
mov r10, qword [0x1802b4c68]
test dl, dl
setne al
add al, 0xc8
mov byte [rbp - 0x50], al
test r10, r10
je 0x18001ca1b
cmp dword [0x1802b4c60], 0
je 0x18001ca1b
mov rdx, qword [0x1802b4b38]
lea r8, [rbp - 0x50]
add rdx, qword [0x1802b5648]
mov r9d, 1
mov rcx, r10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx edx, byte [0x1802b3af9]
mov r10, qword [0x1802b4c68]
test dl, dl
sete byte [rbp - 0x48]
test r10, r10
je 0x18001ca5c
cmp dword [0x1802b4c60], 0
je 0x18001ca5c
mov rdx, qword [0x1802b5648]
lea r8, [rbp - 0x48]
add rdx, qword [0x1802b4b70]
mov r9d, 1
mov rcx, r10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx edx, byte [0x1802b3af9]
mov byte [0x1802b4ce1], dl
cmp byte [0x1802b3a91], 0
mov eax, 0xc3
mov rcx, qword [0x1802b4b68]
mov ebx, 0x48
cmovne ebx, eax
add rcx, qword [0x1802b54a8]
movzx edx, bl
call fcn.18001d1b0
mov rcx, qword [0x1802b4b80]
movzx edx, bl
add rcx, qword [0x1802b54a8]
call fcn.18001d1b0
mov rdx, qword [0x1802b5648]
mov rcx, qword [0x1802b4c68]
test rdx, rdx
je 0x18001cc1e
test rcx, rcx
je 0x18001caed
cmp dword [0x1802b4c60], 0
je 0x18001caed
add rdx, qword [0x1802b4b30]
lea r8, [rbp + 0x150]
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov rbx, qword [rbp + 0x150]
test rbx, rbx
je 0x18001cc1e
test rcx, rcx
je 0x18001cb34
cmp dword [0x1802b4c60], 0
je 0x18001cb34
mov rdx, qword [0x1802b4b58]
lea r8, [rbp + 0x158]
add rdx, rbx
mov qword [rsp + 0x20], rdi
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov rax, qword [0x1802b5648]
cmp qword [rbp + 0x158], rax
jne 0x18001cc3c
mov byte [0x1802b4ae0], 1
test rcx, rcx
je 0x18001cb80
cmp dword [0x1802b4c60], 0
je 0x18001cb80
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov rax, qword [rbp + 0x160]
mov qword [0x1802b4ad8], rax
mov qword [0x1802b4ae8], rbx
test rcx, rcx
je 0x18001cbc6
cmp dword [0x1802b4c60], 0
je 0x18001cbc6
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov rax, qword [rbp + 0x168]
mov qword [0x1802b4ad0], rax
test rcx, rcx
je 0x18001cc06
cmp dword [0x1802b4c60], 0
je 0x18001cc06
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
movsd xmm0, qword [rsp + 0x68]
mov eax, dword [rsp + 0x70]
movsd qword [0x1802b4cb0], xmm0
mov dword [0x1802b4cb8], eax
cmp byte [0x1802b4ae0], 0
jne 0x18001cd4a
mov rdx, qword [0x1802b5648]
test rdx, rdx
jne 0x18001cc45
mov rax, rdi
jmp 0x18001cc7d
mov byte [0x1802b4ae0], 0
jmp 0x18001cc2b
test rcx, rcx
je 0x18001cc76
cmp dword [0x1802b4c60], 0
je 0x18001cc76
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov rax, qword [rbp + 0x170]
mov rdx, qword [0x1802b5648]
mov qword [0x1802b4ad8], rax
mov qword [0x1802b4ae8], rdx
test rdx, rdx
jne 0x18001cc9c
mov rax, rdi
jmp 0x18001ccd4
test rcx, rcx
je 0x18001cccd
cmp dword [0x1802b4c60], 0
je 0x18001cccd
add rdx, 0x30
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov rax, qword [rbp + 0x178]
cmp qword [0x1802b5648], 0
mov qword [0x1802b4ad0], rax
jne 0x18001ccf9
movaps xmm0, xmm6
movss dword [rsp + 0x38], xmm6
unpcklps xmm0, xmm6
movsd qword [rsp + 0x30], xmm0
jmp 0x18001cd32
test rcx, rcx
je 0x18001cd32
cmp dword [0x1802b4c60], 0
je 0x18001cd32
mov rdx, qword [0x1802b5648]
lea r8, [rsp + 0x30]
add rdx, 0x90
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
movsd xmm0, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
movsd qword [0x1802b4cb0], xmm0
mov dword [0x1802b4cb8], eax
mov rdx, qword [0x1802b55d0]
test rdx, rdx
je 0x18001cdc0
test rcx, rcx
je 0x18001cd8a
cmp dword [0x1802b4c60], 0
je 0x18001cd8a
add rdx, 0x3c0
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1802b4c68]
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x18001cdc0
test rcx, rcx
je 0x18001cdd1
cmp dword [0x1802b4c60], 0
je 0x18001cdd1
add rdx, 0x40
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x18001cdd1
mov qword [rsp + 0x54], 0
mov dword [rsp + 0x5c], 0
movsd xmm0, qword [rsp + 0x54]
lea rcx, [rbp - 0x80]
mov eax, dword [rsp + 0x5c]
movsd qword [rbp - 0x80], xmm0
mov dword [rbp - 0x78], eax
call fcn.18001a880
cmp byte [0x1802b3a9d], 0
je 0x18001ceb2
mov ebx, 0xff
movabs r12, 0x7fffffffffffffff
movabs r14, 0x7ffffffffa0a1eff
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x1802b5648]
xor r8d, r8d
mov edx, 0x156
call fcn.18001a780
mov rcx, qword [0x1802b5648]
mov r8b, 1
mov edx, 0xfc
call fcn.18001a780
mov rcx, qword [0x1802b5648]
mov r8b, 1
mov edx, 0x8d
call fcn.18001a780
lea rcx, [rsp + 0x60]
call fcn.180001690
mov rax, qword [rsp + 0x60]
mov qword [rbp - 0x40], rax
cmp rax, r14
je 0x18001ce8c
mov ecx, 1
cmovl ecx, ebx
test cl, cl
jns 0x18001ce8c
add rax, 0x5f5e100
mov qword [rbp - 0x40], rax
jmp 0x18001ce90
mov qword [rbp - 0x40], r12
lea rcx, [rbp - 0x40]
call fcn.180004800
cmp byte [0x1802b3a9d], 0
jne 0x18001ce20
mov r12d, dword [0x1802b4a90]
mov r14d, ebx
jmp 0x18001cef4
mov rcx, qword [0x1802b5648]
mov r8b, 1
mov edx, 0x156
call fcn.18001a780
mov rcx, qword [0x1802b5648]
xor r8d, r8d
mov edx, 0xfc
call fcn.18001a780
mov rcx, qword [0x1802b5648]
xor r8d, r8d
mov edx, 0x8d
call fcn.18001a780
mov r14d, 0xff
mov r15d, 4
movabs rsi, 0x7fffffffffffffff
cmp byte [0x1802b3b10], 0
je 0x18001b130
movaps xmm13, xmmword [rsp + 0x2e0]
movaps xmm12, xmmword [rsp + 0x2f0]
movaps xmm11, xmmword [rsp + 0x300]
movaps xmm10, xmmword [rsp + 0x310]
movaps xmm9, xmmword [rsp + 0x320]
movaps xmm8, xmmword [rsp + 0x330]
movaps xmm7, xmmword [rsp + 0x340]
movaps xmm6, xmmword [rsp + 0x350]
mov r15, qword [rsp + 0x360]
mov r14, qword [rsp + 0x368]
mov r13, qword [rsp + 0x370]
mov r12, qword [rsp + 0x378]
mov rdi, qword [rsp + 0x3a0]
mov rsi, qword [rsp + 0x398]
mov rbx, qword [rsp + 0x390]
mov rcx, qword [rbp + 0x1d8]
xor rcx, rsp
call fcn.180074910
add rsp, 0x380
pop rbp
ret