Function at 0x140022f30
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
mov rax, qword [0x140363f00]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor r13d, r13d
mov r12d, r13d
mov dword [rbp + 0x18], r13d
cmp byte [0x1403864f8], r13b
jne 0x140024870
movabs rbx, 0x8000000000000000
movss xmm10, dword [0x14034a714]
movss xmm7, dword [0x14034a6e8]
movss xmm8, dword [0x14034a710]
movss xmm9, dword [0x14034a514]
mov r10, qword [0x140387d18]
mov r14, qword [rbp + 0x20]
nop dword [rax]
mov rdx, qword [0x140387c30]
add rdx, 0x20
test r10, r10
je 0x14002300b
cmp dword [0x140387c74], 0
je 0x14002300b
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1c8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140387d18]
mov rdx, qword [0x1403884d0]
add rdx, qword [0x140387c08]
test r10, r10
je 0x140023049
cmp dword [0x140387c74], 0
je 0x140023049
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x88]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140387d18]
mov r15, qword [rbp + 0x88]
mov rdx, qword [0x1403884d0]
test rdx, rdx
je 0x140024863
cmp byte [0x1403864d8], 0
je 0x1400230ad
movd xmm0, dword [0x1403864d4]
cvtdq2ps xmm0, xmm0
movss dword [rbp], xmm0
test r10, r10
je 0x1400230a6
cmp dword [0x140387c74], 0
je 0x1400230a6
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x1403864d8], 0
mov ecx, dword [0x1403864d0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14002337c
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], rbx
mov byte [rbp - 0x30], 0
mov dword [rbp - 8], 0xffffffff
movaps xmm6, xmm10
cmp qword [0x1403884d0], 0
je 0x1400232c2
lea rdx, [0x1403884f0]
lea rcx, [rbp + 0x1a8]
call fcn.1400249c0
or r12d, 1
mov rsi, qword [rbp + 0x1b0]
mov rax, qword [rbp + 0x1a8]
cmp rax, rsi
je 0x140023272
lea rbx, [rax + 0x28]
nop word [rax + rax]
mov rax, qword [rbx - 0x28]
mov qword [rbp - 0x70], rax
lea rdx, [rbx - 0x20]
lea rcx, [rbp - 0x68]
call fcn.140014210
mov rax, qword [rbx]
mov qword [rbp - 0x48], rax
mov eax, dword [rbx + 8]
mov dword [rbp - 0x40], eax
mov rdi, qword [rbp - 0x70]
test rdi, rdi
je 0x140023222
mov rcx, qword [0x140387d18]
test rcx, rcx
je 0x140023191
cmp dword [0x140387c74], 0
je 0x140023191
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], r13
mov r9d, ntohs
lea r8, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm1, dword [rsp + 0x54]
subss xmm1, dword [0x1403884e4]
movss xmm2, dword [rsp + 0x58]
subss xmm2, dword [0x1403884e8]
movss xmm0, dword [rsp + 0x5c]
subss xmm0, dword [0x1403884ec]
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
mulss xmm0, xmm0
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x1400231e0
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x1400231e8
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
comiss xmm6, xmm0
jbe 0x140023222
comiss xmm7, xmm0
jbe 0x140023222
movaps xmm6, xmm0
mov qword [rbp - 0x38], rdi
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [rbp - 0x30]
call fcn.1400155b0
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 8], eax
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14002325d
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400248b9
call fcn.14012e214
add rbx, 0x38
lea rax, [rbx - 0x28]
cmp rax, rsi
jne 0x140023130
mov rbx, qword [rbp - 0x18]
lea rcx, [rbp + 0x1a8]
call fcn.140003d00
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400232c2
mov dword [rbp + 0x28], 1
mov rdx, qword [0x140387c28]
add rdx, rcx
mov rcx, qword [0x140387d18]
test rcx, rcx
je 0x1400232c9
cmp dword [0x140387c74], 0
je 0x1400232c9
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140387d18]
cmp rbx, 0xf
jbe 0x140023308
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400232fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400248c0
call fcn.14012e214
mov rcx, qword [0x140387d18]
movabs rbx, 0x8000000000000000
cmp byte [0x1403864ba], 0
je 0x140023385
test rcx, rcx
je 0x140023356
cmp dword [0x140387c74], 0
je 0x140023356
mov rdx, qword [0x1403884d0]
add rdx, 0x10c8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov dword [rbp], 0xbf800000
test rcx, rcx
je 0x1400233f8
cmp dword [0x140387c74], 0
je 0x1400233f8
mov rdx, qword [rbp + 0x90]
jmp 0x1400233dc
mov rcx, qword [0x140387d18]
jmp 0x140023312
test rcx, rcx
je 0x1400233c0
cmp dword [0x140387c74], 0
je 0x1400233c0
mov rdx, qword [0x1403884d0]
add rdx, 0x10c8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov dword [rbp], 0x42c80000
test rcx, rcx
je 0x1400233f8
cmp dword [0x140387c74], 0
je 0x1400233f8
mov rdx, qword [rbp + 0x98]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp]
add rdx, 0xcf4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, 0xdf
mov rcx, qword [0x1403884d0]
cmp byte [0x1403864b8], 0
je 0x140023412
mov r8b, 1
jmp 0x140023415
xor r8d, r8d
call fcn.140022970
cmp byte [0x1403864da], 0
je 0x14002346f
mov ecx, dword [0x1403864cc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14002346f
mov rcx, qword [0x1403884d0]
add rcx, 0x189
cmp byte [0x1403864d9], 0
je 0x14002344f
xor dl, dl
jmp 0x140023451
mov dl, 1
call fcn.140024b40
cmp byte [0x1403864d9], 0
sete byte [0x1403864d9]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140387d18]
cmp qword [0x140387bb8], 0
jne 0x14002352b
mov rdx, qword [0x1403884d0]
test rdx, rdx
jne 0x140023495
mov rdx, r13
jmp 0x1400234d0
test rcx, rcx
je 0x1400234c9
cmp dword [0x140387c74], 0
je 0x1400234c9
add rdx, qword [0x140387c08]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0xa0]
test rcx, rcx
je 0x140023501
cmp dword [0x140387c74], 0
je 0x140023501
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
xor edx, edx
movss xmm0, dword [rbp + 0x30]
comiss xmm0, xmm8
jb 0x14002351c
subss xmm0, xmm8
comiss xmm0, xmm8
jae 0x14002351c
mov rdx, rbx
cvttss2si rax, xmm0
add rax, rdx
mov qword [0x140387bb8], rax
cmp byte [0x1403864b9], 0
je 0x140023652
mov rdx, qword [0x1403884d0]
test rdx, rdx
jne 0x140023549
mov rdx, r13
jmp 0x140023584
test rcx, rcx
je 0x14002357d
cmp dword [0x140387c74], 0
je 0x14002357d
add rdx, qword [0x140387c08]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0xa8]
test rcx, rcx
je 0x1400235b5
cmp dword [0x140387c74], 0
je 0x1400235b5
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x34]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
movzx eax, byte [0x1403864b9]
neg al
sbb ebx, ebx
and ebx, 0x4000
cvttss2si rax, dword [rbp + 0x34]
or ebx, eax
mov rdx, qword [0x1403884d0]
test rdx, rdx
jne 0x1400235df
mov rdx, r13
jmp 0x14002361a
test rcx, rcx
je 0x140023613
cmp dword [0x140387c74], 0
je 0x140023613
add rdx, qword [0x140387c08]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x198]
mov dword [rbp + 0x38], ebx
test rcx, rcx
je 0x1400236bf
cmp dword [0x140387c74], 0
je 0x140023652
add rdx, 0x270
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140387d18]
test rcx, rcx
je 0x1400236bf
cmp dword [0x140387c74], 0
je 0x140023686
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x190]
mov rdx, qword [0x1403881e0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
test rcx, rcx
je 0x1400236bf
cmp dword [0x140387c74], 0
je 0x1400236bf
mov rdx, qword [rbp + 0x190]
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov r14, qword [rbp + 0x20]
mov rbx, r14
mov rax, qword [0x1403880e0]
mov rdx, qword [0x1403880e8]
cmp rax, rdx
je 0x1400236e3
cmp qword [rax], r14
je 0x140023758
add rax, 0x10
cmp rax, rdx
jne 0x1400236d5
mov qword [rsp + 0x70], r14
test rcx, rcx
je 0x140023721
cmp dword [0x140387c74], 0
je 0x140023721
lea rdx, [r14 + 0x30]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1403880e8]
mov rcx, qword [0x140387d18]
mov r14, qword [rbp + 0x20]
movss xmm0, dword [rbp + 0x40]
movss dword [rsp + 0x78], xmm0
cmp rdx, qword [0x1403880f0]
je 0x140023747
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rdx], xmm0
add qword [0x1403880e8], 0x10
jmp 0x140023758
lea r8, [rsp + 0x70]
call fcn.140024bd0
mov rcx, qword [0x140387d18]
cmp byte [0x1403864c4], 0
je 0x140023770
movss xmm0, dword [0x1403864c8]
movss dword [rbp], xmm0
jmp 0x140023777
mov dword [rbp], 0x42480000
test rcx, rcx
je 0x1400237a2
cmp dword [0x140387c74], 0
je 0x1400237a2
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp]
lea rdx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14, qword [rbp + 0x20]
mov edx, 0x59
mov rcx, qword [0x1403884d0]
cmp byte [0x1403864bd], 0
je 0x1400238f7
mov r8b, 1
call fcn.140022970
mov r8b, 1
mov edx, 0x6a
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, WSAGetLastError
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, WSASetLastError
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, WSASetLastError
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, WSASetLastError
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, reloc.WS2_32.dll___WSAFDIsSet
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, 0xa0
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, 0xa1
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, 0xa2
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, 0xa3
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, 0xa4
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, 0xa5
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, 0xc6
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, 0xc7
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
mov edx, 0xa3
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov r8b, 1
jmp 0x140023a2e
xor r8d, r8d
call fcn.140022970
xor r8d, r8d
mov edx, 0x6a
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, WSAGetLastError
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, WSASetLastError
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, WSASetLastError
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, WSASetLastError
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, reloc.WS2_32.dll___WSAFDIsSet
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xa0
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xa1
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xa2
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xa3
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xa4
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xa5
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xc6
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xc7
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xa3
mov rcx, qword [0x1403884d0]
call fcn.140022970
xor r8d, r8d
mov edx, 0xa3
mov rcx, qword [0x1403884d0]
call fcn.140022970
mov rcx, qword [0x140387d18]
cmp byte [0x1403864bc], 0
je 0x140023ba7
test rcx, rcx
je 0x140023a8b
cmp dword [0x140387c74], 0
je 0x140023a8b
mov rdx, qword [0x1403884d0]
add rdx, 0x30
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x188]
test rdx, rdx
je 0x140023d15
test rcx, rcx
je 0x140023acc
cmp dword [0x140387c74], 0
je 0x140023acc
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x140023d15
test rcx, rcx
je 0x140023b0d
cmp dword [0x140387c74], 0
je 0x140023b0d
add rdx, 0x20
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x178]
test rdx, rdx
je 0x140023d15
test rcx, rcx
je 0x140023b4e
cmp dword [0x140387c74], 0
je 0x140023b4e
add rdx, 0x70
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x170]
test rdx, rdx
je 0x140023d15
test rcx, rcx
je 0x140023b8b
cmp dword [0x140387c74], 0
je 0x140023b8b
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x160]
test rdx, rdx
je 0x140023d15
mov dword [rbp], 0xbf800000
jmp 0x140023cee
test rcx, rcx
je 0x140023bdf
cmp dword [0x140387c74], 0
je 0x140023bdf
mov rdx, qword [0x1403884d0]
add rdx, 0x30
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x138]
test rdx, rdx
je 0x140023d15
test rcx, rcx
je 0x140023c20
cmp dword [0x140387c74], 0
je 0x140023c20
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x168]
test rdx, rdx
je 0x140023d15
test rcx, rcx
je 0x140023c61
cmp dword [0x140387c74], 0
je 0x140023c61
add rdx, 0x20
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
je 0x140023d15
test rcx, rcx
je 0x140023ca2
cmp dword [0x140387c74], 0
je 0x140023ca2
add rdx, 0x70
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0xb8]
test rdx, rdx
je 0x140023d15
test rcx, rcx
je 0x140023cdb
cmp dword [0x140387c74], 0
je 0x140023cdb
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x140023d15
mov dword [rbp], 0x3e800000
test rcx, rcx
je 0x140023d15
cmp dword [0x140387c74], 0
je 0x140023d15
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp]
add rdx, 0x2c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1403864d9], 0
je 0x140023d3c
mov rcx, qword [0x1403884d0]
add rcx, 0x189
mov dl, 1
call fcn.140024b40
cmp byte [0x1403864d9], 0
jne 0x140023d51
mov rcx, qword [0x1403884d0]
add rcx, 0x189
xor edx, edx
call fcn.140024b40
mov edx, 2
mov rcx, qword [0x1403884d0]
cmp byte [0x1403864bb], 0
je 0x140023d6b
mov r8b, 1
jmp 0x140023d6e
xor r8d, r8d
call fcn.140022970
mov rdx, qword [0x1403884d0]
mov rcx, qword [0x140387d18]
test rdx, rdx
jne 0x140023d8e
mov rbx, r13
jmp 0x140023f0e
test rcx, rcx
je 0x140023dc2
cmp dword [0x140387c74], 0
je 0x140023dc2
add rdx, qword [0x140387c10]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rbx, qword [rbp + 0xc8]
test rbx, rbx
je 0x140023f0e
test rcx, rcx
je 0x140023e09
cmp dword [0x140387c74], 0
je 0x140023e09
mov rdx, qword [0x140387c20]
add rdx, rbx
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rax, qword [0x1403884d0]
cmp qword [rbp + 0xd0], rax
jne 0x140023f07
mov byte [0x140387bc8], 1
test rcx, rcx
je 0x140023e55
cmp dword [0x140387c74], 0
je 0x140023e55
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rax, qword [rbp + 0xd8]
mov qword [0x140387bc0], rax
mov qword [0x140387bd0], rbx
test rcx, rcx
je 0x140023e9b
cmp dword [0x140387c74], 0
je 0x140023e9b
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rax, qword [rbp + 0xe0]
mov qword [0x140387bb0], rax
test rcx, rcx
je 0x140023edb
cmp dword [0x140387c74], 0
je 0x140023edb
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], r13
mov r9d, ntohs
lea r8, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
movss xmm0, dword [rsp + 0x48]
movss dword [0x1403880f8], xmm0
movss xmm1, dword [rsp + 0x4c]
movss dword [0x1403880fc], xmm1
movss xmm0, dword [rsp + 0x50]
movss dword [0x140388100], xmm0
jmp 0x140023f0e
mov byte [0x140387bc8], 0
mov rax, qword [0x140388108]
mov rdx, qword [0x140388110]
cmp rax, rdx
je 0x140023f33
cmp qword [rax], rbx
je 0x1400240f8
add rax, 0x10
cmp rax, rdx
jne 0x140023f21
mov qword [rsp + 0x60], rbx
mov rdx, qword [0x1403884d0]
test rdx, rdx
je 0x140023fc1
test rcx, rcx
je 0x140023f78
cmp dword [0x140387c74], 0
je 0x140023f78
add rdx, qword [0x140387c10]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0xe8]
test rdx, rdx
je 0x140023fc1
test rcx, rcx
je 0x140023fb8
cmp dword [0x140387c74], 0
je 0x140023fb8
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0xf0]
jmp 0x140023fc4
mov rdx, r13
test rcx, rcx
je 0x140023ff5
cmp dword [0x140387c74], 0
je 0x140023ff5
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
movss xmm0, dword [rbp + 0x78]
movss dword [rsp + 0x6c], xmm0
mov rdx, qword [0x1403884d0]
test rdx, rdx
je 0x140024089
test rcx, rcx
je 0x140024040
cmp dword [0x140387c74], 0
je 0x140024040
add rdx, qword [0x140387c10]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x140024089
test rcx, rcx
je 0x140024080
cmp dword [0x140387c74], 0
je 0x140024080
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x100]
jmp 0x14002408c
mov rdx, r13
test rcx, rcx
je 0x1400240ba
cmp dword [0x140387c74], 0
je 0x1400240ba
add rdx, 0x4c
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
movss xmm0, dword [rbp + 0x44]
movss dword [rsp + 0x68], xmm0
mov rdx, qword [0x140388110]
cmp rdx, qword [0x140388118]
je 0x1400240e7
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rdx], xmm0
add qword [0x140388110], 0x10
jmp 0x1400240f8
lea r8, [rsp + 0x60]
call fcn.140024d90
mov rcx, qword [0x140387d18]
test rcx, rcx
je 0x14002412c
cmp dword [0x140387c74], 0
je 0x14002412c
lea rdx, [rbx + 0x960]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
cmp byte [0x1403864ec], 0
je 0x1400242bb
movss xmm6, dword [0x1403864f4]
mov rdx, qword [0x1403884d0]
test rdx, rdx
je 0x1400241ca
test rcx, rcx
je 0x140024181
cmp dword [0x140387c74], 0
je 0x140024181
add rdx, qword [0x140387c10]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x108]
test rdx, rdx
je 0x1400241ca
test rcx, rcx
je 0x1400241c1
cmp dword [0x140387c74], 0
je 0x1400241c1
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x110]
jmp 0x1400241cd
mov rdx, r13
movss dword [rbp + 0x48], xmm6
test rcx, rcx
je 0x140024203
cmp dword [0x140387c74], 0
je 0x140024203
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140387d18]
movss xmm6, dword [0x1403864f0]
mov rdx, qword [0x1403884d0]
test rdx, rdx
je 0x140024294
test rcx, rcx
je 0x14002424b
cmp dword [0x140387c74], 0
je 0x14002424b
add rdx, qword [0x140387c10]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x118]
test rdx, rdx
je 0x140024294
test rcx, rcx
je 0x14002428b
cmp dword [0x140387c74], 0
je 0x14002428b
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x120]
jmp 0x140024297
mov rdx, r13
movss dword [rbp + 0x50], xmm6
test rcx, rcx
je 0x140024495
cmp dword [0x140387c74], 0
je 0x140024495
lea r8, [rbp + 0x50]
jmp 0x140024479
mov rax, qword [0x140388108]
mov rdx, qword [0x140388110]
cmp rax, rdx
je 0x1400242de
nop
cmp qword [rax], rbx
je 0x1400242e1
add rax, 0x10
cmp rax, rdx
jne 0x1400242d0
mov rax, r13
movss xmm6, dword [rax + 0xc]
mov rdx, qword [0x1403884d0]
test rdx, rdx
je 0x14002436f
test rcx, rcx
je 0x140024326
cmp dword [0x140387c74], 0
je 0x140024326
add rdx, qword [0x140387c10]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x128]
test rdx, rdx
je 0x14002436f
test rcx, rcx
je 0x140024366
cmp dword [0x140387c74], 0
je 0x140024366
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x130]
jmp 0x140024372
mov rdx, r13
movss dword [rbp + 0x58], xmm6
test rcx, rcx
je 0x1400243a8
cmp dword [0x140387c74], 0
je 0x1400243a8
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140387d18]
mov rax, qword [0x140388108]
mov rdx, qword [0x140388110]
cmp rax, rdx
je 0x1400243ce
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x1400243d1
add rax, 0x10
cmp rax, rdx
jne 0x1400243c0
mov rax, r13
movss xmm6, dword [rax + 8]
mov rdx, qword [0x1403884d0]
test rdx, rdx
je 0x14002445f
test rcx, rcx
je 0x140024416
cmp dword [0x140387c74], 0
je 0x140024416
add rdx, qword [0x140387c10]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x1a0]
test rdx, rdx
je 0x14002445f
test rcx, rcx
je 0x140024456
cmp dword [0x140387c74], 0
je 0x140024456
add rdx, 0x960
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x140]
jmp 0x140024462
mov rdx, r13
movss dword [rbp + 0x60], xmm6
test rcx, rcx
je 0x140024495
cmp dword [0x140387c74], 0
je 0x140024495
lea r8, [rbp + 0x60]
mov qword [rsp + 0x20], r13
mov r9d, 4
add rdx, 0x4c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140387d18]
cmp byte [0x1403864ae], 0
je 0x140024563
test rcx, rcx
je 0x1400244da
cmp dword [0x140387c74], 0
je 0x1400244da
mov rdx, qword [0x1403884d0]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
movss xmm0, dword [rbp + 0x68]
comiss xmm0, xmm9
jbe 0x14002451e
mov rdx, qword [0x1403884d0]
test rdx, rdx
je 0x140024556
mov byte [rbp + 8], 1
test rcx, rcx
je 0x140024556
cmp dword [0x140387c74], 0
je 0x140024556
add rdx, 0x2c
mov qword [rsp + 0x20], r13
mov r9d, 1
lea r8, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14002454f
test rcx, rcx
je 0x140024556
cmp dword [0x140387c74], 0
je 0x140024556
mov rdx, qword [0x1403884d0]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x7c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
cmp byte [0x1403864ae], 0
jne 0x14002461a
test rcx, rcx
je 0x14002459b
cmp dword [0x140387c74], 0
je 0x14002459b
mov rdx, qword [0x1403884d0]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x6c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
movss xmm0, dword [rbp + 0x6c]
comiss xmm0, xmm9
jbe 0x1400245df
mov rdx, qword [0x1403884d0]
test rdx, rdx
je 0x14002461a
mov byte [rbp + 0x10], gethostname
test rcx, rcx
je 0x14002461a
cmp dword [0x140387c74], 0
je 0x14002461a
add rdx, 0x2c
mov qword [rsp + 0x20], r13
mov r9d, 1
lea r8, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140024613
test rcx, rcx
je 0x14002461a
cmp dword [0x140387c74], 0
je 0x14002461a
mov rdx, qword [0x1403884d0]
add rdx, 0x280
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
cmp byte [0x1403864be], 0
je 0x140024644
movss xmm0, dword [0x1403864c0]
movss dword [rbp + 0x70], xmm0
test rcx, rcx
je 0x14002467c
cmp dword [0x140387c74], 0
je 0x14002467c
lea r8, [rbp + 0x70]
jmp 0x14002465d
mov dword [rbp + 0x18], 0x3f800000
test rcx, rcx
je 0x14002467c
cmp dword [0x140387c74], 0
je 0x14002467c
lea r8, [rbp + 0x18]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea rdx, [r15 + 0xd40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140387d18]
cmp byte [0x140387bc8], 0
jne 0x1400247b0
mov rdx, qword [0x1403884d0]
test rdx, rdx
jne 0x14002469a
mov rax, r13
jmp 0x1400246d2
test rcx, rcx
je 0x1400246cb
cmp dword [0x140387c74], 0
je 0x1400246cb
add rdx, 0x20
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rax, qword [rbp + 0x148]
mov qword [0x140387bc0], rax
mov rdx, qword [0x1403884d0]
mov qword [0x140387bd0], rdx
test rdx, rdx
jne 0x1400246f1
mov rax, r13
jmp 0x140024729
test rcx, rcx
je 0x140024722
cmp dword [0x140387c74], 0
je 0x140024722
add rdx, 0x30
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rax, qword [rbp + 0x150]
mov qword [0x140387bb0], rax
cmp qword [0x1403884d0], 0
jne 0x14002474d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
jmp 0x140024786
test rcx, rcx
je 0x140024786
cmp dword [0x140387c74], 0
je 0x140024786
mov rdx, qword [0x1403884d0]
add rdx, 0x90
mov qword [rsp + 0x20], r13
mov r9d, ntohs
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
movss xmm0, dword [rsp + 0x30]
movss dword [0x1403880f8], xmm0
movss xmm1, dword [rsp + 0x34]
movss dword [0x1403880fc], xmm1
movss xmm0, dword [rsp + 0x38]
movss dword [0x140388100], xmm0
mov rdx, qword [0x140388408]
test rdx, rdx
je 0x140024826
test rcx, rcx
je 0x1400247f0
cmp dword [0x140387c74], 0
je 0x1400247f0
add rdx, 0x3c0
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140387d18]
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x140024826
test rcx, rcx
je 0x140024837
cmp dword [0x140387c74], 0
je 0x140024837
add rdx, 0x40
mov qword [rsp + 0x20], r13
mov r9d, ntohs
lea r8, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140024837
mov qword [rsp + 0x3c], 0
mov dword [rsp + 0x44], 0
movsd xmm0, qword [rsp + 0x3c]
movsd qword [rbp - 0x80], xmm0
mov eax, dword [rsp + 0x44]
mov dword [rbp - 0x78], eax
lea rcx, [rbp - 0x80]
call fcn.140022ac0
mov r10, qword [0x140387d18]
movabs rbx, 0x8000000000000000
cmp byte [0x1403864f8], 0
je 0x140022fd0
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14012df70
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3