Function at 0x1400435a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x1400e9060]
xor rax, rsp
mov qword [rbp - 0x20], rax
movss xmm15, dword [0x1400d631c]
xor r12d, r12d
movss xmm13, dword [0x1400d62a0]
movabs rdi, 0xc8198be35cc967ac
movss xmm12, dword [0x1400d62d8]
movabs rsi, 0x8cda961642029653
movss xmm14, dword [0x1400d64f8]
movabs r14, 0x8cda96163671e301
movss xmm11, dword [0x1400d6420]
movabs r13, 0xe8b4c16f366bf806
xorps xmm6, xmm6
nop
mov r15, r12
call fcn.140043550
movsxd rcx, dword [0x140138aa0]
lea rdx, [rcx + rcx*4]
mov rcx, qword [0x140138bc8]
mov edx, dword [rcx + rdx*8 + 4]
cmp edx, eax
je 0x140043b7e
nop word [rax + rax]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140043b7e
cmp byte [0x140138a93], r12b
je 0x140043b7e
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cqo
xorps xmm0, xmm0
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rdx, rcx, 0x3b9aca00
add rdx, rax
movabs rax, 0x431bde82d7b634db
imul rdx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cvtsi2sd xmm0, rdx
movsd qword [0x140137828], xmm0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
xorps xmm1, xmm1
xorps xmm0, xmm0
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rdx, rcx, 0x3b9aca00
add rdx, rax
movabs rax, 0x431bde82d7b634db
imul rdx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, dword [0x140138aa0]
lea rcx, [rax + rax*4]
mov rax, qword [0x140138bc8]
cvtsi2sd xmm1, rdx
mov edx, dword [rax + rcx*8]
subsd xmm1, qword [0x140137828]
lea eax, [rdx + rdx]
cvtsi2sd xmm0, rax
comisd xmm1, xmm0
ja 0x140043b50
cmp byte [0x1401389da], r12b
jne 0x14004386a
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rbp - 0x38], rax
pxor xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0xc8198b902fa80bef
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rbp - 0x28], rax
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x140043b50
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140043887
cmp byte [0x1401389db], r12b
je 0x140043b50
xorps xmm0, xmm0
mov dword [rsp + 0x50], Ordinal_26
xor eax, eax
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x54], xmm0
mov dword [rsp + 0x64], eax
call qword [sym.imp.USER32.dll_GetCursorInfo]
cmp dword [rsp + 0x54], r12d
je 0x1400438bc
cmp byte [0x140138a91], r12b
jne 0x140043b50
call fcn.140042a30
mov ecx, 2
movaps xmm7, xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400438e1
cmp byte [0x1401389db], r12b
je 0x1400438e1
movaps xmm7, xmm15
movsxd rax, dword [0x140138aa0]
movaps xmm9, xmm7
movss xmm0, dword [0x140136418]
mulss xmm0, xmm13
lea rcx, [rax + rax*2]
mov rax, qword [0x140138be8]
mov rdx, qword [rax + rcx*8]
mov ecx, 2
mulss xmm9, dword [rdx + r15*8]
mulss xmm7, dword [rdx + r15*8 + 4]
mulss xmm9, xmm0
movss xmm0, dword [0x140136414]
mulss xmm0, xmm13
mulss xmm7, xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140043977
cmp byte [0x1401389db], r12b
je 0x140043977
movss xmm1, dword [0x140136408]
movsxd rax, dword [0x140138aa0]
lea rcx, [rax + rax*4]
mov rax, qword [0x140138bc8]
mulss xmm1, dword [rax + rcx*8 + 8]
movaps xmm0, xmm1
mulss xmm1, xmm7
mulss xmm0, xmm9
movaps xmm7, xmm1
movaps xmm9, xmm0
mov ecx, dword [reloc.WS2_32.dll_recvfrom]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140043992
mulss xmm9, xmm12
mulss xmm7, xmm12
movsxd rax, dword [0x140138aa0]
xorps xmm0, xmm0
movss xmm10, dword [0x140138a98]
comiss xmm10, xmm6
lea rcx, [rax + rax*4]
mov rax, qword [0x140138bc8]
mov ecx, dword [rax + rcx*8]
cvtsi2ss xmm0, rcx
addss xmm0, dword [0x140138a94]
cvttss2si r13d, xmm0
jbe 0x140043a26
movaps xmm6, xmm10
xorps xmm6, xmmword [0x1400d6940]
subss xmm10, xmm6
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xorps xmm8, xmm8
cvtsi2ss xmm8, eax
divss xmm8, xmm14
mulss xmm8, xmm10
addss xmm8, xmm6
addss xmm8, xmm9
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xorps xmm9, xmm9
cvtsi2ss xmm9, eax
divss xmm9, xmm14
mulss xmm9, xmm10
addss xmm9, xmm6
xorps xmm6, xmm6
addss xmm9, xmm7
jmp 0x140043a2e
movaps xmm8, xmm9
movaps xmm9, xmm7
mov ecx, r12d
mov edx, r12d
mov r14d, r12d
mov esi, 1
nop dword [rax]
movd xmm1, esi
mov r8d, Ordinal_45
cvtdq2ps xmm1, xmm1
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x7c], 1
movaps xmm0, xmm1
mulss xmm1, xmm9
mulss xmm0, xmm8
divss xmm1, xmm11
divss xmm0, xmm11
cvttss2si ebx, xmm1
cvttss2si edi, xmm0
mov eax, edi
sub eax, ecx
lea ecx, [r8 - 0x27]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvttss2si rax, xmm0
mov dword [rsp + 0x70], eax
mov eax, ebx
sub eax, edx
lea rdx, [rsp + 0x68]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvttss2si rax, xmm0
mov dword [rsp + 0x74], eax
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
sub ecx, r14d
call fcn.140042980
mov r14d, esi
mov ecx, edi
inc esi
mov edx, ebx
cmp esi, 0x64
jle 0x140043a40
lea ecx, [r13 - 0x64]
call fcn.140042980
movsxd rax, dword [0x140138aa0]
lea rcx, [rax + rax*4]
mov rax, qword [0x140138bc8]
cmp byte [rax + rcx*8 + 0xc], r12b
jne 0x140043b28
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140043b28
mov r8d, Ordinal_45
mov dword [rbp - 0x70], r12d
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x60], r12d
mov qword [rbp - 0x5c], 4
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
movabs rdi, 0xc8198be35cc967ac
movabs rsi, 0x8cda961642029653
movabs r14, 0x8cda96163671e301
movabs r13, 0xe8b4c16f366bf806
inc r15
call fcn.140043550
movsxd rcx, dword [0x140138aa0]
lea rdx, [rcx + rcx*4]
mov rcx, qword [0x140138bc8]
mov r8d, dword [rcx + rdx*8 + 4]
sub r8d, eax
movsxd rax, r8d
cmp r15, rax
jb 0x1400436a0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140043670