Function at 0x1400163e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x140102040]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xor ebx, ebx
movaps xmmword [r11 - 0x38], xmm8
cmp byte [0x140106376], bl
xorps xmm8, xmm8
je 0x140016584
mov rcx, qword [0x1401064b0]
xorps xmm0, xmm0
movaps xmmword [r11 - 0x28], xmm7
movss xmm7, dword [0x140106588]
test rcx, rcx
js 0x14001643b
cvtsi2ss xmm0, rcx
jmp 0x140016450
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
movss xmm1, dword [0x1400f2568]
addss xmm0, xmm7
xor eax, eax
addss xmm0, dword [0x1400f24a0]
comiss xmm0, xmm1
jb 0x140016481
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140016481
movabs rcx, 0x8000000000000000
mov rax, rcx
mov rcx, qword [0x1401061f0]
lea r8, [rbp - 0x45]
cvttss2si rdx, xmm0
mov r9d, 4
mov dword [rbp - 0x45], ebx
add rdx, rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [0x140106574], 1
jbe 0x140016567
movss xmm3, dword [0x140106560]
lea rdx, [rbp - 0x19]
cvtps2pd xmm3, xmm3
mov r8d, 0x28
mov qword [rbp - 0x19], rbx
mov dword [rbp - 9], ebx
mov qword [rbp - 1], rbx
mov dword [rbp - 5], 1
lea ecx, [r8 - 0x27]
mov qword [rbp + 7], rbx
movaps xmmword [rsp + 0xc0], xmm6
movss xmm6, dword [rbp - 0x45]
movaps xmm0, xmm6
subss xmm0, dword [0x1401061f8]
cvtps2pd xmm1, xmm0
movaps xmm0, xmm7
mulsd xmm1, qword [0x1400f25a8]
subss xmm0, dword [0x1401061fc]
addsd xmm1, xmm1
divsd xmm1, xmm3
divsd xmm1, qword [0x1400f2598]
cvttsd2si eax, xmm1
cvtps2pd xmm1, xmm0
mov dword [rbp - 0x11], eax
mulsd xmm1, qword [0x1400f25a8]
addsd xmm1, xmm1
divsd xmm1, xmm3
divsd xmm1, qword [0x1400f2458]
cvttsd2si eax, xmm1
mov dword [rbp - 0xd], eax
call qword [sym.imp.USER32.dll_SendInput]
movss dword [0x1401061f8], xmm6
movaps xmm6, xmmword [rsp + 0xc0]
jmp 0x140016574
movss xmm0, dword [rbp - 0x45]
movss dword [0x1401061f8], xmm0
movss dword [0x1401061fc], xmm7
movaps xmm7, xmmword [rsp + 0xb0]
cmp byte [0x140106373], bl
je 0x1400165cb
movss xmm0, dword [0x140106450]
comiss xmm0, xmm8
jbe 0x1400165cb
movsxd rdx, dword [0x14010242c]
lea rax, [rbp + 0x17]
add rdx, qword [0x1401064b0]
lea r8, [rbp - 0x31]
mov rcx, qword [0x1401061f0]
mov r9d, 4
mov dword [rbp - 0x31], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x140106377], bl
movaps xmm8, xmmword [rsp + 0xa0]
je 0x140016665
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140016665
movsxd rdx, dword [0x140102444]
lea rax, [rbp - 0x39]
add rdx, qword [0x1401065b8]
lea r8, [rbp - 0x49]
mov rcx, qword [0x1401061f0]
mov r9d, 4
mov dword [rbp - 0x49], 0x10001
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
movsxd rdx, dword [0x140102444]
lea rax, [rbp - 0x29]
add rdx, qword [0x1401065b8]
lea r8, [rbp - 0x39]
mov rcx, qword [0x1401061f0]
mov r9d, 4
mov dword [rbp - 0x39], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x140102497], bl
je 0x140016672
call fcn.140013e70
cmp byte [0x14010249b], bl
je 0x14001667f
call fcn.140014bd0
cmp byte [0x140106375], bl
je 0x14001668c
call fcn.140015590
cmp byte [0x140106374], bl
je 0x14001670c
mov eax, dword [0x140102490]
lea r8, [rbp - 0x41]
mov rdx, qword [0x1401063b8]
mov r9d, 4
mov rcx, qword [0x1401061f0]
add rdx, 0x210
mov dword [rbp - 0x49], eax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x41], ebx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x140106570], bl
jne 0x14001670c
mov eax, dword [rbp - 0x49]
cmp dword [rbp - 0x41], eax
je 0x14001670c
mov rdx, qword [0x1401063b8]
lea rax, [rbp - 0x29]
mov rcx, qword [0x1401061f0]
lea r8, [rbp - 0x49]
add rdx, 0x210
mov qword [rsp + 0x20], rax
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x140106378], bl
je 0x140016732
cmp byte [0x140102494], bl
je 0x14001672d
mov ecx, dword [0x1401022a0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140016732
call fcn.140012ff0
cmp byte [0x140106372], bl
je 0x14001679f
call fcn.1400045c0
movsxd rdx, dword [0x140102428]
lea rax, [rbp - 0x21]
add rdx, qword [0x1401065b8]
lea r8, [rbp - 0x31]
mov rcx, qword [0x1401061f0]
mov r9d, 8
mov qword [rbp - 0x31], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsxd rdx, dword [0x1401023f0]
lea rax, [rbp - 0x29]
add rdx, qword [rbp - 0x31]
lea r8, [0x140106228]
mov rcx, qword [0x1401061f0]
mov r9d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14008a030
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rbp
ret