Function at 0x140005b30
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push r12
push r13
push r14
lea rbp, [r11 - 0xb88]
sub rsp, 0xc60
mov rax, qword [0x140122080]
xor rax, rsp
mov qword [rbp + 0xae0], rax
mov qword [r11 + 0x18], r15
lea rdx, [rbp]
movaps xmmword [r11 - 0x88], xmm11
mov rsi, rcx
call fcn.1400170e0
movss xmm11, dword [0x14010d8f4]
divss xmm11, dword [rbp + 0x30]
mov rdx, qword [rsi + 0x210]
mov rcx, qword [0x140283a68]
add rdx, 0x1228
mulss xmm11, dword [0x140283210]
call fcn.140007110
movzx ecx, al
cmp cl, 2
je 0x140005c18
cmp cl, 0xb
je 0x140005c18
cmp cl, 0xc
jne 0x140005bca
movsd xmm0, qword [0x1402832ec]
mov eax, dword [0x1402832f4]
jmp 0x140005c26
cmp cl, 0x18
ja 0x140005be9
mov edx, 0x1300410
bt edx, ecx
jae 0x140005be9
movsd xmm0, qword [0x1402832d4]
mov eax, dword [0x1402832dc]
jmp 0x140005c26
cmp cl, 0x17
ja 0x140005c08
mov eax, 0x800042
bt eax, ecx
jae 0x140005c08
movsd xmm0, qword [0x1402832e0]
mov eax, dword [0x1402832e8]
jmp 0x140005c26
movsd xmm0, qword [0x1402832f8]
mov eax, dword [0x140283300]
jmp 0x140005c26
movsd xmm0, qword [0x1402832c8]
mov eax, dword [0x1402832d0]
mov ecx, dword [0x1402832c0]
mov qword [rsp + 0xc98], rdi
movaps xmmword [rsp + 0xc50], xmm6
movaps xmmword [rsp + 0xc40], xmm7
movsd qword [rsp + 0x40], xmm0
mov r15, qword [rsp + 0x40]
movaps xmmword [rsp + 0xc30], xmm8
movaps xmmword [rsp + 0xc20], xmm9
movaps xmmword [rsp + 0xc10], xmm10
mov dword [rsp + 0x48], eax
shr r15, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1402832c4]
movzx ebx, ax
shr ebx, 0xf
and bl, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r12d, r12d
mov r13d, 1
movzx r14d, ax
mov rax, qword [rsi + 0x3a0]
shr r14d, 0xf
and r14b, 1
test rax, rax
je 0x140006309
test bl, bl
je 0x140006309
cmp byte [0x1402832bc], r12b
je 0x140006309
cmp byte [rsi + 0x394], r12b
jne 0x140006309
mov rbx, qword [0x140283a68]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [rbp + 0x280], rax
lea rax, [rbp + 0x300]
movaps xmmword [rsp + 0xbf0], xmm12
xorps xmm10, xmm10
mov qword [rbp + 0x290], rax
movsd qword [rbp + 0x4f0], xmm10
movsd qword [rbp + 0x510], xmm10
movaps xmmword [rbp + 0x4e0], xmm0
movaps xmmword [rbp + 0x500], xmm0
movaps xmmword [rbp + 0xaa0], xmm1
movaps xmmword [rbp + 0xab0], xmm0
movaps xmmword [rbp + 0xac0], xmm1
mov qword [rbp + 0x288], 0x7d8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140005d60
cmp dword [rbx + 0x20], eax
je 0x140005d63
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140005d52
mov rbx, r12
lea rax, [rbp + 0x280]
mov qword [rbx + 8], Ordinal_26
mov edi, 3
mov qword [rbx + 0x10], rax
mov eax, edi
mov dword [rbx], edi
nop
cmp eax, 6
je 0x140005d94
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbx]
cmp eax, 5
jne 0x140005d80
movaps xmm0, xmmword [rbp + 0x4c0]
movaps xmm1, xmmword [rbp + 0x4d0]
mov rax, qword [rsi + 0x3a8]
mov rbx, qword [0x140283a68]
add rax, 0x28e0
movaps xmmword [rbp - 0x80], xmm0
movaps xmm0, xmmword [rbp + 0x4e0]
movaps xmmword [rbp - 0x70], xmm1
movaps xmm1, xmmword [rbp + 0x4f0]
movaps xmmword [rbp - 0x60], xmm0
movaps xmm0, xmmword [rbp + 0x500]
movaps xmmword [rbp - 0x50], xmm1
movaps xmm1, xmmword [rbp + 0x510]
movaps xmmword [rbp - 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm1
xorps xmm1, xmm1
mov qword [rbp + 0x280], rax
lea rax, [rbp + 0x2a0]
movaps xmmword [rbp + 0x2c0], xmm0
movaps xmmword [rbp + 0x2e0], xmm1
movsd qword [rbp + 0x2d0], xmm10
movsd qword [rbp + 0x2f0], xmm10
mov qword [rbp + 0x288], 0x60
mov qword [rbp + 0x290], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140005e4e
nop
cmp dword [rbx + 0x20], eax
je 0x140005e51
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140005e40
mov rbx, r12
lea rax, [rbp + 0x280]
mov qword [rbx + 8], Ordinal_26
mov qword [rbx + 0x10], rax
mov dword [rbx], edi
cmp edi, 6
je 0x140005ec4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [rbx]
cmp edi, 5
jne 0x140005e66
movaps xmm0, xmmword [rbp + 0x2a0]
movaps xmm1, xmmword [rbp + 0x2b0]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm0, xmmword [rbp + 0x2c0]
movaps xmmword [rbp + 0x50], xmm1
movaps xmm1, xmmword [rbp + 0x2d0]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [rbp + 0x2e0]
movaps xmmword [rbp + 0x70], xmm1
movaps xmm1, xmmword [rbp + 0x2f0]
movaps xmmword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x90], xmm1
jmp 0x140005ef4
xorps xmm0, xmm0
movsd qword [rbp + 0x70], xmm10
xor eax, eax
movaps xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x78], eax
movups xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x98], eax
movaps xmmword [rbp + 0x80], xmm0
movsd qword [rbp + 0x90], xmm10
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x80]
call fcn.14000a550
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x40]
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
movups xmm8, xmmword [rax + 0x20]
movups xmm9, xmmword [rax + 0x30]
call fcn.14000a550
lea r8, [rbp - 0x80]
movaps xmmword [rbp - 0x80], xmm6
lea rdx, [rbp + 0xc0]
movaps xmmword [rbp - 0x70], xmm7
lea rcx, [rbp + 0x40]
movaps xmmword [rbp - 0x60], xmm8
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xc0], xmm0
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp + 0xd0], xmm1
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp + 0xe0], xmm0
movaps xmmword [rbp + 0xf0], xmm1
movaps xmmword [rbp - 0x50], xmm9
call fcn.1400169a0
xorps xmm8, xmm8
lea rdx, [rsi + 0x230]
xorps xmm9, xmm9
lea rcx, [rbp + 0xc0]
xorps xmm12, xmm12
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x80], xmm0
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp - 0x70], xmm1
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp - 0x60], xmm0
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
cvtss2sd xmm8, xmm1
shufps xmm1, xmm1, 0xaa
cvtss2sd xmm12, xmm1
cvtss2sd xmm9, xmm0
call fcn.1400069a0
mov rdx, rax
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x280]
call fcn.140005020
test al, al
je 0x1400060b1
mov r8, qword [rsi + 0x360]
lea rdx, [rsp + 0x60]
mov rcx, qword [0x140283a68]
add r8, 0x168
call fcn.140006f80
movups xmm0, xmmword [rsp + 0x60]
lea rax, [rbp + 0xa0]
movsd xmm1, qword [rsp + 0x70]
lea r9, [rbp - 0x20]
movups xmm7, xmmword [rbp]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
movups xmm6, xmmword [rbp + 0x10]
lea rdx, [rbp + 0xc0]
movaps xmmword [rbp - 0x20], xmm0
movss xmm0, dword [rsp + 0x50]
movsd qword [rbp - 0x10], xmm1
movss xmm1, dword [rbp + 0x280]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm1
movsd qword [rsp + 0x60], xmm8
movsd qword [rsp + 0x68], xmm9
movsd qword [rsp + 0x70], xmm12
movaps xmmword [rbp + 0xa0], xmm7
movsd qword [rbp + 0xb0], xmm6
call fcn.140004ca0
movups xmm0, xmmword [rbp + 0x20]
lea r8, [rbp - 0x20]
movsd xmm1, qword [rbp + 0x30]
movaps xmmword [rbp - 0x60], xmm0
movups xmm0, xmmword [rax]
movsd qword [rbp - 0x50], xmm1
movsd xmm1, qword [rax + 0x10]
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x80], xmm7
movaps xmmword [rbp - 0x70], xmm6
movsd qword [rbp - 0x10], xmm1
jmp 0x1400060ed
movups xmm0, xmmword [rbp]
lea r8, [rsp + 0x60]
movups xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x80], xmm0
movups xmm0, xmmword [rbp + 0x20]
movaps xmmword [rbp - 0x70], xmm1
movsd xmm1, qword [rbp + 0x30]
movaps xmmword [rbp - 0x60], xmm0
movsd qword [rsp + 0x60], xmm8
movsd qword [rsp + 0x68], xmm9
movsd qword [rsp + 0x70], xmm12
movsd qword [rbp - 0x50], xmm1
lea r9, [rbp - 0x80]
mov rcx, rsi
lea rdx, [rbp + 0x280]
call fcn.140016db0
movaps xmm12, xmmword [rsp + 0xbf0]
movsd xmm9, qword [rax]
ucomisd xmm9, xmm10
movsd xmm8, qword [rax + 8]
mov byte [rsi + 0x351], r13b
jp 0x140006131
jne 0x140006131
ucomisd xmm8, xmm10
jp 0x140006131
je 0x140006309
movss xmm0, dword [rsi + 8]
movsd xmm1, qword [0x14010d7b0]
cvtps2pd xmm0, xmm0
subsd xmm0, xmm9
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd xmm1, qword [0x14010d7b0]
movaps xmm7, xmm0
movss xmm0, dword [rsi + 0xc]
cvtps2pd xmm0, xmm0
subsd xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm7
ja 0x14000617e
xorps xmm6, xmm6
sqrtsd xmm6, xmm7
jmp 0x140006189
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movaps xmm6, xmm0
xorps xmm1, xmm1
cvtss2sd xmm1, xmm11
comisd xmm1, xmm6
jb 0x14000633b
movss xmm1, dword [rbp + 0x5f0]
addss xmm1, dword [0x14010d6a4]
comiss xmm1, dword [rbp + 0x5e8]
jb 0x14000633b
lea rdx, [rsi + 0x230]
lea rcx, [rbp + 0xc0]
call fcn.1400069a0
mov rdx, rax
call fcn.140005850
test al, al
jne 0x14000633b
mulsd xmm6, qword [0x14010da38]
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_exp
movss xmm2, dword [rsp + 0x40]
xorps xmm6, xmm6
cvtps2pd xmm1, xmm2
subss xmm2, dword [0x14010d734]
mulsd xmm0, xmm1
cvtsd2ss xmm6, xmm0
comiss xmm6, xmm2
ja 0x14000620f
movaps xmm6, xmm2
cvtpd2ps xmm7, xmm8
cvtpd2ps xmm8, xmm9
movss xmm9, dword [0x14010e170]
xorps xmm4, xmm4
ucomiss xmm8, xmm4
xorps xmm3, xmm3
xorps xmm2, xmm2
jp 0x140006233
je 0x140006285
movss xmm5, dword [rsi + 8]
comiss xmm8, xmm5
jbe 0x140006264
movaps xmm3, xmm5
movaps xmm0, xmm5
subss xmm3, xmm8
addss xmm0, xmm5
xorps xmm3, xmm9
divss xmm3, xmm6
movaps xmm1, xmm3
addss xmm1, xmm5
comiss xmm1, xmm0
jbe 0x140006264
xorps xmm3, xmm3
comiss xmm5, xmm8
jbe 0x140006285
movaps xmm3, xmm8
subss xmm3, xmm5
divss xmm3, xmm6
movaps xmm0, xmm3
addss xmm0, xmm5
comiss xmm4, xmm0
jbe 0x140006285
xorps xmm3, xmm3
ucomiss xmm7, xmm4
jp 0x14000628c
je 0x1400062da
movss xmm5, dword [rsi + 0xc]
comiss xmm7, xmm5
jbe 0x1400062bb
movaps xmm2, xmm5
movaps xmm0, xmm5
subss xmm2, xmm7
addss xmm0, xmm5
xorps xmm2, xmm9
divss xmm2, xmm6
movaps xmm1, xmm2
addss xmm1, xmm5
comiss xmm1, xmm0
jbe 0x1400062bb
xorps xmm2, xmm2
comiss xmm5, xmm7
jbe 0x1400062da
movaps xmm2, xmm7
subss xmm2, xmm5
divss xmm2, xmm6
movaps xmm0, xmm2
addss xmm0, xmm5
comiss xmm4, xmm0
jbe 0x1400062da
xorps xmm2, xmm2
mov rcx, qword [0x140283a80]
mov r9d, r13d
cvttss2si eax, xmm3
mov dword [rcx + 0xc], r12d
lea r8, [rcx + 0xc]
mov dword [r8 + 8], eax
cvttss2si eax, xmm2
mov dword [r8 + 0xc], eax
mov edx, dword [rcx + 8]
mov rcx, qword [rcx]
call sym.Trump_Slotted.exe_interception_send
jmp 0x14000633b
lea rcx, [rbp + 0x100]
mov byte [rsi + 0x351], r12b
call fcn.14000a770
lea rdx, [rbp + 0x100]
lea rcx, [rsi + 0x358]
call fcn.1400064b0
lea rcx, [rbp + 0x100]
call fcn.1400028c0
movaps xmm11, xmmword [rsp + 0xc00]
test r15b, r15b
mov r15, qword [rsp + 0xca0]
movaps xmm10, xmmword [rsp + 0xc10]
movaps xmm9, xmmword [rsp + 0xc20]
movaps xmm8, xmmword [rsp + 0xc30]
movaps xmm7, xmmword [rsp + 0xc40]
movaps xmm6, xmmword [rsp + 0xc50]
je 0x14000647c
test r14b, r14b
je 0x14000647c
mov rdx, qword [rsi + 0x208]
mov rcx, qword [0x140283a68]
add rdx, 0x1720
call fcn.140007060
test rax, rax
je 0x14000647c
movsxd rbx, dword [0x1402832b8]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1400063d1
imul rax, rax, 0x64
jmp 0x1400063ef
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
mov qword [rbp + 0x280], rax
test rbx, rbx
jle 0x14000642b
imul rdx, rbx, 0xf4240
movabs r8, 0x7fffffffffffffff
mov rcx, r8
sub rcx, rdx
cmp rax, rcx
jge 0x140006424
lea rcx, [rax + rdx]
mov qword [rbp + 0x280], rcx
jmp 0x14000642b
mov qword [rbp + 0x280], r8
lea rcx, [rbp + 0x280]
call fcn.140007c00
mov rcx, qword [0x140283a80]
mov r9d, r13d
mov dword [rcx + 0xc], r13d
mov qword [rcx + 0x14], r12
mov edx, dword [rcx + 8]
lea r8, [rcx + 0xc]
mov rcx, qword [rcx]
call sym.Trump_Slotted.exe_interception_send
mov rcx, qword [0x140283a80]
mov r9d, r13d
mov dword [rcx + 0xc], 2
mov qword [rcx + 0x14], r12
mov edx, dword [rcx + 8]
lea r8, [rcx + 0xc]
mov rcx, qword [rcx]
call sym.Trump_Slotted.exe_interception_send
mov rdi, qword [rsp + 0xc98]
mov rcx, qword [rbp + 0xae0]
xor rcx, rsp
call fcn.1400e9540
mov rbx, qword [rsp + 0xca8]
add rsp, 0xc60
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret