Function at 0x1400033b0
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140157900]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor ebx, ebx
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x140003946
mov rcx, qword [0x140158a08]
mov eax, dword [rcx + 0x40f0]
or eax, 2
mov dword [rcx + 0x40f0], eax
movsd xmm0, qword [0x140157990]
movsd qword [rcx + 0x4114], xmm0
mov dword [rcx + 0x40f8], 2
or eax, 0x40
mov dword [rcx + 0x40f0], eax
mov dword [rcx + 0x4150], 0x3f800000
mov r8d, 0x20002b
lea rdx, reloc.WS2_32.dll_accept
lea rcx, [0x1400d757c]
call fcn.140011190
movdqa xmm0, xmmword [0x140144a70]
movups xmmword [rbp - 9], xmm0
lea rcx, [rbp - 9]
call fcn.1400061f0
mov ecx, eax
movss xmm1, dword [0x1401445e0]
call fcn.140002ef0
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [0x1401589e8], rax
mov rax, qword [0x140158a08]
mov rcx, qword [rax + 0x3fe0]
mov byte [rcx + 0xcd], 1
movdqa xmm2, xmmword [0x140144a40]
movss xmm0, dword [0x140144604]
movss xmm6, dword [0x140144608]
cmp byte [0x140158a1b], bl
je 0x1400034af
movaps xmm1, xmm6
jmp 0x1400034b2
movaps xmm1, xmm0
movdqa xmmword [rbp - 9], xmm2
movss xmm3, dword [0x140144520]
lea r8, [rbp - 9]
call fcn.140001670
movdqa xmm1, xmmword [0x140144a80]
movdqa xmmword [rbp - 9], xmm1
mov r9, qword [0x1401589f0]
lea r8, [rbp - 9]
movaps xmm1, xmm6
lea rcx, str.onyx
call fcn.140001980
movaps xmm0, xmm6
call fcn.140001b30
movdqa xmm7, xmmword [0x140144a00]
mov eax, dword [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x140003663
movdqa xmmword [rbp - 9], xmm7
mov r9, qword [0x1401589f8]
lea r8, [rbp - 9]
movss xmm1, dword [0x140144634]
lea rcx, str.please_log_in
call fcn.140001980
movss xmm6, dword [0x140144674]
movss dword [rsp + 0x28], xmm6
movss xmm0, dword [0x140144654]
movss dword [rsp + 0x20], xmm0
lea r8, [0x140159a70]
lea rdx, str.Username
lea rcx, str.username
call fcn.140002050
movss dword [rsp + 0x28], xmm6
movss xmm0, dword [0x140144668]
movss dword [rsp + 0x20], xmm0
lea r8, [0x140159b70]
lea rdx, str.Password
lea rcx, [0x1400d7638]
call fcn.140002050
movss xmm2, dword [0x140144670]
call fcn.1400022a0
mov dword [rbp + 0x17], 0x43480000
mov dword [rbp + 0x1b], 0x41c80000
movss xmm3, dword [0x140157990]
subss xmm3, xmm6
mov rcx, qword [0x140158a08]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
mulss xmm3, dword [0x140144548]
xorps xmm0, xmm0
addss xmm3, xmm0
movss xmm1, dword [rax + 0x48]
subss xmm1, dword [rax + 0x98]
addss xmm3, xmm1
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm3
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm3
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
lea rdx, [rbp + 0x17]
lea rcx, str.login
call fcn.140040030
test al, al
je 0x14000391d
call fcn.140052ae0
jmp 0x14000391d
cmp eax, 1
jne 0x1400036ca
lea rcx, str.loading..
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [str.loading..]
movdqa xmmword [rbp - 9], xmm7
mov r9, qword [0x1401589f8]
lea r8, [rbp - 9]
movss xmm1, dword [0x140144634]
call fcn.140001980
movdqa xmm0, xmmword [0x140144a70]
movups xmmword [rbp - 9], xmm0
lea rcx, [rbp - 9]
call fcn.1400061f0
mov dword [rbp + 0x17], eax
lea r9, [rbp + 0x17]
movss xmm1, dword [0x14014461c]
call fcn.140002b70
jmp 0x14000391d
cmp eax, 2
jne 0x14000398e
movdqa xmmword [rbp - 9], xmm7
mov r9, qword [0x1401589f8]
lea r8, [rbp - 9]
movss xmm1, dword [0x140144634]
lea rcx, str.select_the_game_enhancer
call fcn.140001980
mov rcx, qword [0x140158a00]
call fcn.140014640
movss xmm6, dword [0x140144650]
mov dword [rbp + 0x17], 0x42c80000
mov dword [rbp + 0x1b], 0x42c80000
movss xmm3, dword [0x140157990]
subss xmm3, xmm6
mov rcx, qword [0x140158a08]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
mulss xmm3, dword [0x140144548]
subss xmm3, dword [0x140144640]
movss xmm0, dword [rax + 0x48]
subss xmm0, dword [rax + 0x98]
addss xmm3, xmm0
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm3
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm3
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
lea rdx, [rbp + 0x17]
lea rcx, str.SKRIPT
call fcn.140040030
test al, al
je 0x1400037ed
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], rbx
mov r8d, 3
lea rdx, [0x1400d7684]
lea rcx, [rbp - 9]
call fcn.140003d20
lea rcx, [rbp - 9]
call fcn.140052dc0
mov dword [rbp + 0x17], 0x42c80000
mov dword [rbp + 0x1b], 0x42c80000
movss xmm0, dword [0x140157990]
subss xmm0, xmm6
mov rcx, qword [0x140158a08]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
movss xmm3, dword [rax + 0x48]
subss xmm3, dword [rax + 0x98]
mulss xmm0, dword [0x140144548]
addss xmm0, dword [0x140144640]
addss xmm3, xmm0
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm2, xmm6
movss dword [rax + 0x118], xmm3
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm3
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
lea rdx, [rbp + 0x17]
lea rcx, str.SUSANO
call fcn.140040030
test al, al
je 0x1400038cf
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], rbx
mov r8d, 3
lea rdx, [0x1400d7690]
lea rcx, [rbp - 9]
call fcn.140003d20
lea rcx, [rbp - 9]
call fcn.140052dc0
movss xmm3, dword [0x140144674]
movss xmm2, dword [0x140144678]
call fcn.1400025a0
lea rcx, [0x140157a18]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x140157a18]
movdqa xmmword [rbp - 9], xmm7
mov r9, qword [0x1401589f8]
lea r8, [rbp - 9]
movss xmm1, dword [0x140144680]
call fcn.140001980
call fcn.1400146e0
movdqa xmmword [rbp - 9], xmm7
mov r9, qword [0x1401589f8]
lea r8, [rbp - 9]
movss xmm1, dword [0x140144688]
lea rcx, str.connected
call fcn.140001980
call fcn.140013f90
mov ecx, dword [0x1401579b4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140003964
cmp byte [reloc.WS2_32.dll_accept], 0
sete byte [0x140157988]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400bc4a0
mov rbx, qword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x70]
add rsp, 0x90
pop rbp
ret
cmp eax, 3
jne 0x140003a93
movdqa xmmword [rbp - 9], xmm7
mov r9, qword [0x1401589f8]
lea r8, [rbp - 9]
movss xmm1, dword [0x140144634]
lea rcx, str.clean_traces_left_by_the_game_enhancer
call fcn.140001980
mov rcx, qword [0x140158a00]
call fcn.140014640
movss xmm6, dword [0x140144674]
mov dword [rbp + 0x17], 0x43480000
mov dword [rbp + 0x1b], 0x42960000
movss xmm3, dword [0x140157990]
subss xmm3, xmm6
mov rcx, qword [0x140158a08]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
mulss xmm3, dword [0x140144548]
xorps xmm0, xmm0
addss xmm3, xmm0
movss xmm1, dword [rax + 0x48]
subss xmm1, dword [rax + 0x98]
addss xmm3, xmm1
movss xmm2, dword [rax + 0x4c]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x140144660]
movss dword [rax + 0x118], xmm3
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm3
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
lea rdx, [rbp + 0x17]
lea rcx, str.CLEAN
call fcn.140040030
test al, al
je 0x140003a8b
call fcn.140053650
movaps xmm3, xmm6
jmp 0x1400038d7
cmp eax, 4
jne 0x14000391d
movdqa xmmword [rbp - 9], xmm7
mov r9, qword [0x1401589f8]
lea r8, [rbp - 9]
movss xmm1, dword [0x140144634]
lea rcx, str.success
call fcn.140001980
movdqa xmm0, xmmword [0x140144a80]
movdqa xmmword [rbp - 9], xmm0
mov r9, qword [0x1401589e0]
lea r8, [rbp - 9]
movss xmm1, dword [0x140144664]
lea rcx, str.successfully_cleaned__
call fcn.140001980
movdqa xmm0, xmmword [0x140144a80]
movdqa xmmword [rbp - 9], xmm0
mov r9, qword [0x1401589e0]
lea r8, [rbp - 9]
movss xmm1, dword [0x14014466c]
lea rcx, str.closing_in_3_seconds..
call fcn.140001980
mov ecx, 1
call fcn.1400bc5a4
mov qword [rbp + 0x17], rax
lea rcx, [rbp - 1]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140003fc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x140003bba
cmp dword [rbp - 1], 0
je 0x140003bae
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm0
lea rcx, [rbp + 0x17]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140003bae
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
lea rcx, [0x140157a18]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x140157a18]
movdqa xmmword [rbp + 0x17], xmm7
mov r9, qword [0x1401589f8]
lea r8, [rbp + 0x17]
movss xmm1, dword [0x140144680]
call fcn.140001980
jmp 0x14000391d
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 1], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3