Function at 0x1400014a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x310
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor edi, edi
mov rdx, qword [0x140008790]
add rdx, 0x1878c08
mov qword [rbp - 0x68], rdi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 8]
lea r8, [rbp - 0x68]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r13, qword [rbp - 0x68]
mov qword [rsp + 0x60], r13
test r13, r13
je 0x140001f5f
lea rdx, [r13 + 0x3bf]
mov dword [rbp - 0x78], edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp - 0x78]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140008790]
add rdx, 0x18796f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 0x40]
lea r8, [rbp + 0x10]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [r13 + 0x1214]
mov qword [rbp - 0x10], rdi
mov dword [rbp - 8], edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 0xc]
lea r8, [rbp - 0x10]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140008790]
add rdx, 0x178b898
mov qword [rbp - 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 8]
lea r8, [rbp - 0x28]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rsi, qword [rbp - 0x28]
mov qword [rsp + 0x38], rsi
mov r14d, 1
mov dword [rsp + 0x30], r14d
mov r12d, dword [rbp - 0x78]
mov dword [rsp + 0x34], r12d
movss xmm7, dword [0x1400056b8]
movss xmm6, dword [0x1400056a8]
movss xmm15, dword [0x1400056a4]
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400016a5
cmp byte [0x140008044], 0
sete byte [0x140008044]
lea rdx, [0x140001300]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
movzx edx, byte [0x140008044]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
lea rdx, [0x1400029e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [0x140008044], 0
je 0x140001ec5
mov qword [rbp - 0x70], rdi
mov edx, r14d
and edx, 0x7fff
shl edx, 3
sar edx, 9
add rdx, 0x10
add rdx, rsi
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp - 0x70]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140001ec5
mov qword [rbp - 0x20], rdi
mov eax, r14d
and eax, 0x1ff
imul edx, eax, 0x78
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp - 0x20]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x140001ec5
lea rdx, [rbx + 0x808]
mov dword [rbp - 0x78], edi
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp - 0x78]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp - 0x78]
dec eax
cmp eax, 0x63
ja 0x140001ec5
lea rdx, [rbx + 0x7fc]
mov dword [rbp - 0x70], edi
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp - 0x70]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [rbp - 0x70]
xor r15d, r15d
mov qword [rbp - 0x60], r15
mov edx, edi
shr edx, 9
and edx, 0x3f
shl edx, 3
add rdx, 0x10
add rdx, rsi
mov qword [rsp + 0x20], r15
lea r9d, [r15 + 8]
lea r8, [rbp - 0x60]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140001ec3
mov qword [rbp - 0x18], r15
and edi, 0x1ff
imul edx, edi, 0x78
add rdx, rcx
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9d, [r15 + 8]
lea r8, [rbp - 0x18]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r15, qword [rbp - 0x18]
cmp r15, r13
je 0x140001ec5
lea rdx, [rbx + 0x3bf]
mov dword [rbp - 0x70], edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rbp - 0x70]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], 0xa
mov qword [rbp - 0x30], 0xf
movsd xmm0, qword [str.error:_404]
movsd qword [rbp - 0x48], xmm0
movzx eax, word [0x1400055a8]
mov word [rbp - 0x40], ax
mov byte [rbp - 0x3e], dil
lea rdx, [rbx + 0x720]
mov qword [rbp - 0x60], rdi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 8]
lea r8, [rbp - 0x60]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x140001a18
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea r8, [rbp + 0x60]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rax, [rbp + 0x60]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400018e6
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140001fc7
cmp rbx, 0x10
jae 0x140001931
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov r8, rbx
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x40], 0
jmp 0x1400019cb
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x140001950
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140001977
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001996
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001fcd
mov rcx, rax
call fcn.140003700
test rax, rax
je 0x140001ef5
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400019a7
test rcx, rcx
je 0x1400019a5
call fcn.140003700
mov rsi, rax
jmp 0x1400019a7
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov r8, rbx
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
xor edi, edi
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140001a06
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ef5
call fcn.140003994
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x38], xmm1
lea rdx, [r15 + 0x1214]
mov qword [rbp - 0x58], 0
mov dword [rbp - 0x50], 0
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rbp - 0x58]
mov rcx, qword [0x1400087b0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm2, dword [rbp - 0x50]
movaps xmm13, xmm2
addss xmm13, xmm7
movss xmm7, dword [rbp + 0x40]
movss xmm11, dword [rbp - 0x58]
mulss xmm7, xmm11
movss xmm0, dword [rbp + 0x44]
movss xmm8, dword [rbp - 0x54]
mulss xmm0, xmm8
addss xmm7, xmm0
movss xmm4, dword [rbp + 0x48]
movaps xmm12, xmm4
mulss xmm12, xmm2
addss xmm12, xmm7
addss xmm12, dword [rbp + 0x4c]
movaps xmm1, xmm6
divss xmm1, xmm12
movss xmm9, dword [rbp + 0x24]
mulss xmm9, xmm8
movss xmm0, dword [rbp + 0x20]
mulss xmm0, xmm11
addss xmm9, xmm0
movss xmm6, dword [rbp + 0x28]
movaps xmm0, xmm6
mulss xmm0, xmm2
addss xmm0, xmm9
addss xmm0, dword [rbp + 0x2c]
mulss xmm0, xmm1
xorps xmm10, xmm10
cvtsi2ss xmm10, dword [0x1400087ac]
movaps xmm14, xmm10
mulss xmm14, xmm15
mulss xmm0, xmm15
mulss xmm0, xmm10
addss xmm0, xmm15
movaps xmm15, xmm14
subss xmm15, xmm0
movaps xmm0, xmm13
mulss xmm0, xmm4
addss xmm0, xmm7
addss xmm0, dword [rbp + 0x4c]
movss xmm2, dword [0x1400056a8]
divss xmm2, xmm0
movss xmm7, dword [rbp + 0x14]
mulss xmm7, xmm8
movss xmm0, dword [rbp + 0x10]
mulss xmm0, xmm11
addss xmm7, xmm0
movaps xmm1, xmm13
mulss xmm1, dword [rbp + 0x18]
addss xmm7, xmm1
addss xmm7, dword [rbp + 0x1c]
mulss xmm7, xmm2
mulss xmm13, xmm6
addss xmm13, xmm9
addss xmm13, dword [rbp + 0x2c]
mulss xmm13, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [0x1400087a8]
movss xmm8, dword [0x1400056a4]
mulss xmm7, xmm8
mulss xmm7, xmm0
addss xmm7, xmm8
mulss xmm0, xmm8
addss xmm7, xmm0
mulss xmm13, xmm8
mulss xmm13, xmm10
addss xmm13, xmm8
subss xmm14, xmm13
subss xmm15, xmm14
movaps xmm0, xmm15
divss xmm0, dword [0x1400056ac]
comiss xmm12, dword [0x1400056a0]
jb 0x140001e6c
cvttss2si r13d, xmm14
movaps xmm6, xmm0
mulss xmm6, xmm8
mov ecx, 0xc04ea
cmp r12d, dword [rbp - 0x70]
mov eax, 0xffffff
cmove ecx, eax
cvttss2si eax, xmm15
cvttss2si r9d, xmm0
movaps xmm0, xmm7
subss xmm0, xmm6
cvttss2si edx, xmm0
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov r8d, r13d
call fcn.140001310
mov eax, 0x64
mov edx, dword [rbp - 0x78]
sub eax, edx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm15
divss xmm0, dword [0x1400056bc]
subss xmm15, xmm0
cvttss2si r12d, xmm15
addss xmm0, xmm14
cvttss2si r14d, xmm0
addss xmm6, dword [0x1400056b0]
movaps xmm0, xmm7
subss xmm0, xmm6
cvttss2si esi, xmm0
mov r15, qword [0x1400087c0]
movzx ecx, dl
add cl, cl
mov byte [rbp - 0x68], cl
movzx eax, dl
not al
movzx eax, al
mov dword [rbp - 0x70], eax
sub cl, 0x44
movzx ecx, cl
or ecx, 0xc300
shl ecx, 8
or ecx, eax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdi, rax
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbx, rax
mov dword [rbp], esi
mov dword [rbp + 4], r14d
lea edx, [rsi + 2]
mov dword [rbp + 8], edx
lea edx, [r14 + r12]
mov dword [rbp + 0xc], edx
mov r8, rdi
lea rdx, [rbp]
mov rcx, r15
call qword [sym.imp.USER32.dll_FrameRect]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
lea r9, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae r9, qword [rbp - 0x48]
addss xmm6, xmm7
cvttss2si ebx, xmm6
mov dword [rsp + 0x20], 0xeb6d7d
mov r8d, r13d
mov edx, ebx
mov rcx, qword [0x1400087c0]
call fcn.1400013d0
mov edx, dword [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140002800
nop
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x140001d41
lea rax, [rcx + 2]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x68]
mov word [rax + rcx], 0x5048
mov byte [rax + rcx + 2], 0
lea rax, [rsp + 0x68]
jmp 0x140001d59
mov qword [rsp + 0x20], 2
mov edx, 2
lea rcx, [rsp + 0x68]
call fcn.140002bd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov eax, dword [rbp - 0x68]
add al, 0x37
movzx eax, al
or eax, 0x4b00
shl eax, 8
or eax, dword [rbp - 0x70]
addss xmm14, dword [0x1400056b4]
cvttss2si r8d, xmm14
mov dword [rsp + 0x20], eax
mov edx, ebx
mov rcx, qword [0x1400087c0]
call fcn.1400013d0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140001e0e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001efc
call fcn.140003994
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], dil
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140001e5d
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f03
call fcn.140003994
mov r12d, dword [rsp + 0x34]
mov r13, qword [rsp + 0x60]
mov r14d, dword [rsp + 0x30]
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140001ea3
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f0a
call fcn.140003994
movss xmm15, dword [0x1400056a4]
movss xmm6, dword [0x1400056a8]
movss xmm7, dword [0x1400056b8]
mov rsi, qword [rsp + 0x38]
jmp 0x140001ec5
xor edi, edi
inc r14d
mov dword [rsp + 0x30], r14d
cmp r14d, 0x20
jl 0x140001653
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140001f11
imul rax, rax, 0x64
jmp 0x140001f2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7ffffffffff0bdbe
cmp rax, rcx
jg 0x140001f46
add rax, 0xf4240
jmp 0x140001f50
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call fcn.140002dc0
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400036e0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400012d0
nop
call fcn.140001230
int3