Function at 0x1400c67b0
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140204480]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rcx
xor r15d, r15d
mov rdx, qword [0x140246658]
cmp byte [rdx + 0x6a81], r15b
je 0x1400c7009
movzx ecx, byte [rcx]
test cl, cl
jne 0x1400c6822
mov eax, dword [rbx + 0xc]
cmp eax, 0x20
je 0x1400c6816
cmp eax, 0x30
jne 0x1400c6822
mov dword [reloc.WLDAP32.dll_Ordinal_32], eax
mov dword [reloc.WLDAP32.dll_Ordinal_32], eax
movabs rdi, 0x1000100010001
cmp byte [0x1402443fb], r15b
je 0x1400c68a0
test cl, cl
jne 0x1400c68a0
mov eax, dword [rbx + 0xc]
cmp eax, 0xc00
je 0x1400c6863
cmp eax, 0xa80
je 0x1400c6863
cmp eax, 0xa90
je 0x1400c6863
add eax, 0xfffff600
cmp eax, 0x30
ja 0x1400c68a0
cdqe
bt rdi, rax
jae 0x1400c68a0
mov r8, qword [rdx + 0x6af6]
mov rax, qword [r8]
cmp rax, r8
je 0x1400c68a0
mov r9d, dword [rbx + 0x2c]
cmp dword [rax + 0x327], r9d
jne 0x1400c6895
mov ecx, dword [rbx + 0x30]
cmp dword [rax + 0x32b], ecx
jne 0x1400c6895
cmp word [rax + 0x22], r15w
jne 0x1400c6ac9
mov rcx, qword [rax]
mov rax, rcx
cmp rcx, r8
jne 0x1400c6876
cmp byte [0x140244513], r15b
je 0x1400c6988
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400c6981
cmp byte [rbx], r15b
jne 0x1400c6981
mov eax, dword [rbx + 0xc]
cmp eax, 0xc00
je 0x1400c68fc
cmp eax, 0xa80
je 0x1400c68fc
cmp eax, 0xa90
je 0x1400c68fc
add eax, 0xfffff600
cmp eax, 0x30
ja 0x1400c6981
cdqe
bt rdi, rax
jae 0x1400c6981
mov ecx, reloc.WS2_32.dll_recv
call fcn.140183940
mov ecx, dword [rbx + 0x30]
mov dword [rax], ecx
mov ecx, dword [rbx + 0x2c]
mov dword [rax + 4], ecx
lea rcx, [0x140039300]
mov qword [rax + 8], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x1400fa6b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400c6d8c
cmp dword [rsp + 0x48], 0
je 0x1400c6d80
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400c6d80
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rdx, qword [0x140246658]
cmp byte [rdx + 0x66f8], 0
je 0x1400c6fad
cmp byte [0x140244518], 0
je 0x1400c6fad
cmp byte [rbx], 0
jne 0x1400c6fad
mov ecx, dword [rbx + 0xc]
cmp ecx, 0xc00
je 0x1400c69eb
cmp ecx, 0xa80
je 0x1400c69eb
cmp ecx, 0xa90
je 0x1400c69eb
lea eax, [rcx - 0xa00]
cmp eax, 0x30
ja 0x1400c69d9
cdqe
bt rdi, rax
jb 0x1400c69eb
cmp ecx, 0xc20
je 0x1400c69eb
cmp dword [rbx + 0x14], 0
jle 0x1400c6fad
lea rcx, [rdx + 0x340]
mov rdx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400c6a00
mov rcx, qword [rcx]
mov qword [rsp + 0x20], 9
lea r9, str.localhost
xor r8d, r8d
call fcn.1400eee50
cmp rax, 0xffffffffffffffff
je 0x1400c6f9e
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.OnTextOverlay
lea rcx, [rbp - 0x70]
call fcn.1400ef310
nop
lea rsi, [0x140010180]
mov qword [rsp + 0x20], rsi
lea r9, [0x14000f7f0]
mov edx, 0x40
lea r8d, [rdx - 0x39]
lea rcx, [rbp - 0x50]
call fcn.140183de8
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x50], 2
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r9, qword [rbp - 0x70]
mov rbx, qword [rbp - 0x60]
lea rcx, [rsp + 0x70]
cmp rbx, 0xf
ja 0x1400c6d9d
mov qword [rbp - 0x80], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rbx + 0x70], 0
jmp 0x1400c6da6
mov dword [0x1402444bc], r9d
mov dword [0x14024448c], ecx
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.OnTextOverlay
lea rcx, [rbp - 0x70]
call fcn.1400ef310
nop
lea rsi, [0x140010180]
mov qword [rsp + 0x20], rsi
lea r9, [0x14000f7f0]
mov edx, 0x40
lea r8d, [rdx - 0x39]
lea rcx, [rbp - 0x50]
call fcn.140183de8
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x50], 2
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r9, qword [rbp - 0x70]
mov rbx, qword [rbp - 0x60]
lea rcx, [rsp + 0x70]
cmp rbx, 0xf
ja 0x1400c6b76
mov qword [rbp - 0x80], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rbx + 0x70], 0
jmp 0x1400c6b7f
mov rdx, rbx
call fcn.1400ef1d0
nop
mov eax, dword [rsp + 0x50]
mov dword [rbp - 0x50], eax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x48], rax
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rbp - 0x40], xmm0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.1400e3e80
nop
lea rcx, [rsp + 0x70]
call fcn.140008300
nop
lea rcx, [rbp - 0x70]
call fcn.140008300
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov r8d, reloc.WLDAP32.dll_Ordinal_35
lea rdx, str._2Successfully__1Set_Lamp_Position_
lea rcx, [rbp - 0x70]
call fcn.1400ef310
nop
mov dword [rbp - 0x10], 2
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r9, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x60]
mov rax, qword [rbp + 0x28]
cmp rdi, rax
ja 0x1400c6c28
lea rbx, [rbp + 0x10]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x10]
mov qword [rbp + 0x20], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x1400c6c35
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.1400ef1d0
nop
lea rcx, [rbp - 0x70]
call fcn.140008300
mov r14, qword [0x140246658]
mov r13, qword [r14 + 0x1d0]
mov r12, qword [r14]
test r13, r13
je 0x1400c6d5c
test r12, r12
je 0x1400c6d5c
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.14011c6f0
mov qword [rbp - 0x70], rax
mov ebx, dword [rsp + 0x30]
mov ecx, ebx
add rcx, 0x3c
mov rdi, 0xffffffffffffffff
cmovb rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
mov ecx, ebx
add rcx, 0x41
cmovb rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400c6d5c
test r15, r15
je 0x1400c6d5c
add rbx, 0x3c
mov r8, rbx
xor edx, edx
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x30]
add r8, 0x41
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x40]
mov dword [rax], 4
mov byte [r15], 1
mov dword [r15 + 4], edi
or dword [r15 + 0xc], 8
mov dword [r15 + 0x14], 0
lea rcx, [r15 + 0x38]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [r15 + 0x34], eax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 4]
mov r8, rbx
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call fcn.14000a850
mov r9, r12
mov r8, rax
mov rdx, r13
mov rcx, r14
call fcn.140126240
mov byte [0x1402443fb], 0
mov r9, rsi
mov edx, 0x40
lea r8d, [rdx - 0x39]
lea rcx, [rbp - 0x50]
call fcn.140183ad0
nop
mov al, 1
jmp 0x1400c700b
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rdx, rbx
call fcn.1400ef1d0
nop
mov eax, dword [rsp + 0x50]
mov dword [rbp - 0x50], eax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x48], rax
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rbp - 0x40], xmm0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.1400e3e80
nop
lea rcx, [rsp + 0x70]
call fcn.140008300
nop
lea rcx, [rbp - 0x70]
call fcn.140008300
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov r8d, reloc.WLDAP32.dll_Ordinal_45
lea rdx, str._8PathFinder_Is_Not_Supported_In_This_Server.
lea rcx, [rbp - 0x70]
call fcn.1400ef310
nop
mov dword [rbp - 0x10], 2
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r9, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x60]
mov rax, qword [rbp + 0x28]
cmp rdi, rax
ja 0x1400c6e4f
lea rbx, [rbp + 0x10]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x10]
mov qword [rbp + 0x20], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x1400c6e5c
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.1400ef1d0
nop
lea rcx, [rbp - 0x70]
call fcn.140008300
mov r14, qword [0x140246658]
mov r13, qword [r14 + 0x1d0]
mov r12, qword [r14]
test r13, r13
je 0x1400c6f84
test r12, r12
je 0x1400c6f84
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.14011c6f0
mov qword [rbp - 0x70], rax
mov ebx, dword [rsp + 0x30]
mov ecx, ebx
add rcx, 0x3c
mov rdi, 0xffffffffffffffff
cmovb rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
mov ecx, ebx
add rcx, 0x41
cmovb rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400c6f84
test r15, r15
je 0x1400c6f84
add rbx, 0x3c
mov r8, rbx
xor edx, edx
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x30]
add r8, 0x41
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x40]
mov dword [rax], 4
mov byte [r15], 1
mov dword [r15 + 4], edi
or dword [r15 + 0xc], 8
mov dword [r15 + 0x14], 0
lea rcx, [r15 + 0x38]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [r15 + 0x34], eax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi + 4]
mov r8, rbx
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call fcn.14000a850
mov r9, r12
mov r8, rax
mov rdx, r13
mov rcx, r14
call fcn.140126240
nop
mov r9, rsi
mov edx, 0x40
lea r8d, [rdx - 0x39]
lea rcx, [rbp - 0x50]
call fcn.140183ad0
nop
mov al, 1
jmp 0x1400c700b
mov edx, dword [rbx + 0x30]
mov ecx, dword [rbx + 0x2c]
call fcn.14012af20
mov al, 1
jmp 0x1400c700b
movss xmm1, dword [rbx + 0x18]
movss xmm0, dword [rbx + 0x1c]
movss dword [rdx + 0x6a19], xmm1
movss dword [rdx + 0x6a1d], xmm0
cmp byte [0x14024453b], 0
lea rcx, str._CLIENT_:_local_pos:__.0f__.0f__People_cant_see_you_move_because_Ghost_Mode_is_on__n
jne 0x1400c6fde
lea rcx, str._CLIENT_:_local_pos:__.0f__.0f_n
movss xmm2, dword [rbx + 0x1c]
cvtps2pd xmm2, xmm2
movss xmm1, dword [rbx + 0x18]
cvtps2pd xmm1, xmm1
movq r8, xmm2
movq rdx, xmm1
call fcn.14000eb90
cmp byte [0x14024453b], 0
setne al
jmp 0x1400c700b
xor al, al
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140183920
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret