Function at 0x1400be090
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x518]
sub rsp, 0x600
vmovaps xmmword [rax - 0x28], xmm6
vmovaps xmmword [rax - 0x38], xmm7
vmovaps xmmword [rax - 0x48], xmm8
vmovaps xmmword [rax - 0x58], xmm9
vmovaps xmmword [rax - 0x68], xmm10
vmovaps xmmword [rax - 0x78], xmm11
vmovaps xmmword [rax - 0x88], xmm12
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0x4c], r14d
mov edx, dword [0x140307194]
add rdx, qword [rcx + 0x48]
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebfc
cmp dword [0x1403073d8], r14d
je 0x1400bebfc
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebfc
mov eax, dword [rsp + 0x4c]
cmp eax, 0xffffffff
je 0x1400bebfc
shr eax, 9
lea eax, [rax*8 + 0x10]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], r14d
lea ecx, [r14 + 8]
call fcn.1401703f0
mov qword [rsp + 0x30], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x40], rdx
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov qword [rsp + 0x38], rdx
lea r8, [rsp + 0x30]
mov rdx, qword [0x1403232d8]
call fcn.1400bde00
test rax, rax
je 0x1400bebfc
mov qword [rsp + 0x70], r14
mov ecx, dword [rsp + 0x4c]
and ecx, 0x1ff
imul edx, ecx, 0x78
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebfc
cmp dword [0x1403073d8], r14d
je 0x1400bebfc
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebfc
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x50]
call fcn.140172d70
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
mov dword [rbp - 0x38], r14d
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], r14b
mov qword [rbp - 8], r14
mov qword [rbp], r14
mov qword [rbp + 8], r14
vmovdqu xmmword [rbp + 0x10], xmm0
vxorps xmm1, xmm1, xmm1
vmovups xmmword [rbp + 0x20], xmm1
vmovups xmmword [rbp + 0x30], xmm0
vxorps xmm8, xmm8, xmm8
vmovss dword [rbp + 0x40], xmm8
vmovss dword [rbp + 0x44], xmm8
vmovups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r14
mov qword [rbp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x58], r14b
vmovss dword [rbp + 0x7c], xmm8
vmovss dword [rbp + 0x80], xmm8
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], r14
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400bebe1
mov qword [rbp - 8], rax
mov edx, dword [0x140306f8c]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 0xc]
lea r8, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306f78]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 0xc]
lea r8, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306f88]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov edx, dword [0x140306f90]
add rdx, qword [rbp - 8]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rsp + 0x78]
mov rcx, qword [0x1403073d0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rsp + 0x78]
mov qword [rbp - 0x80], r14
lea rdx, [rbx + 0x360]
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rbp - 0x80]
mov rcx, qword [0x1403073d0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp - 0x80]
mov edx, dword [0x140306fbc]
add rdx, rbx
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rsp + 0x58]
mov rcx, qword [0x1403073d0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x58]
mov dword [rbp + 0x4c], eax
mov edx, dword [0x140306fc0]
add rdx, rdi
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1403073d0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x50]
mov dword [rbp + 0x48], eax
lea rcx, [rbp - 8]
call fcn.140004330
test al, al
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306f9c]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rbp + 0x7c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306f94]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306f80]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306fcc]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rbp + 0x9c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306fa8]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov qword [rbp - 0x78], r14
mov edx, dword [0x140306fac]
add rdx, qword [rbp - 8]
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306fb0]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rbp + 0xa4]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306fb8]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306fb4]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea r8, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov rax, qword [rbp - 8]
test rax, rax
je 0x1400bebe1
mov edx, dword [0x140306fa0]
add rdx, rax
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], r14d
je 0x1400bebe1
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 0x10]
lea r8, [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov edx, dword [0x140306fd4]
add rdx, qword [rbp - 8]
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400be780
cmp dword [0x1403073d8], r14d
je 0x1400be780
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403073d0]
mov rdx, qword [rbp - 0x60]
add rdx, 0x40
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x20], r14
mov r9d, 1
lea r8, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rsp + 0x48]
mov byte [rbp + 0xb4], al
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400bebe1
mov qword [rbp], rax
mov qword [rbp - 0x70], r14
mov qword [rsp + 0x60], r14
lea rdx, [rax + 0x310]
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], 0
je 0x1400bebe1
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
mov edx, dword [0x140306f14]
add rdx, qword [rbp - 0x70]
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], 0
je 0x1400bebe1
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
xor edx, edx
mov r8d, 0x3c0
lea rcx, [rbp + 0xc0]
call fcn.140172d70
lea rcx, [rbp + 0xc0]
call fcn.140003c50
mov rcx, qword [0x1403073d0]
test rcx, rcx
je 0x1400bebe1
cmp dword [0x1403073d8], 0
je 0x1400bebe1
mov qword [rsp + 0x20], r14
mov r9d, 0x3c0
lea r8, [rbp + 0xc0]
mov rdx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400bebe1
lea rbx, [rbp + 0xc8]
mov edi, 0x1e
vmovss xmm10, dword [0x1401ecdc8]
vmovsd xmm11, qword [0x1401ece20]
vmovss xmm12, dword [0x1401ece1c]
mov rcx, qword [rbp + 0x10]
nop dword [rax]
vmovaps xmm3, xmm8
vmovaps xmm2, xmm8
xor dl, dl
mov rax, qword [0x140323360]
vmulss xmm9, xmm10, dword [rax + 0xec]
vmovss xmm4, dword [rbx - 4]
vmovss xmm5, dword [rbx - 8]
vmovss xmm6, dword [rbx]
vmulss xmm1, xmm5, dword [0x140323350]
vfmadd231ss xmm1, xmm4, dword [0x140323354]
vfmadd231ss xmm1, xmm6, dword [0x140323358]
vaddss xmm7, xmm1, dword [0x14032335c]
vcvtss2sd xmm0, xmm7, xmm7
vcomisd xmm0, xmm11
jbe 0x1400be9a0
vmulss xmm1, xmm5, dword [0x140323320]
vfmadd231ss xmm1, xmm4, dword [0x140323324]
vfmadd231ss xmm1, xmm6, dword [0x140323328]
vaddss xmm0, xmm1, dword [0x14032332c]
vdivss xmm1, xmm12, xmm7
vfmadd213ss xmm1, xmm0, xmm12
vmulss xmm0, xmm1, dword [rax + 0xe8]
vmulss xmm3, xmm0, xmm10
vmulss xmm2, xmm5, dword [0x140323330]
vfmadd231ss xmm2, xmm4, dword [0x140323334]
vfmadd231ss xmm2, xmm6, dword [0x140323338]
vaddss xmm0, xmm2, dword [0x14032333c]
vdivss xmm1, xmm0, xmm7
vmovaps xmm2, xmm9
vfnmadd231ss xmm2, xmm9, xmm1
mov dl, 1
vmovsd xmm0, qword [rbx - 8]
vmovsd qword [rsp + 0x30], xmm0
mov eax, dword [rbx]
mov dword [rsp + 0x38], eax
vmovss dword [rsp + 0x3c], xmm3
vmovss dword [rsp + 0x40], xmm2
mov byte [rsp + 0x44], dl
cmp rcx, qword [rbp + 0x18]
je 0x1400be9ea
vmovups xmm0, xmmword [rsp + 0x30]
vmovups xmmword [rcx], xmm0
vmovsd xmm1, qword [rsp + 0x40]
vmovsd qword [rcx + 0x10], xmm1
mov rcx, qword [rbp + 0x10]
add rcx, 0x18
mov qword [rbp + 0x10], rcx
jmp 0x1400be9ff
lea r8, [rsp + 0x30]
mov rdx, rcx
lea rcx, [rbp + 8]
call fcn.140004030
mov rcx, qword [rbp + 0x10]
add rbx, 0x20
sub rdi, 1
jne 0x1400be8e0
sub rcx, qword [rbp + 8]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400bebe1
cmp byte [0x14032314c], dil
je 0x1400bea4d
mov eax, dword [rbp + 0xa0]
cmp dword [rsi + 0xf0], eax
je 0x1400bebe1
cmp dword [rbp + 0x98], 0
jle 0x1400bebe1
xor ecx, ecx
call fcn.140187930
mov rcx, rax
call fcn.140187918
call fcn.1401878ec
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x140323ae4], eax
jle 0x1400beae9
lea rcx, [0x140323ae4]
call fcn.140170378
cmp dword [0x140323ae4], 0xffffffff
jne 0x1400beae9
call fcn.14014d4d8
mov rbx, rax
call fcn.14014d4bc
cmp rbx, 0x989680
jne 0x1400beabb
imul rax, rax, 0x64
jmp 0x1400bead6
cqo
idiv rbx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, r8
mov qword [0x140323ae8], rax
lea rcx, [0x140323ae4]
call fcn.14017030c
call fcn.14014d4d8
mov rbx, rax
call fcn.14014d4bc
cmp rbx, 0x989680
jne 0x1400beb05
imul rbx, rax, 0x64
jmp 0x1400beb21
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
movsxd rax, dword [0x1403071c8]
mov rdx, rbx
sub rdx, qword [0x140323ae8]
imul rcx, rax, 0xf4240
cmp rdx, rcx
jl 0x1400bebe1
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr ax, 0xf
test al, al
jne 0x1400bebda
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 8
call fcn.1401703f0
lea rcx, [0x1400be050]
mov qword [rax], rcx
mov qword [rbp - 0x60], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001ff30]
xor edx, edx
xor ecx, ecx
call fcn.14017b274
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400bec58
cmp dword [rsp + 0x68], 0
je 0x1400bec4d
vmovups xmm0, xmmword [rsp + 0x60]
vmovdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call fcn.14014f758
test eax, eax
jne 0x1400bec4d
mov qword [0x140323ae8], rbx
lea rcx, [rbp + 0x58]
call fcn.140003bf0
lea rcx, [rbp + 8]
call fcn.140004780
lea rcx, [rbp - 0x30]
call fcn.140003bf0
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1401702b0
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
vmovaps xmm6, xmmword [r11 - 0x10]
vmovaps xmm7, xmmword [r11 - 0x20]
vmovaps xmm8, xmmword [r11 - 0x30]
vmovaps xmm9, xmmword [r11 - 0x40]
vmovaps xmm10, xmmword [r11 - 0x50]
vmovaps xmm11, xmmword [r11 - 0x60]
vmovaps xmm12, xmmword [r11 - 0x70]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 1
call fcn.14014d86c
nop
mov dword [rsp + 0x68], r14d
mov ecx, 6
call fcn.14014d86c
int3