Function at 0x1400037e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x528]
sub rsp, 0x600
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x14004d040]
xor rax, rsp
mov qword [rbp + 0x450], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
xor r12d, r12d
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
movdqa xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x50], xmm1
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x70], xmm1
xorps xmm10, xmm10
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x1400040ee
cmp dword [0x14004d0c8], r12d
je 0x1400040ee
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 8]
lea r8, [rbp]
mov rdx, qword [0x14004e398]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400040ee
cmp qword [rsp + 0x58], 8
jne 0x1400040ee
mov rax, qword [rbp]
test rax, rax
je 0x1400040ee
mov qword [rbp + 0x20], rax
lea r8, [rbp + 0x2c]
mov edx, dword [0x14004d258]
lea rcx, [rbp + 0x20]
call fcn.1400044e0
test al, al
je 0x1400040ee
lea r8, [rbp + 0x30]
mov edx, dword [0x14004d260]
lea rcx, [rbp + 0x20]
call fcn.1400044e0
test al, al
je 0x1400040ee
lea r8, [rbp + 0x28]
mov edx, dword [0x14004d25c]
lea rcx, [rbp + 0x20]
call fcn.1400044e0
test al, al
je 0x1400040ee
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x140003a8f
mov edx, dword [0x14004d264]
add rdx, rax
lea r8, [rbp + 0x34]
call fcn.140004600
test al, al
je 0x140003a8f
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x140003a8f
cmp dword [0x14004d0c8], r12d
je 0x140003a8f
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 8]
lea r8, [rsp + 0x60]
mov rdx, qword [0x14004e378]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140003a8f
cmp qword [rsp + 0x58], 8
jne 0x140003a8f
mov ecx, dword [rbp + 0x34]
shr ecx, 9
and ecx, 0x3f
shl ecx, 3
mov rdx, qword [rsp + 0x60]
add rdx, 0x10
add rdx, rcx
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x140003a8f
cmp dword [0x14004d0c8], r12d
je 0x140003a8f
mov qword [rsp + 0x70], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 8]
lea r8, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140003a8f
cmp qword [rsp + 0x70], 8
jne 0x140003a8f
mov eax, dword [rbp + 0x34]
and eax, 0x1ff
imul edx, eax, 0x78
add rdx, qword [rsp + 0x60]
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x140003a8f
cmp dword [0x14004d0c8], r12d
je 0x140003a8f
mov qword [rsp + 0x78], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 8]
lea r8, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140003a8f
cmp qword [rsp + 0x78], 8
mov rax, qword [rsp + 0x68]
je 0x140003a92
mov rax, r12
mov qword [rbp + 0x38], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14004e468], eax
jle 0x140003b0d
lea rcx, [0x14004e468]
call fcn.14003a638
cmp dword [0x14004e468], 0xffffffff
jne 0x140003b0d
xorps xmm0, xmm0
movdqu xmmword [0x14004e458], xmm0
mov ecx, 0xb8
call fcn.14003a6b0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x14004e458], rax
lea rcx, [0x14003c790]
call fcn.14003a9e4
nop
lea rcx, [0x14004e468]
call fcn.14003a5cc
movss xmm14, dword [0x140044e88]
xorps xmm11, xmm11
xorps xmm12, xmm12
xorps xmm13, xmm13
mov r14d, 0x78
lea r15d, [r14 - 0x38]
movabs r13, 0x2aaaaaaaaaaaaaab
movss xmm15, dword [0x140044e60]
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
movdqa xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movaps xmmword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x60], r12
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x1400040d7
cmp dword [0x14004d0c8], eax
je 0x1400040d7
mov qword [rsp + 0x68], r12
mov rdx, qword [0x14004e390]
add rdx, r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400040d7
cmp qword [rsp + 0x68], 8
jne 0x1400040d7
mov rax, qword [rsp + 0x60]
cmp rax, qword [rbp + 0x38]
je 0x1400040d7
test rax, rax
je 0x1400040d7
mov qword [rbp - 0x58], rax
lea r8, [rbp - 0x14]
mov edx, dword [0x14004d250]
lea rcx, [rbp - 0x58]
call fcn.140004570
test al, al
je 0x1400040d7
lea r8, [rbp - 0x28]
mov edx, dword [0x14004d238]
lea rcx, [rbp - 0x58]
call fcn.140004570
test al, al
je 0x1400040d7
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x1400040d7
mov edx, dword [0x14004d24c]
add rdx, rax
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x1400040d7
cmp dword [0x14004d0c8], 0
je 0x1400040d7
mov qword [rsp + 0x68], r12
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400040d7
cmp qword [rsp + 0x68], 8
jne 0x1400040d7
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x1400040d7
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x70], r12
mov qword [rbp + 0x10], r12
mov edx, dword [0x14004d0e4]
add rdx, rax
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x1400040d7
cmp dword [0x14004d0c8], 0
je 0x1400040d7
mov qword [rsp + 0x78], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400040d7
cmp qword [rsp + 0x78], 8
jne 0x1400040d7
mov edx, dword [0x14004d0e8]
add rdx, qword [rsp + 0x70]
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x1400040d7
cmp dword [0x14004d0c8], 0
je 0x1400040d7
mov qword [rbp + 8], r12
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400040d7
cmp qword [rbp + 8], 8
jne 0x1400040d7
xor edx, edx
mov r8d, 0x3c0
lea rcx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x90]
call fcn.140002c30
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x1400040d7
cmp dword [0x14004d0c8], 0
je 0x1400040d7
mov qword [rbp - 0x80], r12
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x3c0
lea r8, [rbp + 0x90]
mov rdx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400040d7
cmp qword [rbp - 0x80], 0x3c0
jne 0x1400040d7
lea rbx, [rbp + 0x90]
lea rdi, [rbp + 0x90]
mov esi, 0x1e
mov r9, qword [rbp - 0x40]
nop
mov qword [rsp + 0x58], 0
lea r8, [rsp + 0x58]
mov rdx, rdi
lea rcx, [0x14004e3a8]
call fcn.140002300
movsd xmm0, qword [rbx]
movsd qword [rsp + 0x30], xmm0
mov ecx, dword [rbx + 8]
mov dword [rsp + 0x38], ecx
movsd xmm0, qword [rsp + 0x58]
movsd qword [rsp + 0x3c], xmm0
mov byte [rsp + 0x44], al
cmp r9, qword [rbp - 0x38]
je 0x140003e57
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r9], xmm0
movsd xmm1, qword [rsp + 0x40]
movsd qword [r9 + 0x10], xmm1
mov r9, qword [rbp - 0x40]
add r9, 0x18
mov qword [rbp - 0x40], r9
jmp 0x140003e6c
lea r8, [rsp + 0x30]
mov rdx, r9
lea rcx, [rbp - 0x48]
call fcn.140002f80
mov r9, qword [rbp - 0x40]
add rdi, 0x20
add rbx, 0x20
sub rsi, 1
jne 0x140003df0
sub r9, qword [rbp - 0x48]
mov rax, r13
imul r9
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400040d7
cmp dword [rbp - 0x60], 1
jne 0x1400040d7
cmp dword [rbp - 0x64], esi
jle 0x1400040d7
lea r8, [rbp - 0x1c]
lea rdx, [rbp - 0x28]
lea rcx, [0x14004e3a8]
call fcn.140002300
test al, al
je 0x1400040d7
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140004017
ucomiss xmm11, xmm10
jp 0x140003efb
jne 0x140003efb
ucomiss xmm12, xmm10
jp 0x140003efb
jne 0x140003efb
ucomiss xmm13, xmm10
jp 0x140003efb
je 0x140004017
movaps xmm7, xmm13
subss xmm7, dword [rbp + 0x84]
movaps xmm8, xmm12
subss xmm8, dword [rbp + 0x80]
movaps xmm9, xmm11
subss xmm9, dword [rbp + 0x7c]
xorps xmm0, xmm0
cvtss2sd xmm0, xmm9
movsd xmm1, qword [0x140044df0]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
xorps xmm0, xmm0
cvtss2sd xmm0, xmm8
movsd xmm1, qword [0x140044df0]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm1, xmm0
addsd xmm1, xmm6
xorps xmm0, xmm0
ucomisd xmm0, xmm1
ja 0x140003f64
xorps xmm0, xmm0
sqrtsd xmm0, xmm1
jmp 0x140003f6c
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
movaps xmm1, xmm9
movaps xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2f
mulss xmm0, xmm15
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
movsd xmm9, qword [0x140044df8]
divsd xmm1, xmm9
cvtpd2ps xmm8, xmm1
comiss xmm6, xmm10
jbe 0x140003fcf
divss xmm7, xmm6
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_atanf
xorps xmm0, xmmword [0x140044fa0]
mulss xmm0, xmm15
cvtss2sd xmm0, xmm0
divsd xmm0, xmm9
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
jmp 0x140003fd3
movaps xmm1, xmm10
movss dword [rbp + 0x18], xmm1
movss dword [rbp + 0x1c], xmm8
mov rcx, qword [0x14004d0c0]
test rcx, rcx
je 0x140004017
cmp dword [0x14004d0c8], 0
je 0x140004017
mov qword [rbp - 0x80], r12
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x18]
mov rdx, qword [0x14004e388]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdi, qword [rbp - 0x48]
mov rbx, qword [0x14004e3e8]
movss xmm0, dword [rbx + 0xec]
mulss xmm0, dword [0x140044da0]
subss xmm0, dword [rdi + 0xa0]
movss xmm8, dword [0x140044dec]
movaps xmm1, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
movaps xmm6, xmm0
movss xmm0, dword [rbx + 0xe8]
mulss xmm0, dword [0x140044da0]
subss xmm0, dword [rdi + 0x9c]
movaps xmm1, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm6, xmm0
xorps xmm1, xmm1
ucomiss xmm1, xmm6
ja 0x140004085
xorps xmm0, xmm0
sqrtss xmm0, xmm6
jmp 0x14000408d
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movss xmm1, dword [0x140044e6c]
comiss xmm1, xmm0
jbe 0x1400040cd
comiss xmm14, xmm0
jbe 0x1400040cd
movaps xmm14, xmm0
movsd xmm1, qword [rdi + 0x90]
movss xmm13, dword [rdi + 0x98]
movaps xmm0, xmm1
shufps xmm0, xmm0, 0x55
movaps xmm12, xmm0
movsd qword [rsp + 0x48], xmm1
movss xmm11, dword [rsp + 0x48]
lea rcx, [rbp - 0x70]
call fcn.140003470
nop
lea rcx, [rbp - 0x48]
call fcn.1400042b0
add r14, 0x78
sub r15, 1
jne 0x140003b40
lea rcx, [rbp + 0x48]
call fcn.1400042b0
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.14003a570
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret