Function at 0x18000e840
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
movaps xmmword [r11 - 0x18], xmm6
mov rax, qword [0x1800b6040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rcx, qword [0x1800b7c00]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rdi
movaps xmmword [r11 - 0x28], xmm7
mov rax, qword [rcx + 0x3ed0]
cmp qword [rax + 0x1a8], 0
movss xmm1, dword [rax + 0x254]
subss xmm1, dword [rax + 0x104]
movss xmm0, dword [rax + 0x250]
jne 0x18000e8a9
cmp qword [rcx + 0x4b30], 0
je 0x18000e8b1
movss xmm0, dword [rax + 0x220]
subss xmm0, dword [rax + 0x100]
movss xmm7, dword [0x1800a3938]
lea rdx, [rbp + 0x17]
xor r8d, r8d
movss dword [rbp + 0x1b], xmm1
lea rcx, [rbp - 0x19]
mov word [rbp - 0x10], 0x31
mov dword [rbp - 0x19], 0x69612323
mulss xmm0, xmm7
mov dword [rbp - 0x15], 0x746f626d
mov byte [rbp - 0x11], 0x5f
mov byte [rbp - 0xe], 0
movss dword [rbp + 0x17], xmm0
call fcn.18003a470
lea rdx, [0x180a4205f]
mov word [rbp + 0x1c], 0x65
lea rcx, [rbp + 0x17]
mov dword [rbp + 0x17], 0x62616e45
mov byte [rbp + 0x1b], 0x6c
mov byte [rbp + 0x1e], 0
call fcn.1800633a0
movss xmm6, dword [0x1800a3b00]
xorps xmm0, xmm0
movaps xmm1, xmm6
call fcn.180042b70
mov rdi, qword [0x1800b7cb0]
movss xmm4, dword [0x1800a3a40]
movss xmm0, dword [0x1800a3a5c]
unpcklps xmm0, xmm4
cmp byte [rdi + 0x24], 0
movsd qword [rbp + 0x27], xmm0
jne 0x18000e980
cmp qword [rdi + 0x18], 0xf
mov rcx, rdi
jbe 0x18000e965
mov rcx, qword [rdi]
lea rdx, [rbp + 0x27]
call fcn.180061d30
test al, al
je 0x18000e976
mov byte [rdi + 0x24], 1
cmp byte [rdi + 0x24], 0
je 0x18000ea88
mov rax, qword [0x1800b7c00]
lea rcx, [rbp - 0x19]
movups xmm0, xmmword [rax + 0x3a1c]
movups xmmword [rbp - 0x19], xmm0
shufps xmm0, xmm0, 0xff
mulss xmm0, dword [rax + 0x37d0]
movss dword [rbp - 0xd], xmm0
call fcn.1800321f0
mov edx, eax
mov ecx, 0x15
call fcn.180032c70
lea rdx, [rbp + 0x27]
mov dword [rbp + 0x17], 0x2e2e2e
lea rcx, [rbp + 0x17]
mov byte [rbp + 0x1b], 0
call fcn.180061d30
mov r8, qword [0x1800b7c00]
movsxd rax, dword [r8 + 0x4818]
cmp eax, 1
jl 0x18000ea0b
mov rcx, qword [r8 + 0x4820]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4 - 0x14]
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
add rax, rax
movups xmmword [r8 + rax*8 + 0x38ac], xmm0
dec dword [r8 + 0x4818]
mov rax, qword [0x1800b8220]
mov rax, qword [rax]
mov qword [rbp + 0x17], rax
cmp byte [rax + 0x19], 0
jne 0x18000ea88
mov qword [rsp + 0xc8], rsi
nop word [rax + rax]
lea rbx, [rax + 0x20]
mov ecx, dword [rbx + 0x20]
lea rsi, [rbx + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18000ea6d
cmp rdi, rbx
je 0x18000ea64
cmp qword [rbx + 0x18], 0xf
mov r8, qword [rbx + 0x10]
jbe 0x18000ea59
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rdi
call fcn.180016fa0
mov eax, dword [rsi]
mov dword [rdi + 0x20], eax
mov byte [rdi + 0x24], 0
lea rcx, [rbp + 0x17]
call fcn.18002f040
mov rax, qword [rbp + 0x17]
cmp byte [rax + 0x19], 0
je 0x18000ea30
mov rsi, qword [rsp + 0xc8]
lea rdx, [0x180a42068]
mov dword [rbp - 0x11], 0x736465
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x67726154
mov dword [rbp - 0x15], 0x50207465
mov byte [rbp - 0xd], 0
call fcn.1800633a0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.180042b70
movdqa xmm0, xmmword [0x1800a4220]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
mov word [rbp + 0x27], 0x3f
movups xmmword [rbp - 0x19], xmm0
mov byte [rbp + 0x29], 0
call fcn.180061370
mov rcx, qword [0x1800b7c00]
cmp byte [rcx + 0x48ef], 0
mov r8, qword [rcx + 0x3ed0]
je 0x18000eb2b
cmp byte [rcx + 0x48ee], 0
jne 0x18000eb2b
test byte [rcx + 0x4770], 4
jne 0x18000ec20
mov eax, dword [rcx + 0x48b8]
cmp eax, dword [rcx + 0x476c]
jne 0x18000ec20
test eax, eax
jne 0x18000ebf3
jmp 0x18000ec20
mov eax, dword [rcx + 0x4774]
test al, 1
je 0x18000ec20
cmp qword [rcx + 0x3ed8], r8
je 0x18000eb4a
test al, al
jns 0x18000ec20
mov eax, dword [rcx + 0x3f30]
test eax, eax
je 0x18000eb6f
cmp eax, dword [rcx + 0x476c]
je 0x18000eb6f
cmp byte [rcx + 0x3f3d], 0
jne 0x18000eb6f
cmp eax, dword [r8 + 0x7c]
jne 0x18000ec20
mov rdx, qword [rcx + 0x48b0]
test rdx, rdx
je 0x18000ebd4
mov rdx, qword [rdx + 0x378]
test rdx, rdx
je 0x18000ebd4
cmp byte [rdx + 0xb7], 0
je 0x18000ebd4
mov rax, qword [r8 + 0x378]
cmp rdx, rax
je 0x18000ebd4
mov r9d, dword [rdx + 0x14]
bt r9d, 0x1b
jb 0x18000ebae
bt r9d, 0x1a
jae 0x18000ebd4
cmp qword [rax + 0x378], rdx
je 0x18000ebd4
cmp rax, rdx
je 0x18000ebd4
mov rax, qword [rax + 0x370]
test rax, rax
jne 0x18000ebb7
test dword [rcx + 0x4770], 0x100
je 0x18000ec20
test byte [rcx + 0x4770], 4
jne 0x18000ec20
mov eax, dword [r8 + 0x7c]
cmp dword [rcx + 0x476c], eax
jne 0x18000ebf3
cmp byte [r8 + 0xb8], 0
jne 0x18000ec20
movdqa xmm0, xmmword [0x1800a3dc0]
lea rcx, [rbp - 0x19]
movdqa xmm1, xmmword [0x1800a4830]
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp + 7], 0x2e
movdqu xmmword [rbp - 9], xmm1
mov byte [rbp + 9], 0
call fcn.180043b90
lea rdx, [0x180a42060]
mov dword [rbp - 0x11], 0x646165
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x67726154
mov dword [rbp - 0x15], 0x44207465
mov byte [rbp - 0xd], 0
call fcn.1800633a0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.180042b70
movdqa xmm0, xmmword [0x1800a4220]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
mov word [rbp + 0x27], 0x3f
movups xmmword [rbp - 0x19], xmm0
mov byte [rbp + 0x29], 0
call fcn.180061370
mov rcx, qword [0x1800b7c00]
cmp byte [rcx + 0x48ef], 0
mov r8, qword [rcx + 0x3ed0]
je 0x18000ecc3
cmp byte [rcx + 0x48ee], 0
jne 0x18000ecc3
test byte [rcx + 0x4770], 4
jne 0x18000edba
mov eax, dword [rcx + 0x48b8]
cmp eax, dword [rcx + 0x476c]
jne 0x18000edba
test eax, eax
jne 0x18000ed8c
jmp 0x18000edba
mov eax, dword [rcx + 0x4774]
test al, 1
je 0x18000edba
cmp qword [rcx + 0x3ed8], r8
je 0x18000ece2
test al, al
jns 0x18000edba
mov eax, dword [rcx + 0x3f30]
test eax, eax
je 0x18000ed07
cmp eax, dword [rcx + 0x476c]
je 0x18000ed07
cmp byte [rcx + 0x3f3d], 0
jne 0x18000ed07
cmp eax, dword [r8 + 0x7c]
jne 0x18000edba
mov rdx, qword [rcx + 0x48b0]
test rdx, rdx
je 0x18000ed6d
mov rdx, qword [rdx + 0x378]
test rdx, rdx
je 0x18000ed6d
cmp byte [rdx + 0xb7], 0
je 0x18000ed6d
mov rax, qword [r8 + 0x378]
cmp rdx, rax
je 0x18000ed6d
mov r9d, dword [rdx + 0x14]
bt r9d, 0x1b
jb 0x18000ed46
bt r9d, 0x1a
jae 0x18000ed6d
cmp qword [rax + 0x378], rdx
je 0x18000ed6d
nop
cmp rax, rdx
je 0x18000ed6d
mov rax, qword [rax + 0x370]
test rax, rax
jne 0x18000ed50
test dword [rcx + 0x4770], 0x100
je 0x18000edba
test byte [rcx + 0x4770], 4
jne 0x18000edba
mov eax, dword [r8 + 0x7c]
cmp dword [rcx + 0x476c], eax
jne 0x18000ed8c
cmp byte [r8 + 0xb8], 0
jne 0x18000edba
movdqa xmm0, xmmword [0x1800a3dc0]
lea rcx, [rbp - 0x19]
movdqa xmm1, xmmword [0x1800a45c0]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp + 7], 0x2e73b4
movdqu xmmword [rbp - 9], xmm1
mov byte [rbp + 0xb], 0
call fcn.180043b90
movdqa xmm0, xmmword [0x1800a46d0]
lea rdx, [0x180a42069]
lea rcx, [rbp - 0x19]
mov word [rbp - 8], 0x77
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 9], 0x65
mov byte [rbp - 6], 0
call fcn.1800633a0
cmp byte [0x180a42069], 0
je 0x18000ee1e
lea rdx, [0x1800b7a1a]
mov dword [rbp - 0xd], 0x564f46
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x77617244
mov dword [rbp - 0x15], 0x6c694620
mov dword [rbp - 0x11], 0x2064656c
mov byte [rbp - 9], 0
call fcn.1800633a0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.180042b70
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x13], 0x726961
lea rdx, [0x180a4206a]
mov dword [rbp - 0x19], 0x736f7243
mov word [rbp - 0x15], 0x6873
mov byte [rbp - 0xf], 0
call fcn.1800633a0
lea rdx, [0x1800b7a19]
mov dword [rbp + 0x1b], 0x656e69
lea rcx, [rbp + 0x17]
mov dword [rbp + 0x17], 0x4c6d6941
mov byte [rbp + 0x1f], 0
call fcn.1800633a0
call fcn.18003a520
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.180042b70
mov rdx, qword [0x1800b7c00]
mov rax, qword [rdx + 0x3ed0]
cmp qword [rax + 0x1a8], 0
movss xmm1, dword [rax + 0x254]
subss xmm1, dword [rax + 0x104]
movss xmm0, dword [rax + 0x250]
jne 0x18000eebd
cmp qword [rdx + 0x4b30], 0
je 0x18000eec5
movss xmm0, dword [rax + 0x220]
subss xmm0, dword [rax + 0x100]
xor r8d, r8d
movss dword [rbp + 0x1b], xmm1
lea rdx, [rbp + 0x17]
mov word [rbp - 0xe], 0x73
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x5f612323
mov dword [rbp - 0x15], 0x74746573
movss dword [rbp + 0x17], xmm0
mov word [rbp - 0x11], 0x6e69
mov byte [rbp - 0xf], 0x67
mov byte [rbp - 0xc], 0
call fcn.18003a470
mov rax, qword [0x1800b7c00]
mov rdx, qword [rax + 0x3ed0]
cmp qword [rdx + 0x1a8], 0
movss xmm0, dword [rdx + 0x250]
jne 0x18000ef33
cmp qword [rax + 0x4b30], 0
je 0x18000ef3b
movss xmm0, dword [rdx + 0x220]
subss xmm0, dword [rdx + 0x100]
mulss xmm0, xmm7
call fcn.180042c20
lea rax, [rbp + 0x27]
mov dword [rbp - 0x13], 0x676e69
lea rdi, [0x18009806c]
mov dword [rbp - 0x19], 0x6f6f6d53
xor ebx, ebx
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r8, [0x180a42064]
mov word [rbp - 0x15], 0x6874
lea rcx, [rbp - 0x19]
mov byte [rbp - 0xf], 0
mov dword [rbp + 0x27], 0x64
mov dword [rbp + 0x17], ebx
call fcn.180066640
mov r9, qword [0x1800b7c00]
mov rax, qword [r9 + 0x3ed0]
mov byte [rax + 0xb8], 1
mov r8, qword [r9 + 0x3ed0]
movsxd rdx, dword [r8 + 0x1c8]
mov rax, qword [r8 + 0x1d0]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1c8], eax
mov dword [r8 + 0x1bc], ecx
mov rcx, qword [r9 + 0x3ed0]
movss xmm0, dword [rcx + 0x250]
cmp qword [rcx + 0x1a8], rbx
jne 0x18000eff9
cmp qword [r9 + 0x4b30], rbx
je 0x18000f001
movss xmm0, dword [rcx + 0x220]
subss xmm0, dword [rcx + 0x100]
mulss xmm0, xmm7
call fcn.180042c20
lea rax, [rbp + 0x17]
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x27]
mov qword [rsp + 0x20], rax
lea r8, [0x1800b7a1c]
mov dword [rbp - 0xf], 0x776569
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x6c656946
mov dword [rbp - 0x15], 0x664f2064
mov word [rbp - 0x11], 0x5620
mov byte [rbp - 0xb], bl
mov dword [rbp + 0x17], 0x64
mov dword [rbp + 0x27], ebx
call fcn.180066640
mov r9, qword [0x1800b7c00]
mov rax, qword [r9 + 0x3ed0]
mov byte [rax + 0xb8], 1
mov r8, qword [r9 + 0x3ed0]
movsxd rdx, dword [r8 + 0x1c8]
mov rax, qword [r8 + 0x1d0]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1c8], eax
mov dword [r8 + 0x1bc], ecx
mov rcx, qword [r9 + 0x3ed0]
movss xmm0, dword [rcx + 0x250]
cmp qword [rcx + 0x1a8], rbx
jne 0x18000f0bc
cmp qword [r9 + 0x4b30], rbx
je 0x18000f0c4
movss xmm0, dword [rcx + 0x220]
subss xmm0, dword [rcx + 0x100]
mulss xmm0, xmm7
call fcn.180042c20
lea rax, [rbp + 0x17]
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x27]
mov qword [rsp + 0x20], rax
lea r8, [0x1800b60c8]
mov word [rbp - 0x12], 0x65
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x74736944
mov word [rbp - 0x15], 0x6e61
mov byte [rbp - 0x13], 0x63
mov byte [rbp - 0x10], bl
mov dword [rbp + 0x17], 0x9c4
mov dword [rbp + 0x27], ebx
call fcn.180066640
mov r9, qword [0x1800b7c00]
mov rdi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc0]
mov rax, qword [r9 + 0x3ed0]
mov byte [rax + 0xb8], 1
mov r8, qword [r9 + 0x3ed0]
movsxd rdx, dword [r8 + 0x1c8]
mov rax, qword [r8 + 0x1d0]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1c8], eax
mov dword [r8 + 0x1bc], ecx
mov rcx, qword [r9 + 0x3ed0]
cmp qword [rcx + 0x1a8], 0
movss xmm0, dword [rcx + 0x250]
jne 0x18000f18d
cmp qword [r9 + 0x4b30], 0
je 0x18000f195
movss xmm0, dword [rcx + 0x220]
subss xmm0, dword [rcx + 0x100]
mulss xmm0, xmm7
call fcn.180042c20
lea rcx, [rbp - 0x19]
mov word [rbp - 0x12], 0x65
mov dword [rbp - 0x19], 0x206d6941
mov word [rbp - 0x15], 0x6f42
mov byte [rbp - 0x13], 0x6e
mov byte [rbp - 0x10], 0
call fcn.180065560
mov rcx, qword [0x1800b7c00]
movaps xmm1, xmm6
xorps xmm0, xmm0
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov r8, qword [rcx + 0x3ed0]
movsxd rdx, dword [r8 + 0x1c8]
mov rax, qword [r8 + 0x1d0]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1c8], eax
mov dword [r8 + 0x1bc], ecx
call fcn.180042b70
movdqa xmm0, xmmword [0x1800a4220]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
mov word [rbp + 0x27], 0x3f
movups xmmword [rbp - 0x19], xmm0
mov byte [rbp + 0x29], 0
call fcn.180061370
mov rcx, qword [0x1800b7c00]
movaps xmm7, xmmword [rsp + 0x90]
cmp byte [rcx + 0x48ef], 0
mov r8, qword [rcx + 0x3ed0]
je 0x18000f28b
cmp byte [rcx + 0x48ee], 0
jne 0x18000f28b
test byte [rcx + 0x4770], 4
jne 0x18000f39d
mov eax, dword [rcx + 0x48b8]
cmp eax, dword [rcx + 0x476c]
jne 0x18000f39d
test eax, eax
jne 0x18000f353
jmp 0x18000f39d
mov eax, dword [rcx + 0x4774]
test al, 1
je 0x18000f39d
cmp qword [rcx + 0x3ed8], r8
je 0x18000f2aa
test al, al
jns 0x18000f39d
mov eax, dword [rcx + 0x3f30]
test eax, eax
je 0x18000f2cf
cmp eax, dword [rcx + 0x476c]
je 0x18000f2cf
cmp byte [rcx + 0x3f3d], 0
jne 0x18000f2cf
cmp eax, dword [r8 + 0x7c]
jne 0x18000f39d
mov rdx, qword [rcx + 0x48b0]
test rdx, rdx
je 0x18000f334
mov rdx, qword [rdx + 0x378]
test rdx, rdx
je 0x18000f334
cmp byte [rdx + 0xb7], 0
je 0x18000f334
mov rax, qword [r8 + 0x378]
cmp rdx, rax
je 0x18000f334
mov r9d, dword [rdx + 0x14]
bt r9d, 0x1b
jb 0x18000f30e
bt r9d, 0x1a
jae 0x18000f334
cmp qword [rax + 0x378], rdx
je 0x18000f334
cmp rax, rdx
je 0x18000f334
mov rax, qword [rax + 0x370]
test rax, rax
jne 0x18000f317
test dword [rcx + 0x4770], 0x100
je 0x18000f39d
test byte [rcx + 0x4770], 4
jne 0x18000f39d
mov eax, dword [r8 + 0x7c]
cmp dword [rcx + 0x476c], eax
jne 0x18000f353
cmp byte [r8 + 0xb8], 0
jne 0x18000f39d
movdqa xmm0, xmmword [0x1800a4f00]
lea rcx, [rbp - 0x19]
movdqa xmm1, xmmword [0x1800a4a20]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp + 7], 0xdcc3c7da
movdqu xmmword [rbp - 9], xmm1
mov dword [rbp + 0xb], 0xd7dcde91
mov dword [rbp + 0xf], 0xd6d896de
mov word [rbp + 0x13], 0x97
mov byte [rbp + 0x15], 1
call fcn.18000f4b0
mov rcx, rax
call fcn.180043b90
lea rcx, [rbp - 0x19]
mov dword [rbp - 0xf], 0x726f6c
mov dword [rbp - 0x19], 0x4c6d6941
mov dword [rbp - 0x15], 0x20656e69
mov word [rbp - 0x11], 0x6f43
mov byte [rbp - 0xb], 0
call fcn.180061230
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.180042b70
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x13], 0x656e69
mov r8d, 0x10020
mov dword [rbp - 0x19], 0x69412323
lea rdx, [0x1800b60b8]
mov word [rbp - 0x15], 0x6c6d
mov byte [rbp - 0xf], 0
call fcn.18006cf00
movups xmm0, xmmword [0x1800b60b8]
movups xmmword [0x1800b6298], xmm0
call fcn.18003a520
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.18008f450
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbp
ret