Function at 0x14001e170
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
mov rax, qword [0x1400fa0c0]
xor rax, rsp
mov qword [rbp - 0x40], rax
mov rsi, rcx
xor r14d, r14d
mov rax, qword [0x1401e4b40]
test rax, rax
je 0x14001e1f4
mov rcx, qword [rax + 0xa0]
jmp 0x14001e1f7
mov rcx, r14
cmp qword [rcx + 0x18], r14
jne 0x14001e218
test rax, rax
je 0x14001e218
mov rcx, qword [rax + 0xa0]
test rcx, rcx
je 0x14001e218
cmp qword [rcx], r14
je 0x14001e218
call fcn.14004a240
call fcn.14004ac50
call fcn.140026390
cmp qword [0x1401e4f98], r14
je 0x14001e269
cmp byte [0x1400fa139], r14b
je 0x14001e269
cmp dword [0x1400fa130], r14d
jne 0x14001e269
lea rcx, [0x1400fa128]
call fcn.140001cb0
test rax, rax
je 0x14001e269
lea rcx, [0x1400fa128]
call fcn.140001cb0
mov rdx, rax
lea rcx, [0x1400fa128]
call fcn.140002280
call fcn.1400197b0
cmp qword [0x1401e4f98], r14
je 0x14001e294
mov rcx, rax
call fcn.14001a2f0
cmp qword [0x1401e4f98], r14
je 0x14001e294
lea rcx, [0x1400fa170]
call fcn.14001dae0
mov r15d, reloc.WS2_32.dll_recv
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [r15 + rdi]
cmp dword [0x1401e4f70], eax
jle 0x14001e2da
lea rcx, [0x1401e4f70]
call fcn.1400c86b0
cmp dword [0x1401e4f70], 0xffffffff
jne 0x14001e2da
mov dword [0x1401e4f68], r14d
lea rcx, [0x1401e4f70]
call fcn.1400c8644
lea rcx, [0x1401e4f68]
call fcn.14001dea0
movss xmm14, dword [0x1400e4010]
movss xmm9, dword [0x1400e3fd8]
cmp byte [0x1400fa13c], r14b
je 0x14001e3ba
mov rax, qword [0x1401e4b40]
mov rax, qword [rax + 0x4878]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rax]
call fcn.1400259d0
mov rbx, rax
movd xmm2, dword [reloc.WLDAP32.dll_Ordinal_50]
cvtdq2ps xmm2, xmm2
mov ecx, dword [rsi + 0xec]
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
mov ecx, dword [rsi + 0xe8]
xorps xmm0, xmm0
cvtsi2ss xmm0, rcx
movss dword [rsp + 0x48], xmm0
movss dword [rsp + 0x4c], xmm1
comiss xmm9, xmm2
ja 0x14001e3ba
subss xmm2, xmm9
mov dword [rsp + 0x28], 0x1ff
movss xmm0, dword [0x1400e40a8]
movss dword [rsp + 0x20], xmm0
xorps xmm3, xmm3
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1400438a0
movss dword [rsp + 0x28], xmm14
mov dword [rsp + 0x20], 1
mov r9d, 0xffffffff
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.140041e70
mov dword [rbx + 0x78], r14d
cmp byte [0x1400fa13d], r14b
je 0x14001e59b
mov eax, dword [0x1401e5220]
cmp eax, dword [r15 + rdi]
jle 0x14001e42b
lea rcx, [0x1401e5220]
call fcn.1400c86b0
mov eax, dword [0x1401e5220]
cmp eax, 0xffffffff
jne 0x14001e42b
lea ecx, [rax + 2]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [0x1401e5210], xmm0
movss dword [0x1401e5214], xmm6
lea rcx, [0x1401e5220]
call fcn.1400c8644
mov eax, dword [0x1401e5220]
movss xmm8, dword [0x1401e5210]
mulss xmm8, xmm9
cmp eax, dword [r15 + rdi]
jle 0x14001e491
lea rcx, [0x1401e5220]
call fcn.1400c86b0
cmp dword [0x1401e5220], 0xffffffff
jne 0x14001e491
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [0x1401e5210], xmm0
movss dword [0x1401e5214], xmm6
lea rcx, [0x1401e5220]
call fcn.1400c8644
movss xmm7, dword [0x1401e5214]
mulss xmm7, xmm9
mov rax, qword [0x1401e4b40]
mov rax, qword [rax + 0x4878]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.1400259d0
mov r10, rax
movaps xmm0, xmmword [0x1400e4550]
movups xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140022410
movaps xmm0, xmm8
movss xmm6, dword [0x1400e4098]
addss xmm0, xmm6
movss dword [rsp + 0x48], xmm0
movss dword [rsp + 0x4c], xmm7
movaps xmm0, xmm8
subss xmm0, xmm6
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x54], xmm7
movss dword [rsp + 0x20], xmm14
mov r9d, eax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rcx, r10
call fcn.140044240
mov rax, qword [0x1401e4b40]
mov rax, qword [rax + 0x4878]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.1400259d0
mov r10, rax
movaps xmm0, xmmword [0x1400e4550]
movups xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140022410
movss dword [rsp + 0x48], xmm8
movaps xmm0, xmm7
addss xmm0, xmm6
movss dword [rsp + 0x4c], xmm0
movss dword [rsp + 0x50], xmm8
subss xmm7, xmm6
movss dword [rsp + 0x54], xmm7
movss dword [rsp + 0x20], xmm14
mov r9d, eax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rcx, r10
call fcn.140044240
call fcn.1400197b0
cmp byte [rax + 0x28], r14b
je 0x14001eac9
mov rax, qword [0x1401e4b40]
movss xmm0, dword [rax + 0x10]
subss xmm0, dword [0x1400e4164]
movss dword [rax + 0x4788], xmm0
mov qword [rax + 0x478c], 0x40a00000
mov dword [rax + 0x4794], r14d
mov dword [rax + 0x477c], 1
or dword [rax + 0x4778], 3
mov dword [rax + 0x4798], 0x42c80000
mov dword [rax + 0x479c], 0x42480000
mov dword [rax + 0x4780], 1
mov rax, qword [0x1401e4f98]
mov qword [rsp + 0x40], rax
mov rdx, qword [0x1401e4f88]
add rdx, 0x18
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rsp + 0x58]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rsp + 0x58]
lea rdx, [rbx + 0x100]
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rbp - 0x60]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r13, qword [rbp - 0x60]
lea rdx, [rbx + 0x108]
mov qword [rsp + 0x20], r14
mov r9d, 4
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edx, edx
lea r8d, [rdx + 7]
lea rdi, str.Spectator_List
mov rcx, rdi
call fcn.14002b720
test al, al
je 0x14001eac4
mov rbx, qword [0x1401e4b40]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
movss xmm10, dword [0x1400e41a4]
movss dword [rsp + 0x20], xmm10
movss xmm11, dword [0x1400e4198]
movaps xmm3, xmm11
movss xmm2, dword [rbx + 0x3c00]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 0x3bf8]
call fcn.140048560
movss xmm0, dword [rsp + 0x58]
movss xmm12, dword [0x1400e4008]
addss xmm0, xmm12
cvttss2si eax, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss xmm13, dword [0x1400e4120]
movaps xmm2, xmm13
subss xmm2, xmm1
mulss xmm2, xmm9
mov rax, qword [rbx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rbx + 0x3ea0]
movss xmm0, dword [rax + 0x18]
subss xmm0, dword [rax + 0x7c]
addss xmm0, xmm2
movss dword [rax + 0xf8], xmm0
mov byte [rax + 0x139], 1
mov rcx, rdi
call fcn.14004d8e0
mov rax, qword [0x1401e4b40]
mov rax, qword [rax + 0x3ea0]
cmp byte [rax + 0xb3], r14b
jne 0x14001e787
mov eax, dword [rax + 0x1ac]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.140050ee0
xor ebx, ebx
mov r12d, dword [rsp + 0x50]
test r12d, r12d
jle 0x14001eac4
mov r15d, ebx
movsd xmm6, qword [0x1400e4040]
movsd xmm7, qword [0x1400e4080]
movsd xmm8, qword [0x1400e4070]
movsxd rdx, r15d
add rdx, r13
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rbp - 0x58]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x14001eab1
mov rdx, qword [0x1401e4fb8]
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rbp - 0x50]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1401e4fb8]
add rdx, rdi
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rbp - 0x48]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x50]
add rdx, 0x88
mov qword [rsp + 0x20], rbx
mov r9d, 4
lea r8, [rsp + 0x48]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x48]
add rdx, 0x88
mov qword [rsp + 0x20], rbx
mov r9d, 4
lea r8, [rsp + 0x50]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, dword [rsp + 0x50]
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.140001be0
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0x90
mov qword [rsp + 0x20], 0
mov r9d, ntohl
lea r8, [rbp - 0x70]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], 0
mov r9d, ntohl
lea r8, [rsp + 0x60]
mov rcx, qword [0x1401e4fd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x68]
subss xmm0, dword [rsp + 0x68]
cvtps2pd xmm1, xmm0
mov rdi, qword [rbp - 0x78]
cmp dword [rsp + 0x48], ebx
mov rbx, qword [rsp + 0x70]
je 0x14001ea7c
lea rax, [rsp + 0x70]
cmp rdi, 0xf
cmova rax, rbx
cmp qword [rbp - 0x80], 1
jne 0x14001e930
cmp byte [rax], 0x30
jne 0x14001e923
xor eax, eax
jmp 0x14001e928
sbb eax, eax
or eax, 1
test eax, eax
je 0x14001ea7c
comisd xmm1, xmm6
jb 0x14001ea7c
comisd xmm7, xmm1
jb 0x14001ea7c
movss xmm0, dword [rbp - 0x6c]
subss xmm0, dword [rsp + 0x64]
movss xmm1, dword [rbp - 0x70]
subss xmm1, dword [rsp + 0x60]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x14001e977
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x14001e97f
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
cvtss2sd xmm0, xmm0
comisd xmm8, xmm0
jb 0x14001ea7c
lea rax, [rsp + 0x70]
cmp rdi, 0xf
cmova rax, rbx
mov rbx, qword [0x1401e4b40]
test rax, rax
jne 0x14001e9ac
xorps xmm0, xmm0
jmp 0x14001e9fa
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm10
movaps xmm3, xmm11
movss xmm2, dword [rbx + 0x3c00]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 0x3bf8]
call fcn.140048560
movss xmm0, dword [rsp + 0x58]
addss xmm0, xmm12
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x58], xmm0
movaps xmm1, xmm13
subss xmm1, xmm0
mulss xmm1, xmm9
or dword [rbx + 0x4778], 2
mov dword [rbx + 0x4798], 0x42c80000
mov dword [rbx + 0x479c], 0x42820000
mov dword [rbx + 0x4780], 1
mov rax, qword [rbx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rbx + 0x3ea0]
movss xmm0, dword [rax + 0x18]
subss xmm0, dword [rax + 0x7c]
addss xmm0, xmm1
movss dword [rax + 0xf8], xmm0
mov byte [rax + 0x139], 1
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call fcn.14004d8e0
mov rdi, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x70]
cmp rdi, 0xf
jbe 0x14001eaaf
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001eaa7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb01
mov rcx, rbx
call fcn.1400c85d4
xor ebx, ebx
inc r14d
add r15d, 0x10
cmp r14d, r12d
jl 0x14001e7b3
xor r14d, r14d
call fcn.14002db00
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14001eae8
cmp byte [rsi + 0x158], 0
sete al
mov byte [rsi + 0x158], al
cmp byte [rsi + 0x158], 0
je 0x14001eb08
mov rcx, rsi
call fcn.14005baa0
mov r8d, 0xa0
jmp 0x14001eb0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.USER32.dll_SetWindowLongA]
movzx eax, byte [rsi + 0x158]
mov rcx, qword [0x1401e4b40]
mov byte [rcx + 0x78], al
movzx eax, byte [rsi + 0x158]
mov byte [rcx + 0xd9], al
call fcn.140028000
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0xae
call qword [rax + 0x1c8]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r14d
movss dword [rsp + 0x28], xmm14
mov dword [rsp + 0x20], r14d
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14001ebea
call fcn.1400283c0
mov rax, qword [0x1401e4b40]
mov rcx, qword [rax + 0x4878]
mov rcx, qword [rcx]
add rcx, 0x48
cmp byte [rcx], 0
cmove rcx, r14
call fcn.140049c80
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14001ecc1
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x14001ecc1
mov rbx, qword [0x1401e4b40]
test rbx, rbx
je 0x14001ec8a
mov rbx, qword [rbx + 0xa0]
test rbx, rbx
je 0x14001ec8a
cmp qword [rbx], 0
je 0x14001ec8a
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001ec55
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 8], r14
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14001ec68
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x10], r14
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14001ec8a
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x18], r14
mov rax, qword [0x1401e4b40]
mov rcx, qword [rax + 0x58]
mov qword [rcx + 8], r14
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
lea rdx, [rsi + 0xa0]
call qword [rax + 0x80]
mov rax, qword [0x1401e4b40]
test rax, rax
je 0x14001ecc1
mov rax, qword [rax + 0xa0]
test rax, rax
je 0x14001ecc1
cmp qword [rax], 0
je 0x14001ecc1
call fcn.14004a240
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.1400c8570
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret