Function at 0x18000bdc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x88], xmm10
mov rax, qword [0x180124040]
xor rax, rsp
mov qword [rbp - 0x31], rax
xor r13d, r13d
mov r12, rdx
mov qword [rbp - 0x59], r13
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x59]
movabs rdx, 0x141cc8988
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x59]
mov qword [rbp - 0x69], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x69]
lea rdx, [rbx + 0x744]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x69]
mov qword [rbp - 0x59], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x59]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x59]
mov qword [rbp - 0x39], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x39]
lea rdx, [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x39]
mov qword [rbp - 0x61], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x61]
lea rdx, [rbx + 0x458]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rsi, qword [rbp - 0x61]
mov qword [rbp - 0x59], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x59]
lea rdx, [rbx + 0x438]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp - 0x49], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x49]
lea rdx, [rbx + 0x120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r14, qword [rbp - 0x49]
mov qword [rbp - 0x79], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x79]
lea rdx, [r14 + 0x538]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r15, qword [rbp - 0x59]
xor eax, eax
xorps xmm0, xmm0
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 0x20]
lea r8, [rsp + 0x30]
lea rdx, [r15 + 0x410]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movups xmm0, xmmword [rsp + 0x40]
xor eax, eax
lea r15, [rbx + 0x8c]
movups xmm7, xmmword [rsp + 0x30]
mov qword [rbp - 0x79], rax
movups xmmword [rsp + 0x40], xmm0
mov dword [rbp - 0x71], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 0xc]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x79]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp - 0x71]
movss xmm1, dword [r12 + 8]
movsd xmm10, qword [rbp - 0x79]
movss xmm0, dword [r12 + 4]
mov dword [rbp - 0x59], eax
mov eax, dword [r12]
mov dword [r12], eax
movss dword [r12 + 4], xmm0
addss xmm1, dword [0x180118b34]
movss dword [r12 + 8], xmm1
test rdi, rdi
je 0x18000c659
movabs rax, 0xcccccccccccccccc
cmp rdi, rax
je 0x18000c659
mov qword [rbp - 0x69], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebx, ebx
lea r9d, [r13 + 8]
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r8, [rbp - 0x69]
lea rdx, [rdi + 0x448]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp - 0x69]
test rax, rax
je 0x18000c659
movabs rcx, 0xcccccccccccccccc
cmp rax, rcx
je 0x18000c659
mov qword [rbp - 0x69], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8, [rbp - 0x69]
lea rdx, [rdi + 0x3fc]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp - 0x79], rbx
mov rbx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x79]
lea rdx, [rbx + 0x278]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x79]
mov dword [rbp - 0x69], r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 4]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x69]
lea rdx, [rbx + 0x25c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor ebx, ebx
mov qword [rbp - 0x79], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8, [rbp - 0x79]
lea rdx, [rsi + 0x3fc]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x79]
xor esi, esi
mov qword [rbp - 0x61], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x61]
lea rdx, [rbx + 0x278]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x61]
mov dword [rbp - 0x69], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 4]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x69]
lea rdx, [rbx + 0x25c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov word [rbp - 0x61], si
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 2]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x61]
lea rdx, [rdi + 0x384]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp word [rbp - 0x61], 1
jle 0x18000c659
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xc0], xmm8
movaps xmmword [rsp + 0xb0], xmm9
mov qword [rbp - 0x79], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x79]
lea rdx, [rdi + 0x448]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x69], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 4]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x69]
lea rdx, [r14 + 0x474]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x79]
mov dword [rbp - 0x69], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 4]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x69]
lea rdx, [rbx + 0x230]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp - 0x79], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x79]
lea rdx, [rdi + 0x448]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x79]
mov dword [rbp - 0x61], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9d, [r13 + 4]
xor eax, eax
lea r8, [rbp - 0x61]
lea rdx, [rbx + 0x22c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm6, dword [rbp - 0x61]
mov dword [rbp - 0x69], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 4]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x69]
lea rdx, [rbx + 0x230]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x69]
addss xmm0, dword [0x1801189f8]
mov qword [rbp - 0x79], rsi
comiss xmm0, xmm6
setae r14b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 8]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x79]
lea rdx, [rdi + 0x448]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x79]
mov dword [rbp - 0x69], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 4]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x69]
lea rdx, [rbx + 0x22c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rbp - 0x61], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 4]
mov rcx, rax
lea r8, [rbp - 0x61]
lea rdx, [rbx + 0x230]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [0x180265bd0]
test eax, eax
jne 0x18000c41a
mov dword [rbp - 0x69], r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 4]
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x69]
lea rdx, [rdi + 0x28c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp - 0x69]
shr eax, 4
movsd xmm1, qword [r12]
movaps xmm0, xmm7
movss xmm6, dword [r12 + 8]
movaps xmm9, xmm1
shufps xmm0, xmm7, 0x55
movaps xmm8, xmm1
subss xmm9, xmm0
movsd qword [rbp - 0x79], xmm1
movaps xmm0, xmm7
shufps xmm8, xmm8, 0x55
shufps xmm0, xmm7, 0xaa
subss xmm8, xmm0
shufps xmm7, xmm7, 0xff
subss xmm6, xmm7
movaps xmm0, xmm9
mulss xmm0, xmm9
movaps xmm1, xmm8
mulss xmm1, xmm8
addss xmm1, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x18000c3c7
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x18000c3cf
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm1, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2f
xorps xmm2, xmm2
movaps xmm1, xmm9
cvtss2sd xmm2, xmm0
movaps xmm0, xmm8
mulsd xmm2, qword [0x180118b48]
cvttsd2si eax, xmm2
mov dword [rsp + 0x40], eax
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2f
xorps xmm1, xmm1
mov ebx, r13d
cvtss2sd xmm1, xmm0
mulsd xmm1, qword [0x180118b48]
cvttsd2si eax, xmm1
mov dword [rsp + 0x44], eax
jmp 0x18000c427
cmp eax, 1
je 0x18000c361
mov ebx, dword [rsp + 0x48]
mov eax, dword [rbp - 0x59]
lea r8, [rbp - 0x79]
movsd xmm6, qword [rsp + 0x40]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x59]
movsd qword [rbp - 0x79], xmm6
mov dword [rbp - 0x71], ebx
movsd qword [rbp - 0x49], xmm10
mov dword [rbp - 0x41], eax
call fcn.18000bc00
mov ecx, dword [0x180265c00]
movsd xmm7, qword [rax]
mov edi, dword [rax + 8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movaps xmm9, xmmword [rsp + 0xb0]
movaps xmm8, xmmword [rsp + 0xc0]
test ax, ax
js 0x18000c489
cmp byte [0x180265c04], sil
je 0x18000c651
cmp byte [0x180265bdc], sil
je 0x18000c599
test r14b, r14b
je 0x18000c651
cmp byte [0x180265bdd], sil
je 0x18000c532
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rbx, 0x346dc5d63886594b
mov rax, rbx
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp qword [0x180266998], rdx
jge 0x18000c651
movsd qword [rbp - 0x79], xmm7
mov dword [rbp - 0x71], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, recv
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x79]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
mov rax, rbx
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
inc rax
add rax, rdx
mov qword [0x180266998], rax
jmp 0x18000c55b
movsd qword [rbp - 0x79], xmm6
mov dword [rbp - 0x71], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, recv
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x79]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x180265c05], sil
je 0x18000c651
xor edx, edx
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
xor edx, edx
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
jmp 0x18000c651
cmp byte [0x180265bdd], sil
je 0x18000c628
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rbx, 0x346dc5d63886594b
mov rax, rbx
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp qword [0x180266998], rdx
jge 0x18000c651
movsd qword [rbp - 0x79], xmm7
mov dword [rbp - 0x71], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, recv
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x79]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
mov rax, rbx
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
inc rax
add rax, rdx
mov qword [0x180266998], rax
jmp 0x18000c651
movsd qword [rbp - 0x79], xmm6
mov dword [rbp - 0x71], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, recv
mov qword [rsp + 0x20], r13
mov rcx, rax
lea r8, [rbp - 0x79]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movaps xmm6, xmmword [rsp + 0xe0]
mov rcx, qword [rbp - 0x31]
xor rcx, rsp
call fcn.180073350
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x50]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret