Function at 0x18000a2a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x398]
sub rsp, 0x470
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x1803d4070]
xor rax, rsp
mov qword [rbp + 0x2c8], rax
call fcn.180001aa0
mov rcx, rax
test rax, rax
je 0x18000b6e1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
lea rdi, [0x180013983]
lea rcx, [rbp - 0x38]
cmp rdi, 0x10000
jae 0x18000a353
movzx edx, di
call fcn.18000d750
jmp 0x18000a35b
mov rdx, rdi
call fcn.18000ce20
movzx ebx, di
call fcn.180001aa0
mov rcx, rax
test rax, rax
je 0x18000b6d6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
cmp rdi, 0x10000
jae 0x18000a394
movzx edx, bx
call fcn.18000d750
jmp 0x18000a39d
mov rdx, rdi
call fcn.18000ce20
nop
mov rdi, qword [0x1803d4e48]
xor ebx, ebx
mov qword [rbp + 0x10], rbx
lea edx, [rbx + 8]
lea rcx, [rdi + 0x94a91e0]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a3d6
lea r8d, [rbx + 8]
lea rdx, [rdi + 0x94a91e0]
lea rcx, [rbp + 0x10]
call fcn.180002d30
mov rbx, qword [rbp + 0x10]
lea rdi, [rbx + 0xb8]
xor ebx, ebx
mov qword [rbp + 0x88], rbx
lea edx, [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a410
lea r8d, [rbx + 8]
mov rdx, rdi
lea rcx, [rbp + 0x88]
call fcn.180002d30
mov rbx, qword [rbp + 0x88]
lea rdi, [rbx + 8]
xor ebx, ebx
mov qword [rbp + 0x90], rbx
lea edx, [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a447
lea r8d, [rbx + 8]
mov rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.180002d30
mov rbx, qword [rbp + 0x90]
lea rdi, [rbx + 0x18]
xor ebx, ebx
mov qword [rbp + 8], rbx
lea edx, [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a475
lea r8d, [rbx + 8]
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.180002d30
mov rbx, qword [rbp + 8]
mov r13d, 0xffffffff
test rbx, rbx
je 0x18000b632
lea rdi, [rbx + 0x2f8]
xor esi, esi
mov qword [rbp + 0x98], rsi
lea edx, [rsi + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a4be
lea r8d, [r13 + 9]
mov rdx, rdi
lea rcx, [rbp + 0x98]
call fcn.180002d30
mov rsi, qword [rbp + 0x98]
lea rcx, [rsi + 0x100]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
mov rcx, rbx
call fcn.1800039e0
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.180003b80
lea r15, [rbx + 0xf8]
xor esi, esi
mov qword [rbp + 0xa0], rsi
lea edx, [rsi + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a51e
lea r8d, [rsi + 8]
mov rdx, r15
lea rcx, [rbp + 0xa0]
call fcn.180002d30
mov rsi, qword [rbp + 0xa0]
lea rcx, [rsi + 0x70]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
lea r14, [rbx + 0xc8]
xor esi, esi
mov qword [rbp + 0xa8], rsi
lea edx, [rsi + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a567
lea r8d, [rsi + 8]
mov rdx, r14
lea rcx, [rbp + 0xa8]
call fcn.180002d30
mov rsi, qword [rbp + 0xa8]
lea r12, [rsi + 0xe0]
xor esi, esi
mov qword [rbp + 0xb0], rsi
lea edx, [rsi + 8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a5a1
lea r8d, [rsi + 8]
mov rdx, r12
lea rcx, [rbp + 0xb0]
call fcn.180002d30
mov rsi, qword [rbp + 0xb0]
lea rcx, [rsi + 0xb0]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
mov rcx, rbx
call fcn.180003cb0
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.180003e30
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x18000a629
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x18000a61b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x18000a61b
call fcn.18000d8d0
mov rsi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x18000a611
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x38], rax
jmp 0x18000a629
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x38]
call fcn.18000d9c0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000a648
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rsi, qword [rbp + 0x10]
add rsi, 0x40
xor ebx, ebx
mov qword [rbp + 0xb8], rbx
lea edx, [rbx + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a683
lea r8d, [rbx + 8]
mov rdx, rsi
lea rcx, [rbp + 0xb8]
call fcn.180002d30
mov rbx, qword [rbp + 0xb8]
lea r12, [rbx + 0xb8]
xor ebx, ebx
mov qword [rbp + 0xc0], rbx
lea edx, [rbx + 8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a6bd
lea r8d, [rbx + 8]
mov rdx, r12
lea rcx, [rbp + 0xc0]
call fcn.180002d30
mov rbx, qword [rbp + 0xc0]
lea r12, [rbx + 0x18]
xor ebx, ebx
mov qword [rbp + 0xc8], rbx
lea edx, [rbx + 8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a6f4
lea r8d, [rbx + 8]
mov rdx, r12
lea rcx, [rbp + 0xc8]
call fcn.180002d30
mov rbx, qword [rbp + 0xc8]
lea rcx, [rbx + 0x18]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
xor ebx, ebx
mov qword [rbp + 0xd0], rbx
lea edx, [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a736
lea r8d, [rbx + 8]
mov rdx, rdi
lea rcx, [rbp + 0xd0]
call fcn.180002d30
mov rbx, qword [rbp + 0xd0]
mov dword [rbp - 0x1c], 0
mov edx, 4
lea rcx, [rbx + 0x100]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a767
lea r8d, [rax + 4]
lea rdx, [rbx + 0x100]
lea rcx, [rbp - 0x1c]
call fcn.180002d30
mov rdi, qword [rbp + 8]
mov rcx, rdi
call fcn.1800039e0
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.180003b80
movsd xmm0, qword [rax]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [rax + 8]
mov dword [rsp + 0x28], eax
xor ebx, ebx
mov qword [rbp + 0xd8], rbx
lea edx, [rbx + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a7c3
lea r8d, [rbx + 8]
mov rdx, r15
lea rcx, [rbp + 0xd8]
call fcn.180002d30
mov rbx, qword [rbp + 0xd8]
xor r15d, r15d
mov dword [rbp - 0x10], r15d
lea edx, [r15 + 4]
lea rcx, [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a7ed
lea r8d, [r15 + 4]
lea rdx, [rbx + 0x70]
lea rcx, [rbp - 0x10]
call fcn.180002d30
mov rbx, r15
mov qword [rbp + 0xe0], rbx
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a823
lea r8d, [rax + 8]
mov rdx, r14
lea rcx, [rbp + 0xe0]
call fcn.180002d30
mov rbx, qword [rbp + 0xe0]
lea r14, [rbx + 0xe0]
mov rbx, r15
mov qword [rbp + 0x20], rbx
mov edx, 8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a857
lea r8d, [rax + 8]
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.180002d30
mov rbx, qword [rbp + 0x20]
mov dword [rbp - 4], r15d
mov edx, 4
lea rcx, [rbx + 0xb0]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a885
lea r8d, [rax + 4]
lea rdx, [rbx + 0xb0]
lea rcx, [rbp - 4]
call fcn.180002d30
mov rcx, rdi
call fcn.180003cb0
movss dword [rsp + 0x30], xmm0
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.180003e30
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rbp - 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x18000a901
mov eax, dword [rbx + 0x10]
shr eax, 0x1f
test al, al
jne 0x18000a8f3
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x18000a8f3
call fcn.18000d8d0
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x18000a8e9
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x38], rax
jmp 0x18000a901
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x38]
call fcn.18000d9c0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000a920
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, r15
mov qword [rbp + 0x28], rbx
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a94d
lea r8d, [rax + 8]
mov rdx, rsi
lea rcx, [rbp + 0x28]
call fcn.180002d30
mov rbx, qword [rbp + 0x28]
lea rdi, [rbx + 0xb8]
mov rbx, r15
mov qword [rbp + 0x30], rbx
mov edx, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a981
lea r8d, [rax + 8]
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.180002d30
mov rbx, qword [rbp + 0x30]
lea rdi, [rbx + 0x18]
mov rbx, r15
mov qword [rbp + 0x38], rbx
mov edx, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a9b2
lea r8d, [rax + 8]
mov rdx, rdi
lea rcx, [rbp + 0x38]
call fcn.180002d30
mov rbx, qword [rbp + 0x38]
mov dword [rbp - 0x30], r15d
mov edx, 4
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000a9da
lea r8d, [rax + 4]
lea rdx, [rbx + 0x18]
lea rcx, [rbp - 0x30]
call fcn.180002d30
mov edi, dword [rbp - 0x30]
lea eax, [rdi - 1]
cmp eax, 0x1386
ja 0x18000b632
mov qword [rbp + 0x40], r15
mov edx, 8
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000aa13
lea r8d, [rax + 8]
lea rdx, [rbx + 0x10]
lea rcx, [rbp + 0x40]
call fcn.180002d30
mov r12d, r15d
test edi, edi
je 0x18000b632
movss xmm10, dword [0x1803ce3d0]
movsd xmm13, qword [0x1803ce310]
movsd xmm14, qword [0x1803ce280]
movsd xmm15, qword [0x1803ce288]
movsd xmm12, qword [0x1803ce2c0]
movss xmm11, dword [0x1803ce278]
mov rdi, qword [rbp - 0x28]
nop dword [rax + rax]
lea esi, [r12*8]
add rsi, qword [rbp + 0x40]
mov rbx, r15
mov qword [rbp + 0x18], rbx
mov edx, 8
lea rcx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000aa9b
lea r8d, [rax + 8]
lea rdx, [rsi + 0x20]
lea rcx, [rbp + 0x18]
call fcn.180002d30
mov rbx, qword [rbp + 0x18]
cmp rbx, 0xffff
jbe 0x18000b623
cmp rbx, qword [rbp + 8]
je 0x18000b623
mov rsi, r15
mov qword [rbp + 0x48], r15
mov edx, 8
lea rcx, [rbx + 0x2f8]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000aae7
lea r8d, [rax + 8]
lea rdx, [rbx + 0x2f8]
lea rcx, [rbp + 0x48]
call fcn.180002d30
mov rsi, qword [rbp + 0x48]
lea r14, [rsi + 0x100]
mov esi, r15d
mov dword [rbp - 0x20], r15d
mov edx, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ab1a
lea r8d, [rax + 4]
mov rdx, r14
lea rcx, [rbp - 0x20]
call fcn.180002d30
mov esi, dword [rbp - 0x20]
cmp esi, dword [rbp - 0x1c]
je 0x18000b623
mov dword [rbp - 0x18], r15d
mov edx, 4
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000b623
lea r8d, [rax + 4]
lea rdx, [rbx + 0x38]
lea rcx, [rbp - 0x18]
call fcn.180002d30
cmp dword [rbp - 0x18], 0x101
jne 0x18000b623
mov dword [rbp - 0x14], r15d
mov edx, 4
lea rcx, [rbx + 0x6c]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000b623
lea r8d, [rax + 4]
lea rdx, [rbx + 0x6c]
lea rcx, [rbp - 0x14]
call fcn.180002d30
cmp dword [rbp - 0x14], 1
jne 0x18000b623
mov rcx, rbx
call fcn.1800039e0
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.180003b80
movsd xmm2, qword [rax]
movss xmm0, dword [rsp + 0x20]
subss xmm0, xmm2
andps xmm0, xmm10
cvtps2pd xmm0, xmm0
movss xmm1, dword [rsp + 0x24]
movaps xmm9, xmm2
shufps xmm9, xmm9, 0x55
movsd qword [rsp + 0x40], xmm2
subss xmm1, xmm9
andps xmm1, xmm10
cvtps2pd xmm8, xmm1
movss xmm2, dword [rsp + 0x28]
movss xmm1, dword [rax + 8]
movss dword [rsp + 0x48], xmm1
subss xmm2, xmm1
andps xmm2, xmm10
cvtps2pd xmm6, xmm2
movsd xmm1, qword [0x1803ce298]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm7, xmm0
movsd xmm1, qword [0x1803ce298]
movaps xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm8, xmm0
movsd xmm1, qword [0x1803ce298]
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm8, xmm7
addsd xmm8, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm8
ja 0x18000ac4c
xorps xmm6, xmm6
sqrtsd xmm6, xmm8
jmp 0x18000ac58
movaps xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movaps xmm6, xmm0
comisd xmm13, xmm6
jb 0x18000b623
subss xmm9, dword [rsp + 0x24]
andps xmm9, xmm10
movss xmm0, dword [0x1803ce390]
comiss xmm0, xmm9
jb 0x18000b623
mov rsi, r15
mov qword [rbp + 0x50], r15
mov edx, 8
lea rcx, [rbx + 0xf8]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000acb5
lea r8d, [rax + 8]
lea rdx, [rbx + 0xf8]
lea rcx, [rbp + 0x50]
call fcn.180002d30
mov rsi, qword [rbp + 0x50]
mov dword [rbp - 8], r15d
mov edx, 4
lea rcx, [rsi + 0x70]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000acdd
lea r8d, [rax + 4]
lea rdx, [rsi + 0x70]
lea rcx, [rbp - 8]
call fcn.180002d30
lea rsi, [rbx + 0xc8]
mov r14, r15
mov qword [rbp + 0x58], r15
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ad11
lea r8d, [rax + 8]
mov rdx, rsi
lea rcx, [rbp + 0x58]
call fcn.180002d30
mov r14, qword [rbp + 0x58]
lea r15, [r14 + 0xe0]
xor r14d, r14d
mov qword [rbp + 0x60], r14
lea edx, [r14 + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ad44
lea r8d, [r14 + 8]
mov rdx, r15
lea rcx, [rbp + 0x60]
call fcn.180002d30
mov r14, qword [rbp + 0x60]
mov dword [rbp - 0xc], 0
mov edx, 4
lea rcx, [r14 + 0xb0]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ad75
lea r8d, [rax + 4]
lea rdx, [r14 + 0xb0]
lea rcx, [rbp - 0xc]
call fcn.180002d30
xor r14d, r14d
mov qword [rbp + 0x68], r14
lea edx, [r14 + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ada1
lea r8d, [r14 + 8]
mov rdx, rsi
lea rcx, [rbp + 0x68]
call fcn.180002d30
mov r14, qword [rbp + 0x68]
lea r15, [r14 + 0xe0]
xor r14d, r14d
mov qword [rbp + 0x70], r14
lea edx, [r14 + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000add4
lea r8d, [r14 + 8]
mov rdx, r15
lea rcx, [rbp + 0x70]
call fcn.180002d30
mov r14, qword [rbp + 0x70]
xor r15d, r15d
mov dword [rbp], r15d
lea edx, [r15 + 4]
lea rcx, [r14 + 0x5c]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000adfe
lea r8d, [r15 + 4]
lea rdx, [r14 + 0x5c]
lea rcx, [rbp]
call fcn.180002d30
mov r14, r15
mov qword [rbp + 0x78], r15
mov edx, 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ae2b
lea r8d, [rax + 8]
mov rdx, rsi
lea rcx, [rbp + 0x78]
call fcn.180002d30
mov r14, qword [rbp + 0x78]
mov rsi, r15
mov qword [rbp + 0x80], r15
mov edx, 8
lea rcx, [r14 + 0xe0]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ae69
lea r8d, [rax + 8]
lea rdx, [r14 + 0xe0]
lea rcx, [rbp + 0x80]
call fcn.180002d30
mov rsi, qword [rbp + 0x80]
mov dword [rbp + 4], r15d
mov edx, 4
lea rcx, [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
test eax, eax
jne 0x18000ae91
lea r8d, [rax + 4]
lea rdx, [rsi + 0x58]
lea rcx, [rbp + 4]
call fcn.180002d30
mov rcx, rbx
call fcn.180003cb0
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.180003e30
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x18000af03
mov eax, dword [rdi + 0x10]
shr eax, 0x1f
test al, al
jne 0x18000aef5
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x18000aef5
call fcn.18000d8d0
mov rbx, rax
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x18000aeeb
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x28], rax
jmp 0x18000af03
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x28]
call fcn.18000d9c0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000af22
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movsd xmm0, qword [rsp + 0x20]
movsd qword [rsp + 0x70], xmm0
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x78], eax
movsd xmm0, qword [rsp + 0x40]
movsd qword [rbp - 0x80], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rbp - 0x78], eax
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
mov rcx, qword [rbp + 0x18]
call fcn.180004130
mov r14d, eax
mov ecx, dword [rbp - 0x10]
call fcn.180004470
mov rdi, qword [rbp - 0x28]
mov r15d, dword [rbp - 0xc]
mov esi, dword [rbp - 8]
test eax, eax
je 0x18000b400
mov ecx, dword [rbp - 4]
call fcn.1800044a0
test eax, eax
je 0x18000b400
mov rbx, qword [rbp - 0x38]
cmp dword [rbx - 0x10], 0
jl 0x18000afe0
lea rdx, str.shock
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x18000afb6
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x18000b400
cmp dword [rbx - 0x10], 0
jl 0x18000afe0
lea rdx, str.emptystep
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x18000afe0
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x18000b400
cmp byte [0x1803d4094], 0
je 0x18000b400
lea rcx, [rdi - 0x18]
call fcn.18000d8d0
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x38]
movaps xmm2, xmm6
mov edx, r15d
mov ecx, esi
call fcn.1800047f0
test eax, eax
je 0x18000b400
test r14d, r14d
je 0x18000b400
mov rbx, qword [rbp + 8]
mov rcx, rbx
call fcn.180003cb0
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
comisd xmm1, xmm14
jbe 0x18000b241
mov rcx, rbx
call fcn.180003cb0
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
comisd xmm15, xmm1
jb 0x18000b241
xor r15d, r15d
mov qword [rbp + 0xe8], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xfc], xmm0
mov dword [rbp + 0x10c], r15d
mov r14d, 0x47
mov word [rbp + 0xf0], r14w
mov dword [rbp + 0xf4], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0xf8], eax
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp + 0xf2], ax
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0xe8]
lea ecx, [r15 + 1]
call section..data
lea ecx, [r15 + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b140
lea ecx, [r15 + 0xc]
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18c], xmm0
mov qword [rbp + 0x1a4], r15
mov dword [rbp + 0x1ac], r15d
mov dword [rbp + 0x188], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x1a0], eax
mov dword [rbp + 0x19c], 4
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x188]
lea ecx, [r15 + 1]
call section..data
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b1b5
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b4], xmm0
mov qword [rbp + 0x1cc], r15
mov dword [rbp + 0x1d4], r15d
mov dword [rbp + 0x1b0], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x1c8], eax
mov dword [rbp + 0x1c4], 0x10
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
mov r8d, 0x28
lea rdx, [rbp + 0x1b0]
lea ecx, [r8 - 0x27]
call section..data
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0x110], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x124], xmm0
mov dword [rbp + 0x134], r15d
mov word [rbp + 0x118], r14w
mov dword [rbp + 0x11c], 2
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x120], eax
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp + 0x11a], ax
lea rdx, [rbp + 0x110]
mov rax, qword [0x1803d4e60]
mov r8d, 0x28
mov qword [0x1803d4e38], rax
lea ecx, [r8 - 0x27]
call section..data
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000b623
xor r15d, r15d
mov qword [rbp + 0x138], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x14c], xmm0
mov dword [rbp + 0x15c], r15d
mov r14d, 0x47
mov word [rbp + 0x140], r14w
mov dword [rbp + 0x144], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x148], eax
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp + 0x142], ax
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x138]
lea ecx, [r15 + 1]
call section..data
lea ecx, [r15 + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b327
lea ecx, [r15 + 0xc]
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1dc], xmm0
mov qword [rbp + 0x1f4], r15
mov dword [rbp + 0x1fc], r15d
mov dword [rbp + 0x1d8], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x1f0], eax
mov dword [rbp + 0x1ec], 4
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x1d8]
lea ecx, [r15 + 1]
call section..data
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b39c
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x204], xmm0
mov qword [rbp + 0x21c], r15
mov dword [rbp + 0x224], r15d
mov dword [rbp + 0x200], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x218], eax
mov dword [rbp + 0x214], 0x10
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
mov r8d, 0x28
lea rdx, [rbp + 0x200]
lea ecx, [r8 - 0x27]
call section..data
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0x160], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x174], xmm0
mov dword [rbp + 0x184], r15d
mov word [rbp + 0x168], r14w
mov dword [rbp + 0x16c], 2
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x170], eax
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp + 0x16a], ax
lea rdx, [rbp + 0x160]
jmp 0x18000b214
cmp byte [0x1803d4095], 0
je 0x18000b620
comisd xmm12, xmm6
jbe 0x18000b620
movss xmm0, dword [rsp + 0x30]
comiss xmm0, xmm11
jbe 0x18000b620
mov ebx, dword [rbp]
cmp ebx, 1
jne 0x18000b529
cmp esi, 0x74
mov ecx, 0xb9
je 0x18000b443
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18000b4b9
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x22c], xmm0
xor r15d, r15d
mov qword [rbp + 0x244], r15
mov dword [rbp + 0x24c], r15d
mov dword [rbp + 0x228], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x240], eax
mov dword [rbp + 0x23c], 4
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x228]
lea ecx, [r15 + 1]
call section..data
jmp 0x18000b623
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18000b529
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x254], xmm0
xor r15d, r15d
mov qword [rbp + 0x26c], r15
mov dword [rbp + 0x274], r15d
mov dword [rbp + 0x250], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x268], eax
mov dword [rbp + 0x264], 0x10
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x250]
lea ecx, [r15 + 1]
call section..data
jmp 0x18000b623
cmp dword [rbp + 4], 0xc
jne 0x18000b620
cmp r15d, 0x14
je 0x18000b620
cmp ebx, 1
je 0x18000b620
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18000b5b3
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x27c], xmm0
xor r15d, r15d
mov qword [rbp + 0x294], r15
mov dword [rbp + 0x29c], r15d
mov dword [rbp + 0x278], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x290], eax
mov dword [rbp + 0x28c], 4
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x278]
lea ecx, [r15 + 1]
call section..data
jmp 0x18000b623
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
xor r15d, r15d
test ax, ax
jns 0x18000b623
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2a4], xmm0
mov qword [rbp + 0x2bc], r15
mov dword [rbp + 0x2c4], r15d
mov dword [rbp + 0x2a0], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [rbp + 0x2b8], eax
mov dword [rbp + 0x2b4], 0x10
mov rax, qword [0x1803d4e60]
mov qword [0x1803d4e38], rax
lea r8d, [r15 + 0x28]
lea rdx, [rbp + 0x2a0]
lea ecx, [r15 + 1]
call section..data
jmp 0x18000b623
xor r15d, r15d
inc r12d
cmp r12d, dword [rbp - 0x30]
jb 0x18000aa60
jmp 0x18000b636
mov rdi, qword [rbp - 0x28]
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000b651
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x18000b66e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x2c8]
xor rcx, rsp
call fcn.18000ffc0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.180001900
nop
mov ecx, 0x80004005
call fcn.180001900
int3