Function at 0x140007630
Capabilities:
Check for foreground window switch
Check for unmoving mouse cursor
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x13a8]
mov eax, 0x14a8
call fcn.1400ede50
sub rsp, rax
call fcn.140002970
mov ecx, 0xfffffff5
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
mov ecx, dword [rdi + 0x914]
test ecx, ecx
je 0x140007699
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140007699
cmp byte [rdi + 0x8cf], 0
mov ecx, 0x64
sete al
mov byte [rdi + 0x8cf], al
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rdi + 0x8cf], 0
mov qword [rsp + 0x1480], r14
je 0x140007f9e
cmp byte [rdi + 0x8d1], 0
movabs r14, 0x7fffffffffffffff
mov qword [rsp + 0x1490], r12
mov qword [rsp + 0x1488], r13
je 0x140007726
xorps xmm0, xmm0
mov dword [rsp + 0x30], Ordinal_27
xor eax, eax
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x34], xmm0
mov dword [rsp + 0x44], eax
call qword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x140007719
xor edx, edx
cmp dword [rsp + 0x38], 0x186a0
mov ecx, edx
setl cl
cmp dword [rsp + 0x38], 0xc350
setg dl
test edx, ecx
je 0x140007726
jmp 0x140007ea0
cmp byte [rbp + 0x13c0], 0
jne 0x140007ea0
mov qword [rsp + 0x14a0], rbx
movaps xmmword [rsp + 0x1460], xmm6
movaps xmmword [rsp + 0x1450], xmm7
movaps xmmword [rsp + 0x1440], xmm8
movaps xmmword [rsp + 0x1430], xmm9
movaps xmmword [rsp + 0x1420], xmm10
movaps xmmword [rsp + 0x1410], xmm11
call fcn.140006670
movd xmm10, eax
cvtdq2ps xmm10, xmm10
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x12f4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x74], eax
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x74], eax
inc rdx
cmp rdx, 0x270
jb 0x140007790
movsd xmm11, qword [0x140138220]
xorps xmm8, xmm8
movsd xmm9, qword [0x1401382d0]
movaps xmm7, xmm11
mov dword [rsp + 0x70], 0x270
xorps xmm6, xmm6
mov ebx, 2
nop dword [rax]
lea rcx, [rsp + 0x70]
call fcn.14002efb0
mov eax, eax
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
subsd xmm0, xmm8
mulsd xmm0, xmm7
mulsd xmm7, xmm9
addsd xmm6, xmm0
sub rbx, 1
jne 0x1400077e0
mov ecx, dword [reloc.WS2_32.dll_bind]
xorps xmm0, xmm0
mov qword [rsp + 0x1478], r15
divsd xmm6, xmm7
cvtss2sd xmm0, xmm10
mulsd xmm6, qword [0x140138218]
addsd xmm6, qword [0x140138228]
mulsd xmm6, xmm0
cvtsd2ss xmm6, xmm6
cmp ecx, 6
jne 0x140007c8e
lea ecx, [rbx + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r15d, 0x8001
test r15w, ax
je 0x140007e5c
cmp byte [rdi + 0x8cf], bl
je 0x140007e5c
lea rcx, [rbp + 0x13c0]
call qword [sym.imp.USER32.dll_GetCursorPos]
movabs rcx, 0x60f8da218bfbc6dc
movabs rax, 0xd775c5dc6d3bb017
mov qword [rbp + 0x13c8], rax
xor edx, edx
mov rax, qword [rbp + 0x13c8]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x13c8], rcx
mov rax, qword [rbp + 0x13c8]
mov qword [rsp + 0x28], rax
movabs rax, 0xd775c5902a71e75b
mov qword [rbp + 0x13c8], rax
mov rax, qword [rbp + 0x13c8]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x13c8], rcx
lea rcx, [rsp + 0x20]
mov rax, qword [rbp + 0x13c8]
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_FindWindowA]
mov r12, qword [rdi + 0x8d8]
mov r13, rax
mov rax, qword [rdi + 0x8e0]
mov qword [rbp + 0x13c8], rax
cmp r12, rax
je 0x140007e5c
movsd xmm10, qword [0x140138208]
movaps xmmword [rsp + 0x1400], xmm12
movsd xmm12, qword [0x140138230]
mov qword [rsp + 0x1498], rsi
nop word [rax + rax]
cmp byte [rdi + 0x91d], 0
je 0x140007afc
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140007ae8
test r13, r13
je 0x140007ae8
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx esi, ax
and si, r15w
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x12f4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x74], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x74], eax
inc rdx
cmp rdx, 0x270
jb 0x1400079b0
mov dword [rsp + 0x70], 0x270
movaps xmm6, xmm8
movaps xmm7, xmm11
mov ebx, 2
lea rcx, [rsp + 0x70]
call fcn.14002efb0
mov eax, eax
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
subsd xmm0, xmm8
mulsd xmm0, xmm7
mulsd xmm7, xmm9
addsd xmm6, xmm0
sub rbx, 1
jne 0x1400079e4
divsd xmm6, xmm7
mulsd xmm6, xmm10
addsd xmm6, xmm12
cvttsd2si ebx, xmm6
test si, si
je 0x140007ae8
movzx r9d, word [rbp + 0x13c4]
mov edx, 0x201
movzx eax, word [rbp + 0x13c0]
mov r8d, 1
shl r9d, 0x10
mov rcx, r13
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageA]
movzx r9d, word [rbp + 0x13c4]
xor r8d, r8d
movzx eax, word [rbp + 0x13c0]
mov edx, 0x202
shl r9d, 0x10
mov rcx, r13
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageA]
imul eax, ebx, 0x514
lea rcx, [rbp + 0x13d8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [r12]
cvttsd2si rbx, xmm0
mov ebx, ebx
call fcn.140005490
mov rax, qword [rbp + 0x13d8]
mov qword [rbp + 0x13d0], rax
test rbx, rbx
je 0x140007adc
imul rdx, rbx, 0xf4240
mov rcx, r14
sub rcx, rdx
cmp rax, rcx
jge 0x140007ad5
lea rcx, [rdx + rax]
mov qword [rbp + 0x13d0], rcx
jmp 0x140007adc
mov qword [rbp + 0x13d0], r14
lea rcx, [rbp + 0x13d0]
call fcn.14002aff0
cmp byte [rdi + 0x91d], 0
mov rax, qword [rbp + 0x13c8]
jne 0x140007c6b
test r13, r13
je 0x140007c6b
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx esi, ax
and si, r15w
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x12f4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x74], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x74], eax
inc rdx
cmp rdx, 0x270
jb 0x140007b30
mov dword [rsp + 0x70], 0x270
movaps xmm6, xmm8
movaps xmm7, xmm11
mov ebx, 2
lea rcx, [rsp + 0x70]
call fcn.14002efb0
mov eax, eax
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
subsd xmm0, xmm8
mulsd xmm0, xmm7
mulsd xmm7, xmm9
addsd xmm6, xmm0
sub rbx, 1
jne 0x140007b64
divsd xmm6, xmm7
mulsd xmm6, xmm10
addsd xmm6, xmm12
cvttsd2si ebx, xmm6
test si, si
je 0x140007c64
movzx r9d, word [rbp + 0x13c4]
mov edx, 0x201
movzx eax, word [rbp + 0x13c0]
mov r8d, 1
shl r9d, 0x10
mov rcx, r13
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageA]
movzx r9d, word [rbp + 0x13c4]
xor r8d, r8d
movzx eax, word [rbp + 0x13c0]
mov edx, 0x202
shl r9d, 0x10
mov rcx, r13
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageA]
imul eax, ebx, 0x514
lea rcx, [rsp + 0x50]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [r12]
cvttsd2si rbx, xmm0
mov ebx, ebx
call fcn.140005490
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x13d0], rax
test rbx, rbx
je 0x140007c58
imul rdx, rbx, 0xf4240
mov rcx, r14
sub rcx, rdx
cmp rax, rcx
jge 0x140007c51
lea rcx, [rdx + rax]
mov qword [rbp + 0x13d0], rcx
jmp 0x140007c58
mov qword [rbp + 0x13d0], r14
lea rcx, [rbp + 0x13d0]
call fcn.14002aff0
mov rax, qword [rbp + 0x13c8]
add r12, 8
cmp r12, rax
jne 0x140007950
movaps xmm12, xmmword [rsp + 0x1400]
mov rsi, qword [rsp + 0x1498]
jmp 0x140007e5c
movzx eax, byte [rdi + 0x91d]
cmp ecx, 5
jne 0x140007d21
test al, al
je 0x140007cc3
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140007e5c
cmp byte [rdi + 0x8cb], 0
je 0x140007e5c
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r15d, 0x8001
test r15w, ax
je 0x140007d15
cmp byte [rdi + 0x8c8], 0
jne 0x140007e5c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, reloc.WS2_32.dll_sendto
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [rdi + 0x8f4]
mov rcx, rbx
call fcn.140007590
mov byte [rdi + 0x8c8], 1
jmp 0x140007e5c
mov byte [rdi + 0x8c8], 0
jmp 0x140007e5c
test al, al
je 0x140007ee4
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140007e5c
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140007e5c
cmp byte [rdi + 0x8cb], 0
je 0x140007deb
movabs rcx, 0x60f8da218bfbc6dc
movabs rax, 0xd775c5dc6d3bb017
mov qword [rbp + 0x13c8], rax
xor edx, edx
mov rax, qword [rbp + 0x13c8]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x13c8], rcx
mov rax, qword [rbp + 0x13c8]
mov qword [rsp + 0x28], rax
movabs rax, 0xd775c5902a71e75b
mov qword [rbp + 0x13c8], rax
mov rax, qword [rbp + 0x13c8]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x13c8], rcx
lea rcx, [rsp + 0x20]
mov rax, qword [rbp + 0x13c8]
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140007e5c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
lea rcx, [rbp + 0x13c0]
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rbp + 0x13c4]
mov r8d, 1
movzx ecx, word [rbp + 0x13c0]
mov edx, 0x201
shl r9d, 0x10
or r9, rcx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
movzx r9d, word [rbp + 0x13c4]
xor r8d, r8d
movzx eax, word [rbp + 0x13c0]
mov edx, 0x202
shl r9d, 0x10
mov rcx, rbx
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageA]
cvttss2si ecx, xmm6
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r15, qword [rsp + 0x1478]
movaps xmm9, xmmword [rsp + 0x1430]
movaps xmm8, xmmword [rsp + 0x1440]
movaps xmm7, xmmword [rsp + 0x1450]
movaps xmm6, xmmword [rsp + 0x1460]
movaps xmm10, xmmword [rsp + 0x1420]
mov rbx, qword [rsp + 0x14a0]
movaps xmm11, xmmword [rsp + 0x1410]
lea rcx, [rsp + 0x58]
call fcn.140005490
mov rax, qword [rsp + 0x58]
movabs rcx, 0x7fffffffff1b1e3f
mov r13, qword [rsp + 0x1488]
mov r12, qword [rsp + 0x1490]
cmp rax, rcx
jge 0x140007fd9
add rax, 0xe4e1c0
mov qword [rbp + 0x13c0], rax
jmp 0x140007fe0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140007e5c
cmp byte [rdi + 0x8cb], 0
je 0x140007deb
movabs rcx, 0x60f8da218bfbc6dc
movabs rax, 0xd775c5dc6d3bb017
mov qword [rbp + 0x13c8], rax
xor edx, edx
mov rax, qword [rbp + 0x13c8]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x13c8], rcx
mov rax, qword [rbp + 0x13c8]
mov qword [rsp + 0x28], rax
movabs rax, 0xd775c5902a71e75b
mov qword [rbp + 0x13c8], rax
mov rax, qword [rbp + 0x13c8]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x13c8], rcx
lea rcx, [rsp + 0x20]
mov rax, qword [rbp + 0x13c8]
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
test rax, rax
je 0x140007e5c
jmp 0x140007df4
lea rcx, [rbp + 0x13c0]
call fcn.140005490
mov rax, qword [rbp + 0x13c0]
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
jge 0x140007fcf
add rax, 0x3b9aca00
mov qword [rbp + 0x13c0], rax
jmp 0x140007fe0
movabs r14, 0x7fffffffffffffff
mov qword [rbp + 0x13c0], r14
lea rcx, [rbp + 0x13c0]
call fcn.14002aff0
mov r14, qword [rsp + 0x1480]
mov al, 1
add rsp, 0x14a8
pop rdi
pop rbp
ret