Function at 0x140008890
Capabilities:
Create thread
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x140061040]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rbx, rcx
xor esi, esi
mov rax, qword [0x14014b0c8]
test rax, rax
je 0x1400088d7
mov rcx, qword [rax + 0xa0]
jmp 0x1400088da
mov rcx, rsi
cmp qword [rcx + 0x18], rsi
jne 0x1400088fb
test rax, rax
je 0x1400088fb
mov rcx, qword [rax + 0xa0]
test rcx, rcx
je 0x1400088fb
cmp qword [rcx], rsi
je 0x1400088fb
call fcn.140035770
call fcn.140036180
call fcn.1400119f0
cmp byte [0x14014b0b8], sil
jne 0x140008aaf
mov ecx, 1
call fcn.14004efa0
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14000b330]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140008c06
cmp dword [rbp - 0x38], 0
je 0x140008bfa
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140008bfa
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea ecx, [rax + 1]
call fcn.14004efa0
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14000b360]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140008beb
cmp dword [rbp - 0x38], 0
je 0x140008bdf
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140008bdf
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea ecx, [rax + 1]
call fcn.14004efa0
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14000b390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140008bd0
cmp dword [rbp - 0x38], 0
je 0x140008bc4
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140008bc4
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea ecx, [rax + 1]
call fcn.14004efa0
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14000b3c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140008bb5
cmp dword [rbp - 0x38], 0
je 0x140008ba9
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140008ba9
mov byte [0x14014b0b8], 1
call fcn.1400032f0
cmp qword [0x14014b1c8], 0
je 0x140008ac6
mov rcx, rax
call fcn.140003770
movss xmm6, dword [0x1400580a4]
cmp byte [0x1400610d0], 0
je 0x140008b91
mov rax, qword [0x14014b0c8]
mov rcx, qword [rax + 0x4878]
lea r8, str.Foreground
mov edx, 1
mov rcx, qword [rcx]
call fcn.140011030
mov rdi, rax
movd xmm2, dword [0x1400610b8]
cvtdq2ps xmm2, xmm2
mov ecx, dword [rbx + 0xe8]
xorps xmm0, xmm0
cvtsi2ss xmm0, rcx
movss dword [rbp - 0x30], xmm0
mov ecx, dword [rbx + 0xec]
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
movss dword [rbp - 0x2c], xmm1
movss xmm0, dword [0x14005806c]
comiss xmm0, xmm2
ja 0x140008b91
subss xmm2, xmm0
mov dword [rsp + 0x28], 0x1ff
movss xmm0, dword [0x140058124]
movss dword [rsp + 0x20], xmm0
xorps xmm3, xmm3
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.14002edd0
movss dword [rsp + 0x28], xmm6
mov dword [rsp + 0x20], 1
mov r9d, 0xffffffff
mov r8d, dword [rdi + 0x78]
mov rdx, qword [rdi + 0x80]
mov rcx, rdi
call fcn.14002d3a0
mov dword [rdi + 0x78], esi
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140008c15
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140008c34
cmp byte [rbx + 0x158], 0
sete al
mov byte [rbx + 0x158], al
cmp byte [rbx + 0x158], 0
je 0x140008c4d
mov rcx, rbx
call fcn.140045020
mov r8d, 0xa0
jmp 0x140008c53
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_SetWindowLongA]
movzx eax, byte [rbx + 0x158]
mov rcx, qword [0x14014b0c8]
mov byte [rcx + 0x78], al
movzx eax, byte [rbx + 0x158]
mov byte [rcx + 0xd9], al
call fcn.140013660
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0xae
call qword [rax + 0x1c8]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
mov dword [rsp + 0x30], esi
movss dword [rsp + 0x28], xmm6
mov dword [rsp + 0x20], esi
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140008d2c
call fcn.140013a20
mov rax, qword [0x14014b0c8]
mov rcx, qword [rax + 0x4878]
mov rcx, qword [rcx]
add rcx, 0x48
cmp byte [rcx], 0
cmove rcx, rsi
call fcn.1400351b0
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140008e03
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x140008e03
mov rdi, qword [0x14014b0c8]
test rdi, rdi
je 0x140008dcc
mov rdi, qword [rdi + 0xa0]
test rdi, rdi
je 0x140008dcc
cmp qword [rdi], 0
je 0x140008dcc
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140008d97
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi + 8], rsi
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140008daa
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi + 0x10], rsi
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140008dcc
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi + 0x18], rsi
mov rax, qword [0x14014b0c8]
mov rcx, qword [rax + 0x58]
mov qword [rcx + 8], rsi
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
lea rdx, [rbx + 0xa0]
call qword [rax + 0x80]
mov rax, qword [0x14014b0c8]
test rax, rax
je 0x140008e03
mov rax, qword [rax + 0xa0]
test rax, rax
je 0x140008e03
cmp qword [rax], 0
je 0x140008e03
call fcn.140035770
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.14004ef80
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [rsp + 0x70]
mov rsp, r11
pop rbp
ret