Function at 0x140001250
Capabilities:
Capture screenshot
Create thread
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xb8], rax
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xa0], xmm1
mov qword [rsp + 0xb0], rax
movsd xmm12, qword [0x140003408]
movsd xmm8, qword [0x140003400]
movsd xmm10, qword [0x140003418]
movsd xmm11, qword [0x140003410]
movsd xmm9, qword [str.PERT]
mov r13d, dword [rsp + 0x50]
movaps xmm6, xmm12
movaps xmm7, xmm8
mov ecx, 5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400015af
mov rbx, qword [0x140005700]
mov qword [rsp + 0x58], rbx
mov rdi, qword [0x140005710]
mov qword [rsp + 0x58], rdi
mov rcx, qword [0x140005718]
call qword [sym.imp.USER32.dll_GetDC]
mov r12, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r15, rax
mov rcx, rdi
shr rcx, 0x20
mov rdx, rbx
shr rdx, 0x20
sub edx, ecx
mov ebp, edx
neg ebp
cmovs ebp, edx
sub ebx, edi
mov esi, ebx
neg esi
cmovs esi, ebx
mov r8d, ebp
mov edx, esi
mov rcx, r12
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r14, rax
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbx, rax
mov dword [rsp + 0x40], 0xcc0020
mov ecx, dword [rsp + 0x5c]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebp
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x7d000
call fcn.1400017e4
mov rbp, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x78], 0x28
mov dword [rsp + 0x84], 0x200001
mov dword [rsp + 0x7c], 0x190
mov dword [rsp + 0x80], 0xfffffec0
xor eax, eax
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r9d, 0x140
xor r8d, r8d
mov rdx, r14
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r12
mov rcx, qword [0x140005718]
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
xor sil, sil
xor r14d, r14d
mov ebx, r14d
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
mulsd xmm0, xmm7
addsd xmm0, xmm10
cvttsd2si edi, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
mulsd xmm0, xmm7
addsd xmm0, xmm11
cvttsd2si eax, xmm0
mov r8d, ebx
and r8d, 0x8000000f
jge 0x140001496
dec r8d
or r8d, 0xfffffff0
inc r8d
test r8d, r8d
jne 0x1400014a0
addsd xmm7, xmm8
addsd xmm6, xmm9
cmp edi, 0x18f
ja 0x1400015a7
cmp eax, 0x13f
ja 0x1400015a7
imul r9d, eax, 0x190
add r9d, edi
movsxd rax, r9d
mov edx, dword [rbp + rax*4]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx r10d, al
movzx r11d, dl
lea eax, [rcx - 1]
cmp eax, 0x4f
ja 0x14000152b
lea eax, [r10 - 0x79]
cmp eax, 0x85
ja 0x14000152b
lea eax, [r11 - 1]
cmp eax, 0x4f
ja 0x14000152b
mov eax, 0x51eb851f
imul r9d
mov r13d, edx
sar r13d, 7
mov eax, r13d
shr eax, 0x1f
add r13d, eax
imul eax, r13d, 0x190
mov ecx, r9d
sub ecx, eax
mov dword [rsp + 0x50], ecx
mov sil, 1
jmp 0x14000152f
mov ecx, dword [rsp + 0x50]
test r8d, r8d
jne 0x140001539
test sil, sil
jne 0x140001549
inc ebx
cmp ebx, 0x1900
jl 0x140001456
jmp 0x1400015a7
lea ebx, [rcx - 0xc8]
lea edi, [r13 - 0xa0]
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, edi
mov edx, ebx
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 5
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 8
jae 0x1400015a7
cmp ebx, 3
jge 0x1400015a7
cmp edi, 3
jge 0x1400015a7
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x1400011f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rbp
call fcn.1400017a0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400012f0