Function at 0x14003efa0
Capabilities:
Create thread
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x1350]
mov eax, 0x1450
call fcn.140052fa0
sub rsp, rax
movaps xmmword [rsp + 0x1440], xmm6
movaps xmmword [rsp + 0x1430], xmm7
movaps xmmword [rsp + 0x1420], xmm8
mov rax, qword [0x140126010]
xor rax, rsp
mov qword [rbp + 0x1310], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140128564], eax
mov esi, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x140128560], eax
lea ecx, [rdi + 8]
call fcn.140052030
lea rcx, [0x14003e9b0]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400400b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14003f65f
cmp dword [rsp + 0x48], edi
je 0x14003f656
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003f656
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea ecx, [rdi + 8]
call fcn.140052030
lea rcx, [0x14003e550]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400400b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14003f646
cmp dword [rsp + 0x48], edi
je 0x14003f63d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003f63d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea ecx, [rdi + 8]
call fcn.140052030
lea rcx, [0x14003db80]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400400b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14003f62d
cmp dword [rsp + 0x48], edi
je 0x14003f624
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003f624
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea ecx, [rdi + 8]
call fcn.140052030
lea rcx, [0x14003cec0]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400400b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14003f614
cmp dword [rsp + 0x48], edi
je 0x14003f60b
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003f60b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rdi + 3]
lea rcx, str..Oykyo
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140126b90], rax
test rax, rax
je 0x14003f244
cmp rax, 0xffffffffffffffff
jne 0x14003f27a
call fcn.140002570
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..Oykyo
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140126b90], rax
cmp byte [0x1401260e4], 0
je 0x14003f5ac
mov r14d, 2
movsd xmm7, qword [0x14011cd10]
movss xmm8, dword [0x14011cd80]
nop
cmp byte [0x14012ae18], 0
je 0x14003f590
mov ecx, dword [0x14012606c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f590
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbp + 0x1304], 0xffffffff
mov dword [rbp - 0x7c], eax
mov rcx, rsi
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rbp + rcx*4 - 0x7c], edx
inc rcx
cmp rcx, 0x270
jb 0x14003f2e0
mov dword [rbp - 0x80], 0x270
lea rcx, [0x1401299a0]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14003f5ff
cmp dword [0x1401299ec], 0x7fffffff
je 0x14003f5e9
mov eax, dword [0x1401260b0]
mov dword [0x140128550], eax
movd xmm0, dword [0x140128554]
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
movd xmm0, dword [0x140128568]
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm6
ja 0x14003f378
xorps xmm0, xmm0
sqrtsd xmm0, xmm6
jmp 0x14003f380
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
minss xmm6, xmm8
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003f3aa
imul rax, rax, 0x64
jmp 0x14003f3c8
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
sub rax, qword [0x140128558]
cmp rax, 0x4d3f640
jl 0x14003f583
movaps xmm0, xmm6
mulss xmm0, dword [0x1401260d8]
mov eax, dword [0x140128568]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
divss xmm1, xmm6
mulss xmm1, xmm0
mov ecx, dword [0x140128554]
movd xmm2, ecx
cvtdq2ps xmm2, xmm2
divss xmm2, xmm6
mulss xmm2, xmm0
test eax, eax
jne 0x14003f41c
test ecx, ecx
je 0x14003f53d
mov rcx, qword [0x140126b90]
test rcx, rcx
je 0x14003f4b6
cmp rcx, 0xffffffffffffffff
je 0x14003f478
cvttss2si eax, xmm1
mov dword [rsp + 0x70], eax
cvttss2si eax, xmm2
mov dword [rsp + 0x74], eax
mov word [rsp + 0x78], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rsp + 0x70]
mov edx, dword [0x140126b88]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x140126b90]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003f4b6
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x68], si
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rsp + 0x60]
mov edx, dword [0x140126b88]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbp - 0x80]
call fcn.14003fdb0
mov ecx, eax
lea rax, [rcx + rcx*2]
test eax, eax
jne 0x14003f4e4
nop dword [rax]
lea rcx, [rbp - 0x80]
call fcn.14003fdb0
mov ecx, eax
lea rax, [rcx + rcx*2]
cmp eax, 1
jb 0x14003f4d0
shr rax, 0x20
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.14003f760
mov rcx, qword [0x140126b90]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003f53d
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x48], r14w
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rsp + 0x40]
mov edx, dword [0x140126b88]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003f55b
imul rdx, rax, 0x64
jmp 0x14003f57c
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rdx, rax
imul rax, rcx, 0x3b9aca00
add rdx, rax
mov qword [0x140128558], rdx
lea rcx, [0x1401299a0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x50]
call fcn.14003f760
cmp byte [0x1401260e4], 0
jne 0x14003f2a0
mov eax, esi
mov rcx, qword [rbp + 0x1310]
xor rcx, rsp
call fcn.140051ef0
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rbp
ret
mov dword [0x1401299ec], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3