Function at 0x1400439e0
Capabilities:
Create thread
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1370]
mov eax, 0x1470
call fcn.140055460
sub rsp, rax
movaps xmmword [rsp + 0x1460], xmm6
movaps xmmword [rsp + 0x1450], xmm7
movaps xmmword [rsp + 0x1440], xmm8
mov rax, qword [0x140129040]
xor rax, rsp
mov qword [rbp + 0x1330], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1406c5760], eax
mov esi, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1406c5754], eax
lea ecx, [rdi + 8]
call fcn.140054500
lea rcx, [0x140043340]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140044a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400440d4
cmp dword [rsp + 0x68], edi
je 0x1400440cb
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400440cb
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rdi + 8]
call fcn.140054500
lea rcx, [0x140042f60]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140044a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400440bb
cmp dword [rsp + 0x68], edi
je 0x1400440b2
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400440b2
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rdi + 8]
call fcn.140054500
lea rcx, [0x140042580]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140044a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400440a2
cmp dword [rsp + 0x68], edi
je 0x140044099
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140044099
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rdi + 8]
call fcn.140054500
lea rcx, [0x140041770]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140044a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140044089
cmp dword [rsp + 0x68], edi
je 0x140044080
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140044080
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rdi + 3]
lea rcx, str..Oykyo
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14066ad90], rax
test rax, rax
je 0x140043c7f
cmp rax, 0xffffffffffffffff
jne 0x140043cb5
call fcn.140004dd0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..Oykyo
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14066ad90], rax
cmp byte [0x14066ae6c], 0
je 0x14004401d
movabs r13, 0x7ffffffffff0bdbf
movabs r12, 0x7fffffffffffffff
movabs r14, 0x4e94914f0000
movabs r15, 0x431bde82d7b634db
movsd xmm8, qword [0x14011fdc8]
movss xmm7, dword [0x14011fe38]
mov ebx, 2
cmp byte [0x1406c8008], 0
je 0x140043f83
mov ecx, dword [0x14066adf4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140043f83
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbp + 0x1324], 0xffffffff
mov dword [rbp - 0x5c], eax
mov rcx, rsi
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rbp + rcx*4 - 0x5c], edx
inc rcx
cmp rcx, 0x270
jb 0x140043d40
mov dword [rbp - 0x60], 0x270
lea rcx, [0x1406c6b90]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x140044074
cmp dword [0x1406c6bdc], 0x7fffffff
je 0x14004405e
mov eax, dword [0x14066ae38]
mov dword [0x1406c5744], eax
movd xmm0, dword [0x1406c5750]
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
movd xmm0, dword [0x1406c5764]
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm6
ja 0x140043dda
xorps xmm0, xmm0
sqrtsd xmm0, xmm6
jmp 0x140043de2
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
minss xmm6, xmm7
lea rcx, [rsp + 0x48]
call fcn.140041330
mov rax, qword [rsp + 0x48]
sub rax, qword [0x1406c5758]
cmp rax, 0x4d3f640
jl 0x140043f76
movaps xmm0, xmm6
mulss xmm0, dword [0x14066ae60]
mov eax, dword [0x1406c5764]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
divss xmm1, xmm6
mulss xmm1, xmm0
mov ecx, dword [0x1406c5750]
movd xmm2, ecx
cvtdq2ps xmm2, xmm2
divss xmm2, xmm6
mulss xmm2, xmm0
test eax, eax
jne 0x140043e50
test ecx, ecx
je 0x140043f62
mov rcx, qword [0x14066ad90]
test rcx, rcx
je 0x140043ee3
cmp rcx, 0xffffffffffffffff
je 0x140043ea8
cvttss2si eax, xmm1
mov dword [rbp - 0x70], eax
cvttss2si eax, xmm2
mov dword [rbp - 0x6c], eax
mov word [rbp - 0x68], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rbp - 0x70]
mov edx, dword [0x14066ad88]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x14066ad90]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140043ee3
mov qword [rbp - 0x80], rdi
mov word [rbp - 0x78], si
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rbp - 0x80]
mov edx, dword [0x14066ad88]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbp - 0x60]
call fcn.140044780
mov ecx, eax
lea rax, [rcx + rcx*2]
test eax, eax
jne 0x140043f0a
lea rcx, [rbp - 0x60]
call fcn.140044780
mov ecx, eax
lea rax, [rcx + rcx*2]
cmp eax, 1
jb 0x140043ef6
shr rax, 0x20
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.1400441e0
mov rcx, qword [0x14066ad90]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140043f62
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x68], bx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rsp + 0x60]
mov edx, dword [0x14066ad88]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rsp + 0x58]
call fcn.140041330
mov rcx, qword [rax]
mov qword [0x1406c5758], rcx
lea rcx, [0x1406c6b90]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
lea rcx, [rsp + 0x70]
call fcn.140041330
mov rbx, qword [rsp + 0x70]
cmp rbx, r13
jge 0x140043fa0
add rbx, 0xf4240
jmp 0x140043fa3
mov rbx, r12
lea rcx, [rsp + 0x40]
call fcn.140041330
mov rax, qword [rsp + 0x40]
cmp rax, rbx
jge 0x140044010
nop word [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jl 0x140043fd2
mov ecx, 0x5265c00
jmp 0x140043ff7
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140043ff5
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x40]
call fcn.140041330
mov rax, qword [rsp + 0x40]
cmp rax, rbx
jl 0x140043fc0
cmp byte [0x14066ae6c], 0
jne 0x140043cfb
mov eax, esi
mov rcx, qword [rbp + 0x1330]
xor rcx, rsp
call fcn.1400543c0
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [0x1406c6bdc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3