Function at 0x1400295a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x14010a040]
xor rax, rsp
mov qword [rbp - 9], rax
cmp byte [0x140170364], 0
jne 0x1400295f3
call fcn.140032250
test eax, eax
jne 0x1400295ec
xor r9d, r9d
lea r8, str.LavenderPremium
lea rdx, str.failed_to_find_ghub_application._Re_install_GHub_2021_version_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140029ab6
mov byte [0x140170364], 1
mov rcx, qword [0x1401702b8]
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], rsi
xor esi, esi
test rcx, rcx
je 0x140029646
cmp dword [0x1401702b0], esi
je 0x140029646
mov rdx, qword [0x140170650]
lea r8, [rbp - 0x49]
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1401702b8]
test eax, eax
je 0x140029646
mov rdx, qword [rbp - 0x49]
jmp 0x14002964d
mov rdx, rsi
mov qword [rbp - 0x49], rdx
test rcx, rcx
je 0x14002967d
cmp dword [0x1401702b0], esi
je 0x14002967d
add rdx, 8
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14002967d
mov rbx, qword [rbp - 0x39]
jmp 0x140029684
mov rbx, rsi
mov qword [rbp - 0x39], rbx
test rbx, rbx
je 0x140029aa6
cmp byte [0x14016f07c], sil
je 0x140029aa6
mov eax, dword [0x14016f090]
mov qword [rsp + 0x110], rdi
test eax, eax
jne 0x1400296b4
mov dword [0x140170360], esi
jmp 0x140029707
cmp eax, 1
jne 0x1400296c5
mov dword [0x140170360], 7
jmp 0x140029707
cmp eax, 2
jne 0x1400296d6
mov dword [0x140170360], 6
jmp 0x140029707
cmp eax, 3
jne 0x1400296e7
mov dword [0x140170360], 5
jmp 0x140029707
cmp eax, 4
jne 0x1400296f8
mov dword [0x140170360], 3
jmp 0x140029707
cmp eax, 5
jne 0x140029707
mov dword [0x140170360], 4
lea rcx, [0x1401705b0]
call fcn.140029130
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test rdi, rdi
je 0x140029a9e
mov rcx, qword [0x1401702b8]
test rcx, rcx
je 0x14002976d
cmp dword [0x1401702b0], esi
je 0x14002976d
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], rsi
mov r9d, ntohs
lea r8, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1401702b8]
test eax, eax
jne 0x140029771
mov qword [rbp - 0x29], rsi
test rcx, rcx
je 0x14002979e
cmp dword [0x1401702b0], esi
je 0x14002979e
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], rsi
mov r9d, ntohs
lea r8, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1400297a2
mov qword [rbp - 0x19], rsi
movss xmm0, dword [rbp - 0x21]
subss xmm0, dword [rbp - 0x11]
movss xmm1, dword [rbp - 0x29]
movss xmm2, dword [rbp - 0x25]
subss xmm2, dword [rbp - 0x15]
subss xmm1, dword [rbp - 0x19]
mulss xmm0, xmm0
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x1400297e5
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x1400297ed
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
movd xmm0, dword [0x14016f088]
cvtdq2pd xmm0, xmm0
comisd xmm0, xmm1
jb 0x140029a9e
mov r8d, dword [0x140170360]
lea rcx, [rbp - 0x39]
movaps xmmword [rsp + 0xe0], xmm6
mov rdx, rdi
movaps xmmword [rsp + 0xd0], xmm7
movaps xmmword [rsp + 0xc0], xmm8
movaps xmmword [rsp + 0xb0], xmm9
movaps xmmword [rsp + 0xa0], xmm10
call fcn.140020c30
movsd xmm0, qword [rbp - 0x39]
lea r8, [rbp - 0x49]
mov eax, dword [rbp - 0x31]
lea rdx, [rbp - 0x39]
lea rcx, [0x1401705b0]
movsd qword [rbp - 0x49], xmm0
mov dword [rbp - 0x41], eax
call fcn.140028f00
movss xmm10, dword [0x14016f084]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 1
sub eax, edx
sar eax, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm8, dword [rbp - 0x35]
cdq
sub eax, edx
sar eax, 1
cvtps2pd xmm0, xmm8
mov edi, eax
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
movsd xmm1, qword [0x1400f7d68]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movss xmm9, dword [rbp - 0x39]
movaps xmm7, xmm0
movsd xmm1, qword [0x1400f7d68]
movd xmm2, ebx
cvtdq2pd xmm2, xmm2
cvtps2pd xmm0, xmm9
subsd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
ucomiss xmm1, xmm0
ja 0x1400298fb
xorps xmm4, xmm4
sqrtss xmm4, xmm0
jmp 0x140029903
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm4, xmm0
movss xmm5, dword [0x1400f8480]
xorps xmm2, xmm2
ucomiss xmm9, xmm2
xorps xmm7, xmm7
xorps xmm6, xmm6
jp 0x14002991c
je 0x140029971
movd xmm3, ebx
cvtdq2ps xmm3, xmm3
comiss xmm9, xmm3
jbe 0x140029952
movaps xmm7, xmm3
lea eax, [rbx + rbx]
subss xmm7, xmm9
movd xmm0, eax
movaps xmm1, xmm3
cvtdq2ps xmm0, xmm0
xorps xmm7, xmm5
divss xmm7, xmm10
addss xmm1, xmm7
comiss xmm1, xmm0
jbe 0x140029952
xorps xmm7, xmm7
comiss xmm3, xmm9
jbe 0x140029971
movaps xmm7, xmm9
subss xmm7, xmm3
divss xmm7, xmm10
addss xmm3, xmm7
comiss xmm2, xmm3
jbe 0x140029971
xorps xmm7, xmm7
ucomiss xmm8, xmm2
movaps xmm9, xmmword [rsp + 0xb0]
jp 0x140029982
je 0x1400299d7
movd xmm3, edi
cvtdq2ps xmm3, xmm3
comiss xmm8, xmm3
jbe 0x1400299b8
movaps xmm6, xmm3
lea eax, [rdi + rdi]
subss xmm6, xmm8
movd xmm0, eax
movaps xmm1, xmm3
cvtdq2ps xmm0, xmm0
xorps xmm6, xmm5
divss xmm6, xmm10
addss xmm1, xmm6
comiss xmm1, xmm0
jbe 0x1400299b8
xorps xmm6, xmm6
comiss xmm3, xmm8
jbe 0x1400299d7
movaps xmm6, xmm8
subss xmm6, xmm3
divss xmm6, xmm10
addss xmm3, xmm6
comiss xmm2, xmm3
jbe 0x1400299d7
xorps xmm6, xmm6
movd xmm0, dword [0x14016f080]
xorps xmm1, xmm1
movaps xmm10, xmmword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0xc0]
cvtdq2pd xmm0, xmm0
cvtss2sd xmm1, xmm4
addsd xmm0, qword [0x1400f7d48]
comisd xmm0, xmm1
jb 0x140029a8e
mov ecx, dword [0x14016f094]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140029a8e
mov rcx, qword [0x140170368]
xor r9d, r9d
mov dword [rsp + 0x48], esi
xor r8d, r8d
cvttss2si eax, xmm7
mov qword [rsp + 0x40], rsi
xor edx, edx
mov dword [rsp + 0x38], 5
mov word [rbp - 0x46], si
mov byte [rbp - 0x49], sil
mov byte [rbp - 0x48], al
cvttss2si eax, xmm6
mov byte [rbp - 0x47], al
lea rax, [rbp - 0x49]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x39]
mov dword [rsp + 0x28], 0x2a2010
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
je 0x140029a8e
cmp qword [0x140170368], rsi
je 0x140029a89
mov qword [0x140170368], rsi
call fcn.140032250
movaps xmm6, xmmword [rsp + 0xe0]
movaps xmm7, xmmword [rsp + 0xd0]
mov rdi, qword [rsp + 0x110]
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x108]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140094c50
add rsp, 0xf0
pop rbp
ret