Function at 0x14005a410
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x100
xor esi, esi
lea r8, [0x14005aaa0]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x14005be20]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x110]
call fcn.14005b2e0
lea rcx, [rsp + 0x118]
call fcn.14005b2e0
lea rcx, [rsp + 0x118]
call fcn.14005b2e0
cmp byte [0x14007b1d0], sil
je 0x14005aa95
mov eax, dword [0x14007b944]
mov ecx, dword [0x14007b958]
mov edx, dword [0x14007b954]
mov qword [rsp + 0x120], rbx
mov rbx, qword [rsp + 0x110]
mov qword [rsp + 0x128], rbp
lea ebp, [rsi + 1]
mov qword [rsp + 0xf0], r12
mov r12d, 0x1f40
mov qword [rsp + 0xe8], r14
lea r14d, [rsi + 2]
mov qword [rsp + 0xe0], r15
movabs r15, 0xb2f4fc0794908cf3
movaps xmmword [rsp + 0xb0], xmm8
movsd xmm8, qword [0x14006fd18]
movaps xmmword [rsp + 0xa0], xmm9
xorps xmm9, xmm9
movaps xmmword [rsp + 0x90], xmm10
movsd xmm10, qword [0x14006fd20]
movaps xmmword [rsp + 0x80], xmm11
movss xmm11, dword [0x14006fd3c]
movaps xmmword [rsp + 0x70], xmm12
movsd xmm12, qword [0x1400677e8]
mov qword [rsp + 0xf8], rdi
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm7
nop dword [rax]
cmp eax, ebp
jbe 0x14005a5b6
cmp eax, r14d
jne 0x14005a561
mov dword [0x14007b948], ebp
jmp 0x14005a5bd
cmp eax, 3
jne 0x14005a572
mov dword [0x14007b948], 5
jmp 0x14005a5bd
cmp eax, 4
jne 0x14005a583
mov dword [0x14007b948], 6
jmp 0x14005a5bd
cmp eax, 5
jne 0x14005a594
mov dword [0x14007b948], 0x10
jmp 0x14005a5bd
cmp eax, 6
jne 0x14005a5a5
mov dword [0x14007b948], 0x12
jmp 0x14005a5bd
cmp eax, 7
jne 0x14005a5bd
mov dword [0x14007b948], 0x45
jmp 0x14005a5bd
mov dword [0x14007b948], r14d
cmp ecx, ebp
jbe 0x14005a623
cmp ecx, r14d
jne 0x14005a5ce
mov dword [0x14007b94c], ebp
jmp 0x14005a62a
cmp ecx, 3
jne 0x14005a5df
mov dword [0x14007b94c], 5
jmp 0x14005a62a
cmp ecx, 4
jne 0x14005a5f0
mov dword [0x14007b94c], 6
jmp 0x14005a62a
cmp ecx, 5
jne 0x14005a601
mov dword [0x14007b94c], 0x10
jmp 0x14005a62a
cmp ecx, 6
jne 0x14005a612
mov dword [0x14007b94c], 0x12
jmp 0x14005a62a
cmp ecx, 7
jne 0x14005a62a
mov dword [0x14007b94c], 0x45
jmp 0x14005a62a
mov dword [0x14007b94c], r14d
cmp edx, ebp
jbe 0x14005a690
cmp edx, r14d
jne 0x14005a63b
mov dword [0x14007b950], ebp
jmp 0x14005a697
cmp edx, 3
jne 0x14005a64c
mov dword [0x14007b950], 5
jmp 0x14005a697
cmp edx, 4
jne 0x14005a65d
mov dword [0x14007b950], 6
jmp 0x14005a697
cmp edx, 5
jne 0x14005a66e
mov dword [0x14007b950], 0x10
jmp 0x14005a697
cmp edx, 6
jne 0x14005a67f
mov dword [0x14007b950], 0x12
jmp 0x14005a697
cmp edx, 7
jne 0x14005a697
mov dword [0x14007b950], 0x45
jmp 0x14005a697
mov dword [0x14007b950], r14d
cmp byte [0x14007b939], sil
jne 0x14005a6b6
cmp byte [0x14007b93d], sil
jne 0x14005a6b6
cmp byte [0x14007b93b], sil
je 0x14005aa1e
movss xmm0, dword [0x14007b1d4]
movaps xmm7, xmm12
cvtps2pd xmm0, xmm0
divsd xmm7, xmm0
call sub.MSVCP140.dll__Query_perf_frequency
mov rdi, rax
call sub.MSVCP140.dll__Query_perf_counter
mov rcx, rax
cmp rdi, 0x989680
jne 0x14005a6e8
imul rdx, rcx, 0x64
jmp 0x14005a75b
cmp rdi, 0x16e3600
jne 0x14005a73a
mov rax, r15
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r15
imul rcx, rcx, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, r8, 0x3b9aca00
jmp 0x14005a758
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
mov rdx, rax
imul rax, rcx, 0x3b9aca00
add rdx, rax
mov ecx, dword [0x14007b948]
sub rdx, rbx
cmp byte [0x14007b93a], sil
xorps xmm6, xmm6
cvtsi2sd xmm6, rdx
divsd xmm6, xmm10
je 0x14005a785
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jmp 0x14005a78f
call qword [sym.imp.USER32.dll_GetKeyState]
test r12w, ax
setne dil
cmp byte [0x14007b93b], sil
jne 0x14005a7a9
cmp byte [0x14007b93d], sil
je 0x14005a90d
comisd xmm6, xmm8
jbe 0x14005a90d
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
mov rcx, rax
cmp rbx, 0x989680
jne 0x14005a7d3
imul rbx, rcx, 0x64
jmp 0x14005a847
cmp rbx, 0x16e3600
jne 0x14005a826
mov rax, r15
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r15
imul rcx, rcx, 0x3b9aca00
imul rcx
lea rbx, [rcx + rdx]
sar rbx, 0x18
mov rax, rbx
shr rax, 0x3f
add rbx, rax
imul rax, r8, 0x3b9aca00
jmp 0x14005a844
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
call sub.MSVCP140.dll__Query_perf_frequency
call sub.MSVCP140.dll__Query_perf_counter
cmp byte [0x14007b93d], sil
je 0x14005a90d
cmp byte [0x14007b938], sil
je 0x14005a90d
mov ecx, dword [0x14007b94c]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14005a90d
mov ecx, dword [0x14007b960]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14007bb80]
cmp rcx, 0xffffffffffffffff
je 0x14005a90d
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov r9d, 0xc
mov dword [rsp + 0x28], esi
mov edx, 0x2676d8
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x48], bp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x14007bb80]
cmp rcx, 0xffffffffffffffff
je 0x14005a90d
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rsi
mov r9d, 0xc
mov dword [rsp + 0x28], esi
mov edx, 0x2676d8
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x58], r14w
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp byte [0x14007b939], sil
je 0x14005a9c7
test dil, dil
je 0x14005a9c7
comisd xmm6, xmm8
jbe 0x14005a9c7
lea rcx, [rsp + 0x110]
call fcn.14005b2e0
lea rcx, [rsp + 0x118]
mov rbx, qword [rax]
call fcn.14005b2e0
cmp byte [0x14007b93b], sil
mov eax, dword [0x14007b930]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm7
je 0x14005a974
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [0x14007b930]
test eax, eax
jne 0x14005a980
cmp dword [0x14007b934], esi
je 0x14005a9c7
mov rcx, qword [0x14007bb80]
cmp rcx, 0xffffffffffffffff
je 0x14005a9c7
cvttsd2si eax, xmm6
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
mov r9d, 0xc
mov dword [rsp + 0x28], esi
mov edx, 0x2676d8
mov word [rsp + 0x68], si
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp byte [0x14007b93b], sil
je 0x14005aa03
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14005aa03
movss xmm0, dword [0x14007b1e4]
movsd xmm2, qword [0x14007b978]
divss xmm0, xmm11
cvtps2pd xmm1, xmm0
addsd xmm2, xmm1
movsd qword [0x14007b978], xmm2
jmp 0x14005aa0c
movsd qword [0x14007b978], xmm9
mov edx, dword [0x14007b954]
mov ecx, dword [0x14007b958]
mov eax, dword [0x14007b944]
cmp byte [0x14007b1d0], sil
jne 0x14005a550
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm11, xmmword [rsp + 0x80]
movaps xmm10, xmmword [rsp + 0x90]
movaps xmm9, xmmword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm6, xmmword [rsp + 0xd0]
mov r15, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x120]
add rsp, 0x100
pop rsi
ret