Function at 0x14000a230
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x140049100]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14004c4a0], eax
jle 0x14000a2ee
lea rcx, [0x14004c4a0]
call fcn.1400113e4
cmp dword [0x14004c4a0], 0xffffffff
jne 0x14000a2ee
mov rax, qword [0x140049e98]
mov qword [0x14004c498], rax
lea rcx, [0x14004c4a0]
call fcn.140011378
xor al, al
mov byte [rsp + 0x40], al
movzx ecx, byte [0x14004c409]
movzx eax, cl
neg al
sbb ebx, ebx
and ebx, 5
test cl, cl
je 0x14000a381
mov edx, dword [0x14004c458]
sub edx, ebx
xor r9d, r9d
mov r8d, dword [0x14004c460]
mov rcx, qword [0x14004c478]
call qword [sym.imp.GDI32.dll_MoveToEx]
mov edx, dword [0x14004c458]
add edx, ebx
mov r8d, dword [0x14004c460]
mov rcx, qword [0x14004c478]
call qword [sym.imp.GDI32.dll_LineTo]
mov r8d, dword [0x14004c460]
sub r8d, ebx
xor r9d, r9d
mov edx, dword [0x14004c458]
mov rcx, qword [0x14004c478]
call qword [sym.imp.GDI32.dll_MoveToEx]
mov r8d, dword [0x14004c460]
add r8d, ebx
mov edx, dword [0x14004c458]
mov rcx, qword [0x14004c478]
call qword [sym.imp.GDI32.dll_LineTo]
mov ecx, 0x23
mov edx, 0x41
movzx eax, byte [0x14004c403]
test al, al
cmovne ecx, edx
jne 0x14000a3a2
cmp byte [0x14004c406], 0
je 0x14000a3d6
cmp byte [0x14004c402], 0
je 0x14000a3d6
mov r8d, dword [0x14004c460]
lea eax, [r8 + rcx]
mov edx, dword [0x14004c458]
lea r9d, [rdx + rcx]
sub r8d, ecx
sub edx, ecx
mov dword [rsp + 0x20], eax
mov rcx, qword [0x14004c478]
call qword [sym.imp.GDI32.dll_Ellipse]
mov rbx, qword [0x140049e90]
lea rsi, [rbx + 0x60]
mov r12d, 0x14
xor r14d, r14d
mov edi, 1
mov r13d, 0xa5ff
mov r15d, 0xff
movss xmm12, dword [0x140041a44]
mov qword [rsp + 0x58], rsi
cmp rbx, qword [0x140049e98]
jae 0x14000aa79
movss xmm2, dword [rsi - 4]
movss xmm4, dword [rsi - 8]
movss xmm3, dword [rsi]
movaps xmm9, xmm4
mulss xmm9, dword [0x140049ed8]
movaps xmm0, xmm2
mulss xmm0, dword [0x140049edc]
addss xmm9, xmm0
movaps xmm1, xmm3
mulss xmm1, dword [0x140049ee0]
addss xmm9, xmm1
addss xmm9, dword [0x140049ee4]
movss dword [rsp + 0x54], xmm9
movss xmm0, dword [0x140041a48]
divss xmm0, xmm9
mulss xmm4, dword [0x140049eb8]
mulss xmm2, dword [0x140049ebc]
addss xmm4, xmm2
mulss xmm3, dword [0x140049ec0]
addss xmm4, xmm3
addss xmm4, dword [0x140049ec4]
mulss xmm4, xmm0
xorps xmm14, xmm14
cvtsi2ss xmm14, dword [0x140049e6c]
movaps xmm15, xmm14
mulss xmm15, xmm12
mulss xmm4, xmm12
mulss xmm4, xmm14
movaps xmm0, xmm15
subss xmm0, xmm4
movss dword [rsp + 0x48], xmm0
movss xmm12, dword [rsi + 8]
movss xmm3, dword [rsi + 4]
movss xmm4, dword [rsi + 0xc]
movaps xmm2, xmm3
mulss xmm2, dword [0x140049ed8]
movaps xmm0, xmm12
mulss xmm0, dword [0x140049edc]
addss xmm2, xmm0
movaps xmm1, xmm4
mulss xmm1, dword [0x140049ee0]
addss xmm2, xmm1
addss xmm2, dword [0x140049ee4]
movss dword [rsp + 0x50], xmm2
movss xmm2, dword [0x140041a48]
movss xmm8, dword [rsp + 0x50]
divss xmm2, xmm8
movaps xmm7, xmm12
mulss xmm7, dword [0x140049eac]
movaps xmm0, xmm3
mulss xmm0, dword [0x140049ea8]
addss xmm7, xmm0
movaps xmm1, xmm4
mulss xmm1, dword [0x140049eb0]
addss xmm7, xmm1
addss xmm7, dword [0x140049eb4]
mulss xmm7, xmm2
mulss xmm12, dword [0x140049ebc]
mulss xmm3, dword [0x140049eb8]
addss xmm12, xmm3
mulss xmm4, dword [0x140049ec0]
addss xmm12, xmm4
addss xmm12, dword [0x140049ec4]
mulss xmm12, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [0x140049e68]
movss xmm10, dword [0x140041a44]
mulss xmm7, xmm10
mulss xmm7, xmm0
mulss xmm0, xmm10
addss xmm7, xmm0
mulss xmm12, xmm10
mulss xmm12, xmm14
subss xmm15, xmm12
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [0x14004c460]
movaps xmm1, xmm15
subss xmm1, xmm0
xorps xmm2, xmm2
cvtsi2ss xmm2, dword [0x14004c458]
movaps xmm0, xmm7
subss xmm0, xmm2
call fcn.140031e10
movaps xmm6, xmm0
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000a76e
movzx edx, byte [0x14004c403]
cmp byte [0x14004c406], 0
je 0x14000a62b
test dl, dl
jne 0x14000a76e
movss xmm0, dword [0x140041a64]
comiss xmm0, xmm6
ja 0x14000a644
jmp 0x14000a76e
test dl, dl
je 0x14000a76e
movss xmm0, dword [0x140041a70]
comiss xmm0, xmm6
jbe 0x14000a76e
mov rax, qword [0x14004c498]
cmp rax, qword [0x140049e98]
je 0x14000a65d
cmp rax, rbx
jne 0x14000a76e
mov qword [0x14004c498], rbx
mov byte [rsp + 0x40], 1
xorps xmm11, xmm11
comiss xmm7, xmm11
jb 0x14000a76e
comiss xmm15, xmm11
jb 0x14000a76e
comiss xmm8, xmm11
jb 0x14000a76e
movss xmm1, dword [0x140041a48]
test dl, dl
je 0x14000a6a1
movss xmm0, dword [0x140041a5c]
jmp 0x14000a6a4
movaps xmm0, xmm1
test dl, dl
je 0x14000a6b2
movss xmm3, dword [0x140041a40]
jmp 0x14000a6f4
movss xmm2, dword [0x140041a60]
movaps xmm3, xmm0
comiss xmm2, xmm6
jbe 0x14000a6c9
mulss xmm3, xmm10
jmp 0x14000a6e8
movss xmm2, dword [0x140041a68]
comiss xmm2, xmm6
jbe 0x14000a6e0
mulss xmm3, dword [0x140041a3c]
jmp 0x14000a6e8
mulss xmm3, dword [0x140041a34]
minss xmm3, xmm0
comiss xmm1, xmm3
jbe 0x14000a6f4
movaps xmm3, xmm1
movd xmm0, dword [0x14004c458]
cvtdq2ps xmm0, xmm0
movaps xmm2, xmm7
subss xmm2, xmm0
divss xmm2, xmm3
movd xmm0, dword [0x14004c460]
cvtdq2ps xmm0, xmm0
movaps xmm1, xmm15
subss xmm1, xmm0
divss xmm1, xmm3
mov ecx, 0xa
test dl, dl
cmovne ecx, r12d
mov qword [rbp - 0x80], 0
mov dword [rbp - 0x70], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
cvttss2si eax, xmm2
mov dword [rbp - 0x78], eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
cvttss2si eax, xmm0
mov dword [rbp - 0x74], eax
mov dword [rbp - 0x6c], edi
mov r8d, 0x28
lea rdx, [rbp - 0x80]
mov ecx, edi
call qword [sym.imp.USER32.dll_SendInput]
movss xmm0, dword [rsp + 0x54]
comiss xmm0, dword [0x140041a30]
jb 0x14000aa66
movss xmm8, dword [rsp + 0x48]
subss xmm8, xmm15
movaps xmm6, xmm8
divss xmm6, dword [0x140041a58]
cmp byte [0x140049d60], 0
je 0x14000a9c1
mov ecx, 0x3c
cmp byte [0x14004c40a], 0
cmovne ecx, r13d
cmp byte [0x14004c407], 0
mov eax, 0xff000a
cmovne ecx, eax
cvttss2si r8d, xmm15
movaps xmm9, xmm6
mulss xmm9, xmm10
cvttss2si eax, xmm8
cvttss2si r9d, xmm6
movaps xmm0, xmm7
subss xmm0, xmm9
cvttss2si edx, xmm0
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
call fcn.14000a150
movzx ecx, byte [rsi - 0x30]
movzx eax, cl
add al, al
add al, 0x37
movzx edi, al
or edi, 0x4b00
shl edi, 8
not cl
movzx eax, cl
or edi, eax
mov edx, dword [rsi - 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400026e0
mov rsi, rax
mov qword [rsp + 0x48], rax
cmp qword [rax + 0x18], 0xf
jbe 0x14000a83c
mov rsi, qword [rax]
mov qword [rsp + 0x48], rsi
mov r13, qword [0x14004c478]
movaps xmm0, xmm7
addss xmm0, xmm9
cvttss2si r12d, xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rbp - 0x58], xmm1
movups xmmword [rbp - 0x48], xmm1
movups xmmword [rbp - 0x38], xmm1
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x58], 0xfffffff6
mov dword [rbp - 0x48], 0x190
mov byte [rbp - 0x3e], 4
lea r8, str.Arial
mov edx, 0x20
lea rcx, [rbp - 0x3c]
call fcn.14001bf7c
lea rcx, [rbp - 0x58]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov r15, rax
mov rdx, rax
mov rcx, r13
call qword [sym.imp.GDI32.dll_SelectObject]
mov r14, rax
mov edx, edi
mov rcx, r13
call qword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov rdi, 0xffffffffffffffff
mov r9d, edi
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
mov eax, 2
mul rsi
cmovb rax, rdi
mov rcx, rax
call fcn.14001145c
mov rdi, rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0x48]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r9d, [rsi - 1]
mov dword [rsp + 0x20], r9d
mov r9, rdi
cvttss2si r8d, xmm15
mov edx, r12d
mov rcx, r13
call qword [sym.imp.GDI32.dll_TextOutW]
mov rcx, rdi
call fcn.1400110c0
mov rdx, r14
mov rcx, r13
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000a98f
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a98a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ab4c
call fcn.1400110c0
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], r14b
mov edi, 1
mov rsi, qword [rsp + 0x58]
mov r15d, 0xff
mov r12d, 0x14
mov r13d, 0xa5ff
cmp byte [0x14004c404], 0
je 0x14000aa12
movaps xmm1, xmm6
mulss xmm1, dword [0x140041a3c]
movaps xmm0, xmm8
mulss xmm0, dword [0x140041a38]
cvttss2si eax, xmm0
cvttss2si r9d, xmm1
cvttss2si r8d, xmm15
mulss xmm1, xmm10
movaps xmm0, xmm7
subss xmm0, xmm1
cvttss2si edx, xmm0
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.14000a150
cmp byte [0x14004c401], 0
je 0x14000aa66
mulss xmm6, dword [0x140041a34]
mulss xmm8, dword [0x140041a34]
cvttss2si eax, xmm8
cvttss2si r9d, xmm6
addss xmm15, dword [0x140041a60]
cvttss2si r8d, xmm15
mulss xmm6, xmm10
subss xmm7, xmm6
cvttss2si edx, xmm7
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0xc8c8c8
mov dword [rsp + 0x20], eax
call fcn.14000a150
add rbx, 0xb0
add rsi, 0xb0
jmp 0x14000a3fb
lea rcx, [rsp + 0x48]
cmp byte [rsp + 0x40], 0
jne 0x14000aa9f
mov rax, qword [0x140049e98]
mov qword [0x14004c498], rax
call fcn.14000a050
mov rax, qword [rsp + 0x48]
jmp 0x14000aaae
call fcn.14000a050
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
movabs rcx, 0x7fffffffffb3b4bf
cmp rax, rcx
je 0x14000aace
cmovl edi, r15d
test dil, dil
jns 0x14000aace
add rax, 0x4c4b40
jmp 0x14000aad8
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
call fcn.14000cab0
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400110a0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001b998
int3