Function at 0x14004a3c0
Capabilities:
Check for foreground window switch
Check for unmoving mouse cursor
Enumerate gui resources
Log keystrokes via polling
Terminate process

Disassembly:
mov r11, rsp
push rbp
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xa8
movaps xmmword [r11 - 0x28], xmm6
mov rax, qword [0x14007f010]
xor rax, rsp
mov qword [rbp + 0x27], rax
movss xmm6, dword [0x1400749d4]
xorps xmm0, xmm0
mov qword [r11 + 8], rbx
xor r15d, r15d
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x18], r14
movups xmmword [0x14007fc98], xmm0
movups xmmword [0x14007fca8], xmm0
movups xmmword [0x14007fcb8], xmm0
nop word [rax + rax]
mov rdx, qword [0x14007fcc8]
lea rcx, [0x14007fc98]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14004a460
lea rcx, [0x14007fc98]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x14007fc98]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp qword [0x14007fc90], r15
je 0x14004ab3c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x14007fc90]
jne 0x14004a4b4
mov edx, 3
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov rcx, qword [0x14007fcc8]
xor r9d, r9d
mov dword [rsp + 0x30], 3
mov rdx, rax
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14004a503
mov rax, qword [0x14007fce0]
lea rdx, [rbp - 9]
mov qword [rbp - 9], r15
mov ecx, dword [rax + 8]
mov dword [rbp - 1], ecx
lea rcx, [0x14004a350]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x14004a4ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14004a4ee
mov rax, qword [rbp - 9]
test rax, rax
jne 0x14004a4f1
mov rax, r15
mov ecx, 0xfa
mov qword [0x14007fc90], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [0x14007fc20]
lea rcx, [rbp + 0x17]
mov dword [rbx + 0x18], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rbp + 0x17]
mov ecx, 1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe08], xmm0
movd xmm1, dword [rbp + 0x1b]
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0xe0c], xmm1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14004a567
mov byte [rbx + 0xe10], 1
mov eax, dword [rbx + 0xe0c]
mov dword [rbx + 0x36f8], eax
mov byte [rbx + 0x3748], 1
jmp 0x14004a56e
mov byte [rbx + 0xe10], r15b
cmp dword [0x14007fe78], r15d
jne 0x14004a592
cmp dword [0x14007fe80], r15d
jne 0x14004a592
cmp dword [0x14007fe7c], r15d
jne 0x14004a592
cmp dword [0x14007fe84], r15d
je 0x14004a5f0
mov rcx, qword [0x14007fcc8]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 8
xor r9d, r9d
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
movdqu xmmword [0x14007fe78], xmm0
mov dword [0x14007fe8c], r15d
mov dword [0x14007fe94], r15d
mov qword [0x14007fc40], r15
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14007fc38]
lea rdx, [0x14007fc40]
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rbx, qword [0x14007fc20]
test rbx, rbx
je 0x14004a605
mov rax, qword [rbx + 0xa0]
jmp 0x14004a608
mov rax, r15
cmp qword [rax + 0x18], r15
jne 0x14004a630
test rbx, rbx
je 0x14004a63e
mov rax, qword [rbx + 0xa0]
test rax, rax
je 0x14004a630
cmp qword [rax], r15
je 0x14004a630
call fcn.14003b970
mov rbx, qword [0x14007fc20]
test rbx, rbx
je 0x14004a63e
mov rdi, qword [rbx + 0x98]
jmp 0x14004a641
mov rdi, r15
xorps xmm0, xmm0
lea rdx, [rbp - 0x19]
movdqu xmmword [rbp - 0x19], xmm0
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x11]
lea rcx, [rbp + 0x1f]
sub eax, dword [rbp - 0x19]
mov qword [rbp + 0x1f], r15
movd xmm1, eax
mov eax, dword [rbp - 0xd]
sub eax, dword [rbp - 0x15]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x10], xmm1
movss dword [rbx + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0x1f]
xorps xmm1, xmm1
mov rsi, qword [0x14007fc20]
mov rax, rcx
sub rax, qword [rdi + 0x18]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rdi + 0x20]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x18], xmm1
mov qword [rdi + 0x18], rcx
test rsi, rsi
je 0x14004a6c6
mov r14, qword [rsi + 0x98]
jmp 0x14004a6c9
mov r14, r15
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [r14]
cmp rax, rcx
jne 0x14004a75b
cmp byte [rsi + 0xdb], r15b
je 0x14004a71d
cvttss2si eax, dword [rsi + 0xe08]
lea rdx, [rbp + 7]
mov dword [rbp + 7], eax
cvttss2si eax, dword [rsi + 0xe0c]
mov dword [rbp + 0xb], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x14004a714
mov edx, dword [rbp + 0xb]
mov ecx, dword [rbp + 7]
call qword [sym.imp.USER32.dll_SetCursorPos]
cmp byte [rsi + 0xdb], r15b
jne 0x14004a75b
cmp dword [r14 + 0x10], r15d
jne 0x14004a75b
lea rcx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14004a75b
mov rcx, qword [r14]
lea rdx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14004a75b
movd xmm2, dword [rbp + 0x13]
lea rcx, [rsi + 8]
movd xmm1, dword [rbp + 0xf]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
call fcn.140013a90
call fcn.14003bd10
cmp byte [rbx + 0x78], r15b
je 0x14004a76d
mov eax, 0xffffffff
jmp 0x14004a77a
mov rax, qword [0x14007fc20]
mov eax, dword [rax + 0x4a50]
cmp dword [rdi + 0x28], eax
je 0x14004a787
mov dword [rdi + 0x28], eax
call fcn.14003bba0
call fcn.14003bee0
call fcn.140017ef0
call fcn.1400496b0
call fcn.140049fd0
call fcn.140019c00
mov rcx, qword [0x14007fc38]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x14007fc38]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x14007fc38]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x14007fc38]
mov r9d, 1
mov dword [rsp + 0x30], r15d
xor r8d, r8d
movss dword [rsp + 0x28], xmm6
xor edx, edx
mov dword [rsp + 0x20], r15d
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x14007fc38]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14004a85e
call fcn.14001a080
mov rax, qword [0x14007fc20]
mov rcx, qword [rax + 0x48a8]
mov rax, qword [rcx]
mov rcx, r15
add rax, 0x48
cmp byte [rax], r15b
cmovne rcx, rax
call fcn.14003b3b0
mov rcx, qword [0x14007fc38]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14007fc38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14004a93c
mov rcx, qword [0x14007fc38]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14004a93c
mov rbx, qword [0x14007fc20]
test rbx, rbx
je 0x14004a903
mov rbx, qword [rbx + 0xa0]
test rbx, rbx
je 0x14004a903
cmp qword [rbx], r15
je 0x14004a903
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004a8ce
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 8], r15
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004a8e1
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x10], r15
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14004a903
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x14007fc20]
mov qword [rbx + 0x18], r15
mov rcx, qword [rax + 0x58]
mov qword [rcx + 8], r15
mov rcx, qword [0x14007fc38]
lea rdx, [0x14007fc40]
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rcx, qword [0x14007fc20]
test rcx, rcx
je 0x14004a943
mov rax, qword [rcx + 0xa0]
test rax, rax
je 0x14004a943
cmp qword [rax], r15
je 0x14004a943
call fcn.14003b970
mov rcx, qword [0x14007fc20]
cmp dword [0x14007fca0], 0x12
jne 0x14004a420
test rcx, rcx
je 0x14004a95e
mov rdi, qword [rcx + 0xa0]
jmp 0x14004a961
mov rdi, r15
lea rsi, [rcx + 8]
test rcx, rcx
je 0x14004a9da
mov rbx, qword [rcx + 0xa0]
test rbx, rbx
je 0x14004a9da
cmp qword [rbx], r15
je 0x14004a9da
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x14004a998
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x14007fc20]
mov qword [rbx + 8], r15
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x14004a9b5
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x14007fc20]
mov qword [rbx + 0x10], r15
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14004a9da
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x14007fc20]
mov qword [rbx + 0x18], r15
mov rax, qword [rcx + 0x58]
mov qword [rax + 8], r15
mov rdx, qword [rdi]
test rdx, rdx
je 0x14004a9f2
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x14007fc20]
mov qword [rsi + 0x88], r15
mov qword [rsi + 0x98], r15
test rcx, rcx
je 0x14004aa0b
dec dword [rcx + 0xf4]
mov rdx, qword [0x14007fc10]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, qword [0x14007fc20]
test rax, rax
je 0x14004aa2f
mov rbx, qword [rax + 0x98]
jmp 0x14004aa32
mov rbx, r15
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x14004aa4c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x14007fc20]
mov qword [rdi + 0x80], r15
mov qword [rdi + 0x90], r15
test rax, rax
je 0x14004aa65
dec dword [rax + 0xf4]
mov rdx, qword [0x14007fc10]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rbx, qword [0x14007fc20]
call fcn.140015ed0
mov qword [0x14007fc20], r15
test rbx, rbx
je 0x14004aab5
mov rcx, rbx
call fcn.14002b5d0
mov rax, qword [0x14007fc20]
test rax, rax
je 0x14004aaa6
dec dword [rax + 0xf4]
mov rdx, qword [0x14007fc10]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [0x14007fc38]
test rcx, rcx
je 0x14004aad7
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x14007fc38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14007fcd8]
test rcx, rcx
je 0x14004aae9
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14007fcc8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rax, qword [0x14007fca8]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140064080
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop r15
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3