Function at 0x14000a250
Capabilities:
Enumerate gui resources
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [0x14004db3c], 0
jne 0x14000a278
mov byte [0x14004db3c], 1
call fcn.1400043a0
cmp byte [0x14004d068], 1
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x40], rdi
jne 0x14000a597
xor ebp, ebp
cmp dword [0x14004dc6c], ebp
jne 0x14000a43e
cmp qword [0x14004db40], rbp
jne 0x14000a5b4
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x60], rsi
lea rcx, [0x140039ff0]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, rbx
cmp rbx, rsi
je 0x14000a3c0
nop dword [rax + rax]
lea rcx, [rdi + 0x85]
lea rdx, str.RobloxPlayerBeta.exe
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000a318
add rdi, 0x108
cmp rdi, rsi
jne 0x14000a2f0
jmp 0x14000a3c0
lea rcx, [0x14004db40]
mov eax, 2
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
lea rdi, [rdi + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdi - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdi - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdi - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdi - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdi - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdi - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x14000a330
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [0x14004db40]
mov qword [0x14004dc80], rcx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x14004dc80]
lea rdx, [0x14004dc68]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rbx, qword [rsp + 0x20]
mov dword [0x14004dc6c], 1
mov rsi, qword [rsp + 0x60]
test rbx, rbx
je 0x14000a432
mov rcx, qword [rsp + 0x30]
movabs rax, 0xf83e0f83e0f83e1
sub rcx, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, rbx
imul rdx, rdx, 0x108
cmp rdx, 0x1000
jb 0x14000a41c
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a41c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003aca4
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbp
movdqu xmmword [rsp + 0x20], xmm0
cmp dword [0x14004dc6c], ebp
je 0x14000a5b4
mov rcx, qword [0x14004dc50]
or dword [rcx + 0x47a8], 2
movsd xmm0, qword [0x14004d070]
or dword [rcx + 0x47a8], 0x40
cmp qword [0x14004dd08], rbp
movsd qword [rcx + 0x47c8], xmm0
mov dword [rcx + 0x47b0], 2
mov dword [rcx + 0x4808], 0x3f800000
je 0x14000a597
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x14000a4a2
imul rbx, rax, 0x64
jmp 0x14000a4c3
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
imul rcx, qword [0x14004dcd8], 0x3b9aca00
mov rax, rbx
sub rax, qword [0x14004dcd0]
cmp rax, rcx
je 0x14000a4e3
jl 0x14000a575
mov rcx, qword [0x14004dca0]
test rcx, rcx
je 0x14000a56e
mov rax, qword [0x14004dcc8]
mov rdx, qword [0x14004dc98]
shr rax, 3
cmp rax, rcx
jbe 0x14000a51a
mov r8, rdx
lea rcx, [0x14004dc90]
mov rdx, qword [rdx]
call fcn.140006090
jmp 0x14000a56e
call fcn.1400076d0
mov rax, qword [0x14004dc98]
mov qword [rax], rax
mov rax, qword [0x14004dc98]
mov qword [rax + 8], rax
mov rdi, qword [0x14004dca8]
mov rcx, qword [0x14004dcb0]
sub rcx, rdi
mov qword [0x14004dca0], rbp
add rcx, 7
shr rcx, 3
cmp rdi, qword [0x14004dcb0]
cmova rcx, rbp
test rcx, rcx
je 0x14000a56e
mov rax, qword [0x14004dc98]
rep stosq qword [rdi], rax
mov qword [0x14004dcd0], rbx
xor r8d, r8d
lea rcx, [0x14003db94]
xor edx, edx
call fcn.140015310
mov rdx, qword [0x14004dd08]
call fcn.1400046b0
call fcn.1400174e0
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000a5b4
cmp byte [0x14004d068], 0
sete byte [0x14004d068]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14003ac40
add rsp, 0x48
ret