Function at 0x1400026e0
Capabilities:
Get token membership
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x140047030]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor ecx, ecx
call fcn.14001bc88
mov rcx, rax
call fcn.1400196d8
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x100]
call fcn.140011c00
mov r8d, 0x100
lea rdx, [rbp + 0x100]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400056b0
mov rcx, rax
lea rdx, [rbp + 0x100]
call fcn.140005a50
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x70], rcx
mov rdx, qword [rcx]
call qword [rdx + 8]
nop
lea rcx, [rbp - 0x78]
call fcn.1400085c0
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x60]
movzx edi, ax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400027bc
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x1400027bc
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, di
mov rcx, rbx
call fcn.140008070
mov rcx, rbx
call fcn.1400051d0
mov dword [rbp - 0x64], 0
mov word [rbp - 0x60], 0x500
lea rax, [rbp - 0x78]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
lea r8d, [rbx + 0x20]
mov dl, 2
lea rcx, [rbp - 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 0x68], eax
test eax, eax
je 0x140002839
lea r8, [rbp - 0x68]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x68]
cmp eax, 1
jne 0x140002de9
lea rdx, [0x1400406f8]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
mov rcx, rax
call fcn.140005fc0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r12d, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r13d, eax
lea rdx, [0x1400408e8]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
mov edx, r12d
call fcn.1400030f0
mov rcx, rax
lea rdx, [0x1400408e0]
call fcn.140005d10
mov rcx, rax
mov edx, r13d
call fcn.1400030f0
mov rcx, rax
lea rdx, [0x1400408dc]
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, 2
mov rcx, rax
call qword [sym.imp.USER32.dll_MonitorFromWindow]
mov dword [rbp - 0x50], 0x68
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
mov dword [rbp + 0x64], 0xdc
lea r8, [rbp + 0x20]
mov edx, 0xffffffff
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov edi, dword [rbp + 0xcc]
mov ebx, dword [rbp + 0xd0]
lea rdx, [0x140040910]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
mov edx, edi
call fcn.1400030f0
mov rcx, rax
lea rdx, [0x1400408e0]
call fcn.140005d10
mov rcx, rax
mov edx, ebx
call fcn.1400030f0
mov rcx, rax
lea rdx, [0x1400408dc]
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
movd xmm1, edi
cvtdq2pd xmm1, xmm1
movd xmm0, r12d
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
mulsd xmm1, qword [0x140040a48]
cvttsd2si ebx, xmm1
lea rdx, [0x140040938]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
mov edx, ebx
call fcn.1400030f0
mov rcx, rax
lea rdx, [0x140040934]
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
lea rcx, [0x1400485b0]
call fcn.140005fc0
lea rdx, [0x140040718]
mov rcx, rax
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
lea rcx, [0x1400485b0]
call fcn.140005fc0
lea rdx, [0x140040730]
mov rcx, rax
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
lea rcx, [0x1400485b0]
call fcn.140005fc0
lea rdx, [0x140040770]
mov rcx, rax
call fcn.140005d10
mov rcx, rax
mov edx, dword [0x140047c10]
call fcn.1400030f0
mov rcx, rax
lea rdx, [0x140040760]
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
lea rcx, [0x1400485b0]
call fcn.140005fc0
lea rdx, [0x1400407a0]
mov rcx, rax
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
lea rdx, [0x1400407c8]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
lea rdx, [0x140040810]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
mov rcx, rax
call fcn.140005fc0
mov dil, 1
xor sil, sil
nop word [rax + rax]
movzx r15d, sil
movzx r14d, dil
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002c10
nop word [rax + rax]
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002be8
lea rcx, [0x1400485b0]
call fcn.140005fc0
lea rdx, [0x140040950]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov ebx, dword [0x140047c10]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1400487f0]
movsxd rcx, dword [rax + 4]
mov eax, 4
lea r8, [0x1400487f0]
cmp qword [rcx + r8 + 0x48], 0
mov edx, 0
cmovne eax, edx
mov dword [rcx + r8 + 0x10], eax
test dword [rcx + r8 + 0x14], eax
jne 0x140002df1
mov dword [rbp - 0x68], ebx
lea rdx, [rbp - 0x68]
mov rcx, r8
call fcn.140006050
mov ecx, dword [rbp - 0x68]
test ecx, ecx
jle 0x140002bc5
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
test eax, eax
jle 0x140002bc5
mov dword [0x140047c10], eax
lea rdx, [0x140040998]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
mov edx, dword [0x140047c10]
call fcn.1400030f0
mov rcx, rax
lea rdx, [0x140040988]
jmp 0x140002bd3
lea rdx, [0x1400409b0]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
mov rcx, rax
call fcn.140005fc0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140002ae0
nop word [rax + rax]
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140002c34
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002cd0
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002c64
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002c64
mov ecx, 0x54
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140002c71
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002c10
test dil, dil
sete dil
test r14b, r14b
jne 0x140002ca7
lea rdx, [0x140040880]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
mov edx, dword [0x140047c10]
call fcn.1400030f0
lea rdx, [0x140040860]
jmp 0x140002cb5
lea rax, [0x1400485b0]
lea rdx, [0x140040898]
mov rcx, rax
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002d70
mov ecx, 0x320
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140002d11
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140002ce4
jmp 0x140002d70
test sil, sil
sete sil
test r15b, r15b
jne 0x140002d47
lea rdx, [0x1400408a8]
lea rcx, [0x1400485b0]
call fcn.140005d10
mov rcx, rax
mov edx, dword [0x140047c10]
call fcn.1400030f0
lea rdx, [0x140040760]
jmp 0x140002d55
lea rax, [0x1400485b0]
lea rdx, [0x1400408c8]
mov rcx, rax
call fcn.140005d10
mov rcx, rax
call fcn.140005fc0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
test dil, dil
je 0x140002d84
movzx r8d, sil
mov edx, r13d
mov ecx, r12d
call fcn.140002e30
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002ab0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140002ab0
xor eax, eax
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.14000f600
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor ecx, ecx
call fcn.140015d50
int3
mov edx, 1
lea rcx, [rbp - 0x78]
call fcn.1400015c0
mov r8, rax
lea rdx, str.ios_base::badbit_set
lea rcx, [rsp + 0x60]
call fcn.1400025c0
lea rdx, [0x140045a40]
lea rcx, [rsp + 0x60]
call fcn.140011460
int3