Function at 0x1400280d0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
movaps xmmword [rsp + 0x1f0], xmm6
mov rax, qword [0x14014d140]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov rsi, r9
mov edi, r8d
mov ebx, edx
mov dword [rbp - 0x10], 0x50
mov dword [rbp - 0xc], 0x40
lea rax, [0x140027fe0]
mov qword [rbp - 8], rax
xor r14d, r14d
mov qword [rbp], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm1
lea rcx, [rbp - 0x80]
call fcn.140027db0
cmp qword [rax + 0x18], 0xf
jbe 0x14002815b
mov rax, qword [rax]
mov qword [rbp + 0x30], rax
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14002819d
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028198
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028198
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ef64
mov qword [rbp + 0x38], r14
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_RegisterClassExA]
lea rcx, [rbp - 0x80]
call fcn.140027db0
mov r8, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400281c1
mov r8, qword [rax]
mov qword [rsp + 0x58], r14
mov rax, qword [rbp + 8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0x80000008
mov rdx, qword [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140151fd8], rax
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140028249
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002823d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002823d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ef64
mov rax, qword [0x140151fd8]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov qword [rbp + 0x80], r14
mov dword [rbp + 0x88], ebx
mov dword [rbp + 0x8c], edi
lea rdx, [rbp + 0x80]
mov rcx, qword [0x140151fd8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rax, qword [0x140151fd8]
mov qword [rbp - 0x4c], r14
mov qword [rbp - 0x38], 2
mov qword [rbp - 0x20], 2
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x50], 0x1c
mov dword [rbp - 0x58], 0x3c
mov dword [rbp - 0x54], 1
mov dword [rbp - 0x3c], 0x20
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x44], 1
mov qword [rbp - 0x28], 1
mov dword [rbp + 0xc0], 0xb000
mov dword [rbp + 0xc4], 0xa000
lea rax, [0x140151fe8]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x50], rax
lea rax, [0x140151fe0]
mov qword [rsp + 0x48], rax
lea rax, [0x140151ff0]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
je 0x140028383
call fcn.140027f60
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14007eba0
mov rbx, qword [rsp + 0x230]
movaps xmm6, xmmword [rsp + 0x1f0]
add rsp, 0x200
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140027ef0
mov edx, 0xa
mov rcx, qword [0x140151fd8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140151fd8]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], 0x10
mov edx, 0x38e0
mov r9d, 8
mov r8d, 0x450
lea rcx, str.1.90.6
call fcn.14004ea30
xor ecx, ecx
call fcn.14004e710
cmp qword [0x14015aed8], r14
jne 0x140028432
mov ecx, 0xc8
call fcn.14007ece0
mov rbx, rax
mov qword [rbp + 0xc0], rax
xor edx, edx
mov r8d, 0xc8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0xc8
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.14000faa0
mov qword [0x14015aed8], rax
call fcn.140031600
mov qword [rbp + 0x48], 0xffffffffffffffff
mov qword [rbp + 0x50], 0xffffffffffffffff
mov qword [rbp + 0x58], 0xffffffffffffffff
mov qword [rbp + 0x60], 0xffffffffffffffff
mov dword [rbp + 0x68], 0xffffffff
mov qword [rbp + 0x6c], 0xfffffffffffffffd
mov dword [rbp + 0x74], 0xffffffff
mov qword [rbp + 0x78], r14
mov qword [rsp + 0x30], r14
lea rax, [0x140152038]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x48]
mov r8d, 0x213
lea rdx, [0x14014d730]
mov rcx, qword [0x140151fe0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov qword [rsp + 0x30], r14
lea rax, [0x140152020]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x48]
mov r8d, 0x233
lea rdx, [0x14014d4f0]
mov rcx, qword [0x140151fe0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov qword [rsp + 0x30], r14
lea rax, [0x140152040]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x48]
mov r8d, 0x247
lea rdx, [0x14014d950]
mov rcx, qword [0x140151fe0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov qword [rsp + 0x30], r14
lea rax, [0x140152028]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x48]
mov r8d, 0x1da
lea rdx, [0x14014d310]
mov rcx, qword [0x140151fe0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov qword [rsp + 0x30], r14
lea rax, [0x140152030]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x48]
mov r8d, 0x3466
lea rdx, [0x14014dba0]
mov rcx, qword [0x140151fe0]
call qword [sym.imp.d3dx11_43.dll_D3DX11CreateShaderResourceViewFromMemory]
mov rcx, qword [0x140151fd8]
call fcn.140065de0
mov rdx, qword [0x140151fe8]
mov rcx, qword [0x140151fe0]
call fcn.140064da0
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movabs r15, 0xefffffffeffff
xorps xmm6, xmm6
nop dword [rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x90]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140028600
lea rcx, [rbp + 0x90]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x90]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x140028ab7
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
mov rcx, qword [0x140151fd8]
call qword [sym.imp.USER32.dll_SetWindowPos]
test rsi, rsi
je 0x140028afa
call fcn.140065000
call fcn.140065f80
call fcn.140059330
mov rax, qword [0x14015aed8]
test rax, rax
jne 0x140028693
mov ecx, 0xc8
call fcn.14007ece0
mov rbx, rax
mov qword [rbp + 0xc0], rax
xor edx, edx
mov r8d, 0xc8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0xc8
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.14000faa0
mov qword [0x14015aed8], rax
mov ecx, dword [rax + 0x60]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400286d3
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
movsxd rcx, dword [0x14015ea50]
sub rax, rcx
cmp rax, 0xc8
jbe 0x1400286d3
cmp byte [0x140152000], 0
sete byte [0x140152000]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [0x14015ea50], eax
movzx ebx, byte [0x140152000]
call fcn.140051b30
mov byte [rax + 0x50], bl
movzx ebx, byte [0x140152000]
call fcn.140051b30
mov byte [rax + 0xc3], bl
movzx ebx, byte [0x140152000]
call fcn.140051b30
mov byte [rax + 0xc2], bl
call fcn.140029040
mov rdi, rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0xc0], 8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov ecx, 8
call fcn.14007ece0
mov qword [rsp + 0x60], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x70], rdx
mov rcx, qword [rbp + 0xc0]
mov qword [rax], rcx
mov qword [rsp + 0x68], rdx
call fcn.140029040
mov rbx, qword [rax + 0x118]
call fcn.140029040
nop
lea r9, [rsp + 0x60]
mov r8, rbx
mov rdx, qword [rax + 0x130]
call fcn.140013d70
mov qword [rdi + 0x168], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0xc0], 8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov ecx, 8
call fcn.14007ece0
mov qword [rsp + 0x60], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x70], rdx
mov rcx, qword [rbp + 0xc0]
mov qword [rax], rcx
mov qword [rsp + 0x68], rdx
call fcn.140029040
mov rbx, qword [rax + 0x118]
call fcn.140029040
nop
lea r9, [rsp + 0x60]
mov r8, rbx
mov rdx, qword [rax + 0x130]
call fcn.140013d70
mov rbx, rax
test rax, rax
je 0x1400289bd
lea rcx, [rax - 0x10000]
cmp rcx, r15
ja 0x1400289bd
lea rax, [rbp - 0x80]
mov qword [rbp + 0xc0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
call fcn.140029040
lea rdx, [rbx + 0x280]
lea r9, [rbp - 0x80]
mov r8, qword [rax + 0x118]
call fcn.140014080
comiss xmm0, xmm6
jbe 0x1400289bd
mov rax, qword [0x140157308]
test rax, rax
jne 0x14002889d
mov ecx, 0x30
call fcn.14007ece0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov byte [rax], 1
mov byte [rax + 4], 1
mov dword [rax + 0x10], 0x43480000
mov dword [rax + 0x14], 0x73
mov dword [rax + 0x1c], r14d
mov dword [rax + 0x24], 0x3f800000
mov dword [rax + 0x2c], 0x3f800000
mov qword [0x140157308], rax
mov ecx, dword [rax + 0x14]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140028909
mov rcx, qword [0x140157308]
test rcx, rcx
jne 0x1400288ff
mov ecx, 0x30
call fcn.14007ece0
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov byte [rax], 1
mov byte [rax + 4], 1
mov dword [rax + 0x10], 0x43480000
mov dword [rax + 0x14], 0x73
mov dword [rax + 0x1c], r14d
mov dword [rax + 0x24], 0x3f800000
mov dword [rax + 0x2c], 0x3f800000
mov qword [0x140157308], rax
cmp byte [rcx + 3], 0
sete al
mov byte [rcx + 3], al
call fcn.140012b90
mov rcx, rax
call fcn.1400135e0
call fcn.1400334c0
mov rcx, rax
call fcn.140033900
mov rax, qword [0x140157308]
test rax, rax
jne 0x140028975
mov ecx, 0x30
call fcn.14007ece0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov byte [rax], 1
mov byte [rax + 4], 1
mov dword [rax + 0x10], 0x43480000
mov dword [rax + 0x14], 0x73
mov dword [rax + 0x1c], r14d
mov dword [rax + 0x24], 0x3f800000
mov dword [rax + 0x2c], 0x3f800000
mov qword [0x140157308], rax
mov rcx, rax
call fcn.140026af0
mov rax, qword [0x14015ea48]
test rax, rax
jne 0x1400289a8
mov ecx, 0x20
call fcn.14007ece0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x10], r14d
mov qword [0x14015ea48], rax
mov rcx, rax
call fcn.1400350a0
call fcn.140031c20
mov rcx, rax
call fcn.140031d70
mov edx, 0xffffffec
mov rcx, qword [0x140151fd8]
cmp byte [0x140152000], 0
mov r8d, 0x80020
je 0x1400289de
mov r8d, 0x80000
call qword [sym.imp.USER32.dll_SetWindowLongA]
cmp byte [0x140152000], 0
je 0x140028a44
mov rax, qword [0x14015aed8]
test rax, rax
jne 0x140028a3c
mov ecx, 0xc8
call fcn.14007ece0
mov rbx, rax
mov qword [rbp + 0xc0], rax
xor edx, edx
mov r8d, 0xc8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0xc8
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.14000faa0
mov qword [0x14015aed8], rax
mov rcx, rax
call fcn.14002e3b0
call fcn.14004fa20
call fcn.14005b0f0
mov rcx, qword [0x140151fe8]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x140151ff8]
mov edx, 1
call qword [rax + pe_nt_image_headers64]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov rcx, qword [0x140151fe8]
mov rax, qword [rcx]
lea r8, [rbp + 0xd0]
mov rdx, qword [0x140151ff8]
call qword [rax + 0x190]
call fcn.1400517b0
mov rcx, rax
call fcn.140065040
mov rcx, qword [0x140151ff0]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 1
call qword [rax + 0x40]
cmp dword [rbp + 0x98], 0x12
jne 0x1400285c0
call fcn.140065ca0
call fcn.140066290
xor ecx, ecx
call fcn.14004f280
call fcn.140027f60
mov rcx, qword [0x140151fd8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x140028355
call fcn.140027d40
mov rbx, rax
lea rax, [0x1400a8bb4]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 5
movaps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0xc0], xmm0
lea r8, str.14:35:22
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.14001a170
nop
mov rcx, rax
call fcn.140010c70
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14000fb80
mov r8, rax
mov rcx, rbx
call fcn.140028b90
nop
lea rcx, [rsp + 0x60]
call fcn.140010c80
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3