Function at 0x140093a90
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1400de040]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov ecx, dword [0x1400de40c]
xor dil, dil
test ecx, ecx
je 0x140093aea
sub ecx, 1
je 0x140093ad2
cmp ecx, 1
jne 0x140093b08
mov byte [0x1400de418], cl
jmp 0x140093b08
mov ecx, dword [0x1400de408]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne byte [0x1400de418]
jmp 0x140093b08
mov ecx, dword [0x1400de408]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140093b08
cmp byte [0x1400de418], dil
sete byte [0x1400de418]
cmp byte [0x1400df372], dil
je 0x1400941a7
lea rdx, [rsp + 0x41]
mov qword [rsp + 0x200], rbx
xor ecx, ecx
mov dword [rsp + 0x40], 0x626f5222
mov dword [rsp + 0x44], 0x786f6c
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x14009419f
cmp byte [0x1400de418], dil
je 0x14009419f
mov r8, qword [0x1400df390]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x208], rsi
add r8, 0x110
mov qword [rsp + 0x210], r14
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
movaps xmmword [rsp + 0x1c0], xmm8
movaps xmmword [rsp + 0x1b0], xmm9
movaps xmmword [rsp + 0x1a0], xmm10
movaps xmmword [rsp + 0x190], xmm11
movaps xmmword [rsp + 0x180], xmm12
movaps xmmword [rsp + 0x170], xmm13
movaps xmmword [rsp + 0x160], xmm14
movaps xmmword [rsp + 0x150], xmm15
call fcn.140099920
mov r8, qword [rsp + 0x40]
lea rdx, [rbp + 0x40]
add r8, 0x298
call fcn.140099920
xor r14d, r14d
mov dword [rsp + 0x40], 0x726f577b
xorps xmm0, xmm0
mov qword [rbp - 0x20], r14
mov rbx, 0xffffffffffffffff
mov qword [rbp - 0x18], r14
movups xmmword [rbp - 0x30], xmm0
mov dword [rsp + 0x44], 0x6170736b
lea rax, [rsp + 0x41]
mov word [rsp + 0x48], 0x6563
mov r8, rbx
mov byte [rsp + 0x4a], dil
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140093c30
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x30]
call fcn.140002040
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x80]
lea rcx, [0x1400df378]
call fcn.1400970c0
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x6d614376
mov rsi, rax
mov dword [rsp + 0x44], 0x617265
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
lea rax, [rsp + 0x41]
mov qword [rbp - 0x38], r14
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x140093c85
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x50]
call fcn.140002040
lea r8, [rbp - 0x50]
mov rcx, rsi
lea rdx, [rsp + 0x40]
call fcn.1400970c0
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x208]
add rax, 0xd0
mov qword [rbp - 8], rax
lea rax, [rbp + 0x18]
mov qword [rbp], rax
mov eax, dword [0x1400dfbb8]
mov dword [rbp + 0x11], r14d
mov word [rbp + 0x15], r14w
mov byte [rbp + 0x17], dil
mov dword [rbp - 0x10], 0x12b2d92
mov qword [rbp + 8], 0x24
mov dword [rbp - 0xc], eax
mov byte [rbp + 0x10], dil
test eax, eax
je 0x140093d35
mov rcx, qword [0x1400dfbb0]
test rcx, rcx
je 0x140093d35
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x10]
mov dword [rsp + 0x28], 0x28
mov r9d, 0x28
mov edx, 0x224a14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movss xmm0, dword [rbp + 0x20]
xorps xmm6, xmm6
movss dword [rbp - 0x5c], xmm0
xorps xmm3, xmm3
movss xmm0, dword [rbp + 0x2c]
xorps xmm4, xmm4
movss dword [rbp - 0x64], xmm0
xorps xmm5, xmm5
movss xmm0, dword [rbp + 0x38]
mov ecx, 0x57
movss dword [rbp - 0x6c], xmm0
xorps xmm12, xmm12
movss xmm0, dword [rbp + 0x18]
xorps xmm13, xmm13
movss dword [rsp + 0x40], xmm0
xorps xmm14, xmm14
movss xmm0, dword [rbp + 0x24]
xorps xmm10, xmm10
movss dword [rbp - 0x80], xmm0
xorps xmm7, xmm7
movss xmm0, dword [rbp + 0x30]
xorps xmm11, xmm11
movss dword [rbp - 0x58], xmm0
xorps xmm15, xmm15
movss dword [rbp - 0x70], xmm6
xorps xmm8, xmm8
movss dword [rbp - 0x68], xmm6
xorps xmm9, xmm9
movss dword [rbp - 0x60], xmm6
movss dword [rsp + 0x70], xmm6
movss dword [rsp + 0x74], xmm6
movss dword [rsp + 0x78], xmm6
movss dword [rsp + 0x64], xmm3
movss dword [rsp + 0x68], xmm6
movss dword [rsp + 0x6c], xmm6
movss dword [rsp + 0x58], xmm3
movss dword [rsp + 0x5c], xmm4
movss dword [rsp + 0x60], xmm5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140093e7d
xorps xmm0, xmm0
xorps xmm1, xmm1
subss xmm0, dword [rbp - 0x6c]
subss xmm1, dword [rbp - 0x64]
xorps xmm2, xmm2
mov dil, 1
subss xmm2, dword [rbp - 0x5c]
movss dword [rbp - 0x70], xmm0
movaps xmm12, xmm0
movss dword [rbp - 0x68], xmm1
movaps xmm13, xmm1
movss dword [rsp + 0x70], xmm0
movaps xmm10, xmm1
movss dword [rbp - 0x60], xmm2
movaps xmm14, xmm2
movss dword [rsp + 0x74], xmm1
movaps xmm7, xmm2
movss dword [rsp + 0x78], xmm2
movaps xmm11, xmm0
movss dword [rsp + 0x64], xmm1
movaps xmm15, xmm2
movss dword [rsp + 0x68], xmm2
movaps xmm8, xmm1
movss dword [rsp + 0x6c], xmm0
movaps xmm9, xmm0
movss dword [rsp + 0x58], xmm2
movss dword [rsp + 0x5c], xmm1
movss dword [rsp + 0x60], xmm0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140093f07
movss xmm0, dword [rbp - 0x70]
mov dil, 1
addss xmm0, dword [rbp - 0x6c]
movss xmm1, dword [rbp - 0x68]
addss xmm1, dword [rbp - 0x64]
movss xmm2, dword [rbp - 0x60]
addss xmm2, dword [rbp - 0x5c]
movss dword [rsp + 0x70], xmm0
movaps xmm12, xmm0
movss dword [rsp + 0x6c], xmm0
movaps xmm11, xmm0
movss dword [rsp + 0x74], xmm1
movaps xmm13, xmm1
movss dword [rsp + 0x64], xmm1
movaps xmm10, xmm1
movss dword [rsp + 0x78], xmm2
movaps xmm14, xmm2
movss dword [rsp + 0x68], xmm2
movaps xmm7, xmm2
movss dword [rsp + 0x58], xmm2
movaps xmm15, xmm2
movss dword [rsp + 0x5c], xmm1
movaps xmm8, xmm1
movss dword [rsp + 0x60], xmm0
movaps xmm9, xmm0
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140093f84
movss xmm12, dword [rsp + 0x70]
mov dil, 1
subss xmm12, dword [rbp - 0x58]
movss xmm13, dword [rsp + 0x74]
subss xmm13, dword [rbp - 0x80]
movss xmm14, dword [rsp + 0x78]
subss xmm14, dword [rsp + 0x40]
movss dword [rsp + 0x6c], xmm12
movaps xmm11, xmm12
movss dword [rsp + 0x60], xmm12
movaps xmm9, xmm12
movss dword [rsp + 0x64], xmm13
movaps xmm10, xmm13
movss dword [rsp + 0x5c], xmm13
movaps xmm8, xmm13
movss dword [rsp + 0x68], xmm14
movaps xmm7, xmm14
movss dword [rsp + 0x58], xmm14
movaps xmm15, xmm14
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140093fdd
movss xmm11, dword [rbp - 0x58]
mov dil, 1
movss xmm10, dword [rbp - 0x80]
addss xmm11, xmm12
movss xmm7, dword [rsp + 0x40]
addss xmm10, xmm13
addss xmm7, xmm14
movaps xmm2, xmm11
movaps xmm14, xmm11
movaps xmm0, xmm10
movaps xmm13, xmm10
movaps xmm1, xmm7
movaps xmm12, xmm7
movaps xmm15, xmm7
movaps xmm8, xmm10
movaps xmm9, xmm11
jmp 0x140094004
movss xmm12, dword [rsp + 0x58]
movss xmm13, dword [rsp + 0x5c]
movss xmm14, dword [rsp + 0x60]
movss xmm0, dword [rsp + 0x64]
movss xmm1, dword [rsp + 0x68]
movss xmm2, dword [rsp + 0x6c]
mulss xmm10, xmm0
xorps xmm0, xmm0
mulss xmm7, xmm1
mulss xmm11, xmm2
addss xmm7, xmm10
movaps xmm10, xmmword [rsp + 0x1a0]
addss xmm7, xmm11
movaps xmm11, xmmword [rsp + 0x190]
ucomiss xmm0, xmm7
ja 0x14009403f
xorps xmm0, xmm0
sqrtss xmm0, xmm7
jmp 0x140094047
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
comiss xmm0, xmm6
movaps xmm7, xmmword [rsp + 0x1d0]
jbe 0x14009406f
movaps xmm15, xmm12
movaps xmm8, xmm13
movaps xmm9, xmm14
divss xmm15, xmm0
divss xmm8, xmm0
divss xmm9, xmm0
mov r8, qword [0x1400df390]
lea rdx, [rbp - 0x80]
add r8, 0x110
call fcn.140099920
mov r8, qword [rbp - 0x80]
lea rdx, [rbp - 0x58]
add r8, 0x298
call fcn.140099920
movdqa xmm0, xmmword [0x1400cad50]
lea rax, [rsp + 0x41]
movaps xmm14, xmmword [rsp + 0x160]
movaps xmm13, xmmword [rsp + 0x170]
movaps xmm12, xmmword [rsp + 0x180]
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x40], r14
xorps xmm0, xmm0
mov qword [rbp - 0x38], r14
mov r14, qword [rsp + 0x210]
movups xmmword [rbp - 0x50], xmm0
mov word [rsp + 0x50], 0x74
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400940e6
mov r8, rbx
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x50]
call fcn.140002040
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.1400970c0
test dil, dil
jne 0x140094129
movaps xmm0, xmm6
movss dword [rbp - 0x78], xmm6
unpcklps xmm0, xmm6
movsd qword [rbp - 0x80], xmm0
jmp 0x14009416e
cmp dil, 1
jne 0x14009417c
movss xmm1, dword [0x1400de310]
movss xmm0, dword [0x1400ca6f4]
movaps xmm2, xmm1
mulss xmm2, xmm15
mulss xmm8, xmm1
mulss xmm2, xmm0
mulss xmm9, xmm1
mulss xmm8, xmm0
mulss xmm9, xmm0
unpcklps xmm2, xmm8
movsd qword [rbp - 0x80], xmm2
movss dword [rbp - 0x78], xmm9
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140097750
movaps xmm9, xmmword [rsp + 0x1b0]
movaps xmm8, xmmword [rsp + 0x1c0]
movaps xmm6, xmmword [rsp + 0x1e0]
movaps xmm15, xmmword [rsp + 0x150]
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.1400b5c20
mov rdi, qword [rsp + 0x218]
add rsp, 0x1f0
pop rbp
ret