Function at 0x140092c40
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1400da040]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov ecx, dword [0x1400da40c]
xor dil, dil
test ecx, ecx
je 0x140092c9a
sub ecx, 1
je 0x140092c82
cmp ecx, 1
jne 0x140092cb8
mov byte [0x1400da418], cl
jmp 0x140092cb8
mov ecx, dword [0x1400da408]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne byte [0x1400da418]
jmp 0x140092cb8
mov ecx, dword [0x1400da408]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140092cb8
cmp byte [0x1400da418], dil
sete byte [0x1400da418]
cmp byte [0x1400db372], dil
je 0x140093357
lea rdx, [rsp + 0x41]
mov qword [rsp + 0x200], rbx
xor ecx, ecx
mov dword [rsp + 0x40], 0x626f5270
mov dword [rsp + 0x44], 0x786f6c
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x14009334f
cmp byte [0x1400da418], dil
je 0x14009334f
mov r8, qword [0x1400db390]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x208], rsi
add r8, 0x118
mov qword [rsp + 0x210], r14
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
movaps xmmword [rsp + 0x1c0], xmm8
movaps xmmword [rsp + 0x1b0], xmm9
movaps xmmword [rsp + 0x1a0], xmm10
movaps xmmword [rsp + 0x190], xmm11
movaps xmmword [rsp + 0x180], xmm12
movaps xmmword [rsp + 0x170], xmm13
movaps xmmword [rsp + 0x160], xmm14
movaps xmmword [rsp + 0x150], xmm15
call fcn.140098a50
mov r8, qword [rsp + 0x40]
lea rdx, [rbp + 0x40]
add r8, 0x2a0
call fcn.140098a50
xor r14d, r14d
mov dword [rsp + 0x40], 0x726f573d
xorps xmm0, xmm0
mov qword [rbp - 0x20], r14
mov rbx, 0xffffffffffffffff
mov qword [rbp - 0x18], r14
movups xmmword [rbp - 0x30], xmm0
mov dword [rsp + 0x44], 0x6170736b
lea rax, [rsp + 0x41]
mov word [rsp + 0x48], 0x6563
mov r8, rbx
mov byte [rsp + 0x4a], dil
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140092de0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x30]
call fcn.140002040
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x80]
lea rcx, [0x1400db378]
call fcn.1400961f0
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x6d61435f
mov rsi, rax
mov dword [rsp + 0x44], 0x617265
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
lea rax, [rsp + 0x41]
mov qword [rbp - 0x38], r14
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x140092e35
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x50]
call fcn.140002040
lea r8, [rbp - 0x50]
mov rcx, rsi
lea rdx, [rsp + 0x40]
call fcn.1400961f0
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x208]
add rax, 0xd8
mov qword [rbp - 8], rax
lea rax, [rbp + 0x18]
mov qword [rbp], rax
mov eax, dword [0x1400dbbb8]
mov dword [rbp + 0x11], r14d
mov word [rbp + 0x15], r14w
mov byte [rbp + 0x17], dil
mov dword [rbp - 0x10], 0x12b2d92
mov qword [rbp + 8], 0x24
mov dword [rbp - 0xc], eax
mov byte [rbp + 0x10], dil
test eax, eax
je 0x140092ee5
mov rcx, qword [0x1400dbbb0]
test rcx, rcx
je 0x140092ee5
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x10]
mov dword [rsp + 0x28], 0x28
mov r9d, 0x28
mov edx, 0x224a14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movss xmm0, dword [rbp + 0x20]
xorps xmm6, xmm6
movss dword [rbp - 0x5c], xmm0
xorps xmm3, xmm3
movss xmm0, dword [rbp + 0x2c]
xorps xmm4, xmm4
movss dword [rbp - 0x64], xmm0
xorps xmm5, xmm5
movss xmm0, dword [rbp + 0x38]
mov ecx, 0x57
movss dword [rbp - 0x6c], xmm0
xorps xmm12, xmm12
movss xmm0, dword [rbp + 0x18]
xorps xmm13, xmm13
movss dword [rsp + 0x40], xmm0
xorps xmm14, xmm14
movss xmm0, dword [rbp + 0x24]
xorps xmm10, xmm10
movss dword [rbp - 0x80], xmm0
xorps xmm7, xmm7
movss xmm0, dword [rbp + 0x30]
xorps xmm11, xmm11
movss dword [rbp - 0x58], xmm0
xorps xmm15, xmm15
movss dword [rbp - 0x70], xmm6
xorps xmm8, xmm8
movss dword [rbp - 0x68], xmm6
xorps xmm9, xmm9
movss dword [rbp - 0x60], xmm6
movss dword [rsp + 0x70], xmm6
movss dword [rsp + 0x74], xmm6
movss dword [rsp + 0x78], xmm6
movss dword [rsp + 0x64], xmm3
movss dword [rsp + 0x68], xmm6
movss dword [rsp + 0x6c], xmm6
movss dword [rsp + 0x58], xmm3
movss dword [rsp + 0x5c], xmm4
movss dword [rsp + 0x60], xmm5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009302d
xorps xmm0, xmm0
xorps xmm1, xmm1
subss xmm0, dword [rbp - 0x6c]
subss xmm1, dword [rbp - 0x64]
xorps xmm2, xmm2
mov dil, 1
subss xmm2, dword [rbp - 0x5c]
movss dword [rbp - 0x70], xmm0
movaps xmm12, xmm0
movss dword [rbp - 0x68], xmm1
movaps xmm13, xmm1
movss dword [rsp + 0x70], xmm0
movaps xmm10, xmm1
movss dword [rbp - 0x60], xmm2
movaps xmm14, xmm2
movss dword [rsp + 0x74], xmm1
movaps xmm7, xmm2
movss dword [rsp + 0x78], xmm2
movaps xmm11, xmm0
movss dword [rsp + 0x64], xmm1
movaps xmm15, xmm2
movss dword [rsp + 0x68], xmm2
movaps xmm8, xmm1
movss dword [rsp + 0x6c], xmm0
movaps xmm9, xmm0
movss dword [rsp + 0x58], xmm2
movss dword [rsp + 0x5c], xmm1
movss dword [rsp + 0x60], xmm0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400930b7
movss xmm0, dword [rbp - 0x70]
mov dil, 1
addss xmm0, dword [rbp - 0x6c]
movss xmm1, dword [rbp - 0x68]
addss xmm1, dword [rbp - 0x64]
movss xmm2, dword [rbp - 0x60]
addss xmm2, dword [rbp - 0x5c]
movss dword [rsp + 0x70], xmm0
movaps xmm12, xmm0
movss dword [rsp + 0x6c], xmm0
movaps xmm11, xmm0
movss dword [rsp + 0x74], xmm1
movaps xmm13, xmm1
movss dword [rsp + 0x64], xmm1
movaps xmm10, xmm1
movss dword [rsp + 0x78], xmm2
movaps xmm14, xmm2
movss dword [rsp + 0x68], xmm2
movaps xmm7, xmm2
movss dword [rsp + 0x58], xmm2
movaps xmm15, xmm2
movss dword [rsp + 0x5c], xmm1
movaps xmm8, xmm1
movss dword [rsp + 0x60], xmm0
movaps xmm9, xmm0
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140093134
movss xmm12, dword [rsp + 0x70]
mov dil, 1
subss xmm12, dword [rbp - 0x58]
movss xmm13, dword [rsp + 0x74]
subss xmm13, dword [rbp - 0x80]
movss xmm14, dword [rsp + 0x78]
subss xmm14, dword [rsp + 0x40]
movss dword [rsp + 0x6c], xmm12
movaps xmm11, xmm12
movss dword [rsp + 0x60], xmm12
movaps xmm9, xmm12
movss dword [rsp + 0x64], xmm13
movaps xmm10, xmm13
movss dword [rsp + 0x5c], xmm13
movaps xmm8, xmm13
movss dword [rsp + 0x68], xmm14
movaps xmm7, xmm14
movss dword [rsp + 0x58], xmm14
movaps xmm15, xmm14
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009318d
movss xmm11, dword [rbp - 0x58]
mov dil, 1
movss xmm10, dword [rbp - 0x80]
addss xmm11, xmm12
movss xmm7, dword [rsp + 0x40]
addss xmm10, xmm13
addss xmm7, xmm14
movaps xmm2, xmm11
movaps xmm14, xmm11
movaps xmm0, xmm10
movaps xmm13, xmm10
movaps xmm1, xmm7
movaps xmm12, xmm7
movaps xmm15, xmm7
movaps xmm8, xmm10
movaps xmm9, xmm11
jmp 0x1400931b4
movss xmm12, dword [rsp + 0x58]
movss xmm13, dword [rsp + 0x5c]
movss xmm14, dword [rsp + 0x60]
movss xmm0, dword [rsp + 0x64]
movss xmm1, dword [rsp + 0x68]
movss xmm2, dword [rsp + 0x6c]
mulss xmm10, xmm0
xorps xmm0, xmm0
mulss xmm7, xmm1
mulss xmm11, xmm2
addss xmm7, xmm10
movaps xmm10, xmmword [rsp + 0x1a0]
addss xmm7, xmm11
movaps xmm11, xmmword [rsp + 0x190]
ucomiss xmm0, xmm7
ja 0x1400931ef
xorps xmm0, xmm0
sqrtss xmm0, xmm7
jmp 0x1400931f7
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
comiss xmm0, xmm6
movaps xmm7, xmmword [rsp + 0x1d0]
jbe 0x14009321f
movaps xmm15, xmm12
movaps xmm8, xmm13
movaps xmm9, xmm14
divss xmm15, xmm0
divss xmm8, xmm0
divss xmm9, xmm0
mov r8, qword [0x1400db390]
lea rdx, [rbp - 0x80]
add r8, 0x118
call fcn.140098a50
mov r8, qword [rbp - 0x80]
lea rdx, [rbp - 0x58]
add r8, 0x2a0
call fcn.140098a50
movdqa xmm0, xmmword [0x1400c7630]
lea rax, [rsp + 0x41]
movaps xmm14, xmmword [rsp + 0x160]
movaps xmm13, xmmword [rsp + 0x170]
movaps xmm12, xmmword [rsp + 0x180]
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x40], r14
xorps xmm0, xmm0
mov qword [rbp - 0x38], r14
mov r14, qword [rsp + 0x210]
movups xmmword [rbp - 0x50], xmm0
mov word [rsp + 0x50], 0x74
inc rbx
cmp byte [rax + rbx], 0
jne 0x140093296
mov r8, rbx
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x50]
call fcn.140002040
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.1400961f0
test dil, dil
jne 0x1400932d9
movaps xmm0, xmm6
movss dword [rbp - 0x78], xmm6
unpcklps xmm0, xmm6
movsd qword [rbp - 0x80], xmm0
jmp 0x14009331e
cmp dil, 1
jne 0x14009332c
movss xmm1, dword [0x1400da310]
movss xmm0, dword [0x1400c6fdc]
movaps xmm2, xmm1
mulss xmm2, xmm15
mulss xmm8, xmm1
mulss xmm2, xmm0
mulss xmm9, xmm1
mulss xmm8, xmm0
mulss xmm9, xmm0
unpcklps xmm2, xmm8
movsd qword [rbp - 0x80], xmm2
movss dword [rbp - 0x78], xmm9
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140096880
movaps xmm9, xmmword [rsp + 0x1b0]
movaps xmm8, xmmword [rsp + 0x1c0]
movaps xmm6, xmmword [rsp + 0x1e0]
movaps xmm15, xmmword [rsp + 0x150]
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.1400b3900
mov rdi, qword [rsp + 0x218]
add rsp, 0x1f0
pop rbp
ret