Function at 0x14003f100
Capabilities:
Create thread
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1370]
mov eax, 0x1470
call fcn.140053070
sub rsp, rax
movaps xmmword [rsp + 0x1460], xmm6
movaps xmmword [rsp + 0x1450], xmm7
movaps xmmword [rsp + 0x1440], xmm8
mov rax, qword [0x140126040]
xor rax, rsp
mov qword [rbp + 0x1330], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401285d0], eax
mov esi, 1
mov ecx, esi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401285c4], eax
lea ecx, [rdi + 8]
call fcn.140052110
lea rcx, [0x14003ea60]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400401b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14003f7f4
cmp dword [rsp + 0x68], edi
je 0x14003f7eb
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003f7eb
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rdi + 8]
call fcn.140052110
lea rcx, [0x14003e680]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400401b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14003f7db
cmp dword [rsp + 0x68], edi
je 0x14003f7d2
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003f7d2
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rdi + 8]
call fcn.140052110
lea rcx, [0x14003dca0]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400401b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14003f7c2
cmp dword [rsp + 0x68], edi
je 0x14003f7b9
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003f7b9
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea ecx, [rdi + 8]
call fcn.140052110
lea rcx, [0x14003ce90]
mov qword [rax], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x1400401b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14003f7a9
cmp dword [rsp + 0x68], edi
je 0x14003f7a0
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003f7a0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rdi + 3]
lea rcx, str..Oykyo
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140126c00], rax
test rax, rax
je 0x14003f39f
cmp rax, 0xffffffffffffffff
jne 0x14003f3d5
call fcn.140002570
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..Oykyo
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140126c00], rax
cmp byte [0x140126154], 0
je 0x14003f73d
movabs r13, 0x7ffffffffff0bdbf
movabs r12, 0x7fffffffffffffff
movabs r14, 0x4e94914f0000
movabs r15, 0x431bde82d7b634db
movsd xmm8, qword [0x14011cd10]
movss xmm7, dword [0x14011cd80]
mov ebx, 2
cmp byte [0x14012ae78], 0
je 0x14003f6a3
mov ecx, dword [0x1401260dc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f6a3
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbp + 0x1324], 0xffffffff
mov dword [rbp - 0x5c], eax
mov rcx, rsi
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rbp + rcx*4 - 0x5c], edx
inc rcx
cmp rcx, 0x270
jb 0x14003f460
mov dword [rbp - 0x60], 0x270
lea rcx, [0x140129a00]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14003f794
cmp dword [0x140129a4c], 0x7fffffff
je 0x14003f77e
mov eax, dword [0x140126120]
mov dword [0x1401285b4], eax
movd xmm0, dword [0x1401285c0]
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
movd xmm0, dword [0x1401285d4]
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm6
ja 0x14003f4fa
xorps xmm0, xmm0
sqrtsd xmm0, xmm6
jmp 0x14003f502
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
minss xmm6, xmm7
lea rcx, [rsp + 0x48]
call fcn.14003ca50
mov rax, qword [rsp + 0x48]
sub rax, qword [0x1401285c8]
cmp rax, 0x4d3f640
jl 0x14003f696
movaps xmm0, xmm6
mulss xmm0, dword [0x140126148]
mov eax, dword [0x1401285d4]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
divss xmm1, xmm6
mulss xmm1, xmm0
mov ecx, dword [0x1401285c0]
movd xmm2, ecx
cvtdq2ps xmm2, xmm2
divss xmm2, xmm6
mulss xmm2, xmm0
test eax, eax
jne 0x14003f570
test ecx, ecx
je 0x14003f682
mov rcx, qword [0x140126c00]
test rcx, rcx
je 0x14003f603
cmp rcx, 0xffffffffffffffff
je 0x14003f5c8
cvttss2si eax, xmm1
mov dword [rbp - 0x70], eax
cvttss2si eax, xmm2
mov dword [rbp - 0x6c], eax
mov word [rbp - 0x68], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rbp - 0x70]
mov edx, dword [0x140126bf8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x140126c00]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003f603
mov qword [rbp - 0x80], rdi
mov word [rbp - 0x78], si
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rbp - 0x80]
mov edx, dword [0x140126bf8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbp - 0x60]
call fcn.14003fea0
mov ecx, eax
lea rax, [rcx + rcx*2]
test eax, eax
jne 0x14003f62a
lea rcx, [rbp - 0x60]
call fcn.14003fea0
mov ecx, eax
lea rax, [rcx + rcx*2]
cmp eax, 1
jb 0x14003f616
shr rax, 0x20
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.14003f900
mov rcx, qword [0x140126c00]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003f682
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x68], bx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0xc
lea r8, [rsp + 0x60]
mov edx, dword [0x140126bf8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rsp + 0x58]
call fcn.14003ca50
mov rcx, qword [rax]
mov qword [0x1401285c8], rcx
lea rcx, [0x140129a00]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
lea rcx, [rsp + 0x70]
call fcn.14003ca50
mov rbx, qword [rsp + 0x70]
cmp rbx, r13
jge 0x14003f6c0
add rbx, 0xf4240
jmp 0x14003f6c3
mov rbx, r12
lea rcx, [rsp + 0x40]
call fcn.14003ca50
mov rax, qword [rsp + 0x40]
cmp rax, rbx
jge 0x14003f730
nop word [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jl 0x14003f6f2
mov ecx, 0x5265c00
jmp 0x14003f717
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003f715
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x40]
call fcn.14003ca50
mov rax, qword [rsp + 0x40]
cmp rax, rbx
jl 0x14003f6e0
cmp byte [0x140126154], 0
jne 0x14003f41b
mov eax, esi
mov rcx, qword [rbp + 0x1330]
xor rcx, rsp
call fcn.140051fd0
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [0x140129a4c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3