Function at 0x140001540
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Log keystrokes via polling
Register raw input devices
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x140019040]
xor rax, rsp
mov qword [rbp + 0x440], rax
movups xmm0, xmmword [str.LocalGentleClick_MUTEX]
mov r12, rcx
lea rcx, [rbp + 0x3e0]
movups xmm1, xmmword [0x14000f430]
movups xmmword [rbp + 0x3e0], xmm0
movups xmm0, xmmword [0x14000f440]
movups xmmword [rbp + 0x3f0], xmm1
movups xmmword [rbp + 0x400], xmm0
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140019ae0], eax
mov r14d, 1
test eax, eax
je 0x140001b09
lea r8, [rbp + 0x3e0]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x14001adb0], rax
test rax, rax
je 0x140001b09
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov r13d, 2
cmp eax, 0xb7
jne 0x140001733
mov rcx, qword [0x14001adb0]
mov edx, 0x12c
mov r15d, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001733
nop
cmp eax, 0x80
je 0x140001733
cmp r15d, 8
jge 0x14000172b
xor r9d, r9d
lea r8, [rbp + 0x3ec]
xor edx, edx
mov rcx, 0xfffffffffffffffd
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x14000170c
mov edx, dword [0x140019ae0]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x12c
mov rcx, rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
jne 0x14000170c
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x14000170c
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000170c
mov r8d, 0x18
lea rdx, [rbp + 0x410]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x140001703
lea rcx, [rbp + 0x410]
lea r8, [rbp + 0x3ec]
sub r8, rcx
nop
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x1400016f3
add rcx, r13
test eax, eax
jne 0x1400016e0
test edx, edx
jne 0x140001703
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14001adb0]
mov edx, 0x12c
inc r15d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140001620
jmp 0x140001733
test eax, eax
jne 0x140001b09
lea rcx, [0x140001530]
call fcn.140001d64
test eax, eax
je 0x140001755
mov rcx, qword [0x14001adb0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x140001b09
lea rax, section..text
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x70]
lea rax, [rbp + 0x3ec]
mov qword [rbp - 0x60], rdi
xorps xmm0, xmm0
mov qword [rbp - 0x30], rax
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x40], xmm1
mov qword [rbp - 0x58], r12
call qword [sym.imp.USER32.dll_RegisterClassW]
mov qword [rsp + 0x58], rdi
lea rdx, [rbp + 0x3ec]
mov qword [rsp + 0x50], r12
xor r9d, r9d
mov qword [rsp + 0x48], rdi
xor r8d, r8d
mov qword [rsp + 0x40], 0xfffffffffffffffd
xor ecx, ecx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
test rax, rax
je 0x140001b09
mov dword [rsp + 0x64], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rsp + 0x64]
mov rcx, rax
mov edx, 7
call qword [sym.imp.USER32.dll_SetUserObjectInformationW]
test eax, eax
je 0x140001b09
lea rdx, str.GC_ICON
mov dword [rbp + 0x10], 0x3d0
mov rcx, r12
mov qword [rbp + 0x18], rsi
mov dword [rbp + 0x20], edi
mov dword [rbp + 0x24], 7
mov dword [rbp + 0x28], 0x8001
call qword [sym.imp.USER32.dll_LoadIconW]
xor edx, edx
mov dword [rbp + 0x38], 0x650067
mov r8d, 0x200
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x140]
mov dword [rbp + 0x3c], 0x74006e
mov dword [rbp + 0x40], 0x65006c
mov dword [rbp + 0x44], 0x63002d
mov dword [rbp + 0x48], 0x69006c
mov qword [rbp + 0x4c], 0x6b0063
mov qword [rbp + 0x54], rdi
mov qword [rbp + 0x5c], rdi
mov qword [rbp + 0x64], rdi
mov qword [rbp + 0x6c], rdi
mov qword [rbp + 0x74], rdi
mov qword [rbp + 0x7c], rdi
mov qword [rbp + 0x84], rdi
mov qword [rbp + 0x8c], rdi
mov qword [rbp + 0x94], rdi
mov qword [rbp + 0x9c], rdi
mov qword [rbp + 0xa4], rdi
mov qword [rbp + 0xac], rdi
mov qword [rbp + 0xb4], rdi
mov qword [rbp + 0xbc], rdi
mov qword [rbp + 0xc4], rdi
mov qword [rbp + 0xcc], rdi
mov qword [rbp + 0xd4], rdi
mov qword [rbp + 0xdc], rdi
mov qword [rbp + 0xe4], rdi
mov qword [rbp + 0xec], rdi
mov qword [rbp + 0xf4], rdi
mov qword [rbp + 0xfc], rdi
mov qword [rbp + 0x104], rdi
mov qword [rbp + 0x10c], rdi
mov qword [rbp + 0x114], rdi
mov qword [rbp + 0x11c], rdi
mov qword [rbp + 0x124], rdi
mov qword [rbp + 0x12c], rdi
mov qword [rbp + 0x134], rdi
mov dword [rbp + 0x13c], edi
call fcn.14000da80
xorps xmm0, xmm0
mov dword [rbp + 0x340], edi
xor eax, eax
mov qword [rbp + 0x3c4], rdi
movups xmmword [rbp + 0x344], xmm0
mov dword [rbp + 0x3cc], edi
movups xmmword [rbp + 0x354], xmm0
mov qword [rbp + 0x3d0], rax
movups xmmword [rbp + 0x364], xmm0
mov qword [rbp + 0x3d8], rdi
movups xmmword [rbp + 0x374], xmm0
movups xmmword [rbp + 0x384], xmm0
movups xmmword [rbp + 0x394], xmm0
movups xmmword [rbp + 0x3a4], xmm0
movups xmmword [rbp + 0x3b4], xmm0
cmp qword [rbp + 0x30], rax
jne 0x1400019b1
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x30], rax
test rax, rax
je 0x140001b09
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
je 0x140001b09
mov r8d, 0x10
mov dword [rsp + 0x68], 0x20001
mov edx, r13d
mov dword [rsp + 0x6c], 0x130
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], 0x60001
mov dword [rsp + 0x7c], 0x130
mov qword [rbp - 0x80], rsi
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
je 0x140001b09
mov ecx, r13d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, r14d
shr ebx, 0xf
and bl, r14b
add bl, bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
lea rcx, [0x14001aec0]
and al, r14b
or al, bl
mov byte [0x14001aec8], al
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140001b09
lea rbx, [0x14001adc0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x140001b09
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + rbx]
shr byte [rcx + rbx + 1], 7
shr al, 7
mov byte [rcx + rbx], al
add rcx, r13
cmp rcx, 0x100
jl 0x140001a70
mov rbx, rdi
lea r15, [0x140000000]
mov r8d, dword [rbx + r15 + 0x19000]
mov edx, edi
mov r9d, dword [rbx + r15 + 0x19010]
bts r8d, 0xe
mov rcx, rsi
call qword [sym.imp.USER32.dll_RegisterHotKey]
test eax, eax
je 0x140001b09
inc edi
add rbx, 4
cmp edi, r13d
jle 0x140001a95
xor r9d, r9d
lea rcx, [rbp - 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001b05
nop word [rax + rax]
cmp eax, 0xffffffff
je 0x140001b09
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp - 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001ae0
mov r14, qword [rbp - 0x10]
mov eax, r14d
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.140001e10
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret