Function at 0x1400015f0
Capabilities:
Capture screenshot
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov ebx, 0x8000
movsd xmm11, qword [0x140004748]
movsd xmm12, qword [0x140004738]
movsd xmm8, qword [0x140004750]
movsd xmm9, qword [0x140004740]
movsd xmm10, qword [0x140004728]
nop word [rax + rax]
movaps xmm6, xmm11
movaps xmm7, xmm12
cmp byte [0x1400071cc], 0
je 0x140001969
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x140001969
mov rbx, qword [0x1400071d8]
mov qword [rsp + 0x160], rbx
mov rdi, qword [0x1400071e8]
mov qword [rsp + 0x168], rdi
mov rcx, qword [0x1400071c0]
call qword [sym.imp.USER32.dll_GetDC]
mov r13, rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r12, rax
mov eax, dword [rsp + 0x164]
mov ebp, dword [rsp + 0x16c]
sub eax, ebp
cdq
mov esi, eax
xor esi, edx
sub esi, edx
sub ebx, edi
mov eax, ebx
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov r8d, esi
mov edx, ebx
mov rcx, r13
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r15, rax
mov rdx, rax
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov r14, rax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], esi
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x1fa4
call fcn.1400030a8
mov qword [rsp + 0x168], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov dword [rsp + 0x80], 0x28
mov dword [rsp + 0x8c], 0x200001
mov dword [rsp + 0x84], 0x2d
mov dword [rsp + 0x88], 0xffffffd3
xor ebx, ebx
mov qword [rsp + 0x90], rbx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 0x2d]
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
mov rcx, qword [0x1400071c0]
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteObject]
xor al, al
mov byte [rsp + 0x160], al
mov esi, 0x7fffffff
mov ebp, esi
mov r14d, 0x80000000
mov edi, ebx
mov r13d, ebp
mov r12d, r14d
mov r15d, esi
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
mulsd xmm0, xmm7
addsd xmm0, xmm8
cvttsd2si ebx, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
mulsd xmm0, xmm7
addsd xmm0, xmm8
cvttsd2si r8d, xmm0
mov eax, edi
and eax, 0x8000000f
jge 0x140001856
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x14000185f
addsd xmm7, xmm9
addsd xmm6, xmm10
cmp ebx, 0x2c
ja 0x1400018ec
cmp r8d, 0x2d
ja 0x1400018ec
imul eax, r8d, 0x2d
add eax, ebx
cdqe
mov rcx, qword [rsp + 0x168]
mov edx, dword [rcx + rax*4]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx r9d, al
movzx r10d, dl
lea eax, [rcx - 0x79]
cmp eax, 0x86
ja 0x1400018de
lea eax, [r9 - 0x79]
cmp eax, 0x86
ja 0x1400018de
lea eax, [r10 - 1]
cmp eax, 0x4f
ja 0x1400018de
mov byte [rsp + 0x160], 1
mov esi, ebx
cmp ebx, r15d
cmovge esi, r15d
mov r14d, ebx
cmp ebx, r12d
cmovle r14d, r12d
mov ebp, r8d
cmp r8d, r13d
cmovge ebp, r13d
inc edi
cmp edi, 0x2d0
jl 0x140001812
cmp byte [rsp + 0x160], 0
je 0x140001957
lea eax, [rbp - 0x15]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
lea eax, [r14 + rsi]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x16
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvttss2si rbx, xmm0
mov edi, 1
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, ebx
mov ecx, edi
test ax, ax
je 0x140001944
addss xmm6, dword [0x140004730]
jmp 0x14000194c
subss xmm6, dword [0x140004724]
cvttss2si r8, xmm6
call qword [sym.imp.USER32.dll_mouse_event]
mov rcx, qword [rsp + 0x168]
call fcn.140002df4
mov ebx, 0x8000
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001680