Function at 0x140005bd0
Capabilities:
Log keystrokes via polling
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov eax, dword [0x14000b048]
mov rsi, rcx
add eax, 0x1cf
movaps xmmword [rsp + 0x40], xmm7
movss xmm7, dword [0x1400097dc]
mov dword [rsp + 0x28], 0xdc000000
movss dword [rsp + 0x20], xmm7
movd xmm0, eax
mov eax, dword [0x14000b04c]
add eax, 0x3c
cvtdq2ps xmm0, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movaps xmm2, xmm0
addss xmm1, dword [0x1400097c0]
addss xmm2, dword [0x140009834]
movaps xmm3, xmm1
call fcn.140004ba0
movss xmm2, dword [0x140009798]
movaps xmm3, xmm7
mov eax, dword [0x14000b04c]
add eax, 0x3b
mov dword [rsp + 0x28], 0xff6495ed
movss dword [rsp + 0x20], xmm2
movss xmm2, dword [0x140009834]
movd xmm1, eax
mov eax, dword [0x14000b048]
add eax, 0x1ce
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
call fcn.140004000
lea rcx, str.Mpbe_tfuujoht
call fcn.140007d90
mov r9, rax
xor ebp, ebp
mov eax, dword [0x14000b04c]
or r8d, 0xffffffff
add eax, 0x3c
mov dword [rsp + 0x20], ebp
movd xmm1, eax
mov eax, dword [0x14000b048]
add eax, 0x1ec
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
call fcn.140004970
mov ebx, dword [0x14000b04c]
lea rcx, [0x14001ff18]
mov edi, dword [0x14000b048]
add ebx, 0x3c
add edi, 0x1d1
mov dword [0x14001ff18], 0x18
call qword [sym.imp.USER32.dll_GetCursorInfo]
mov ecx, dword [0x14001ff28]
cmp ecx, edi
jl 0x140005e28
lea eax, [rdi + 0x82]
cmp ecx, eax
jg 0x140005e28
mov ecx, dword [0x14001ff2c]
cmp ecx, ebx
jl 0x140005e28
lea eax, [rbx + 0xf]
cmp ecx, eax
jg 0x140005e28
mov eax, dword [0x14000b048]
add eax, 0x1cf
mov dword [rsp + 0x28], 0x1effffff
movss dword [rsp + 0x20], xmm7
movd xmm0, eax
mov eax, dword [0x14000b04c]
add eax, 0x3c
cvtdq2ps xmm0, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movaps xmm2, xmm0
addss xmm1, dword [0x1400097c0]
addss xmm2, dword [0x140009834]
movaps xmm3, xmm1
call fcn.140004ba0
mov rax, qword [0x14001ff88]
test rax, rax
jne 0x140005e42
lea rcx, str.OuVtfsHfuLfzTubuf
call fcn.140007d90
lea rcx, str.win32u.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001ff88], rax
test rax, rax
jne 0x140005e42
lea ecx, [rbp + 1]
call qword [sym.imp.USER32.dll_GetKeyState]
movsx rcx, ax
shr rcx, 0x10
test cx, cx
jne 0x140005e5a
mov byte [0x140023278], bpl
cmp dword [0x1400202ac], ebp
jle 0x140005e28
lea rcx, str.Mpbefe
call fcn.140007d90
mov r9, rax
mov dword [rsp + 0x20], ebp
mov eax, dword [0x14000b04c]
or r8d, 0xffffffff
add eax, 0x50
movd xmm1, eax
mov eax, dword [0x14000b048]
add eax, 0x1ef
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
call fcn.140004970
dec dword [0x1400202ac]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
mov ecx, 1
call rax
movsx rcx, ax
shr rcx, 0x10
test cx, cx
je 0x140005dd5
cmp byte [0x140023278], bpl
je 0x140005e81
cmp dword [0x14002327c], ebp
je 0x140005ddc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x14002327c], eax
ja 0x140005ddc
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, str.settings
mov edx, 0x80000000
mov byte [0x140023278], 1
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005edb
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
mov r8d, 0x620
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1400202ac], 0x14
jmp 0x140005de4