Function at 0x140048790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0xa0
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
mov rax, qword [0x140063020]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, qword [0x14008a6d0]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
lea r14, [rsp + 0xa8]
movabs rbp, 0xff00ff00ff00ff00
mov qword [r11 - 0x40], rbp
mov qword [r11 - 0x38], r14
mov rdi, qword [r14]
mov rbx, rdi
xor rbx, rbp
mov qword [r11 - 0x48], rbx
mov qword [r14], rax
test rsi, rsi
jne 0x14004880d
mov qword [r14], rdi
jmp 0x140048a40
lea rcx, [rsi + 0x360]
call fcn.14004de60
movaps xmm6, xmm0
lea rcx, [rsi + 0x368]
call fcn.14004de60
addss xmm0, dword [0x140059c30]
comiss xmm0, xmm6
jb 0x140048805
mov r8d, 0x6d
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.140044390
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x40], xmm0
movsd xmm1, qword [rsp + 0x30]
movsd qword [rsp + 0x50], xmm1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140044000
xorps xmm2, xmm2
xorps xmm7, xmm7
xorps xmm6, xmm6
movss xmm5, dword [0x140063060]
movsd xmm4, qword [rsp + 0x20]
ucomisd xmm4, xmm2
jp 0x14004888c
je 0x1400488f3
mov eax, dword [0x14008a6e8]
movd xmm3, eax
cvtdq2pd xmm3, xmm3
comisd xmm4, xmm3
jbe 0x1400488cf
movaps xmm7, xmm3
subsd xmm7, xmm4
xorps xmm7, xmmword [0x140059f90]
cvtps2pd xmm0, xmm5
divsd xmm7, xmm0
movaps xmm1, xmm7
addsd xmm1, xmm3
add eax, eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x1400488cf
xorps xmm7, xmm7
comisd xmm3, xmm4
jbe 0x1400488f3
movaps xmm7, xmm4
subsd xmm7, xmm3
cvtps2pd xmm0, xmm5
divsd xmm7, xmm0
movaps xmm0, xmm7
addsd xmm0, xmm3
comisd xmm2, xmm0
jbe 0x1400488f3
xorps xmm7, xmm7
movsd xmm3, qword [rsp + 0x28]
ucomisd xmm3, xmm2
jp 0x140048901
je 0x140048968
mov eax, dword [0x14008a6f0]
movd xmm4, eax
cvtdq2pd xmm4, xmm4
comisd xmm3, xmm4
jbe 0x140048944
movaps xmm6, xmm4
subsd xmm6, xmm3
xorps xmm6, xmmword [0x140059f90]
cvtps2pd xmm0, xmm5
divsd xmm6, xmm0
movaps xmm1, xmm6
addsd xmm1, xmm4
add eax, eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x140048944
xorps xmm6, xmm6
comisd xmm4, xmm3
jbe 0x140048968
movaps xmm6, xmm3
subsd xmm6, xmm4
cvtps2pd xmm0, xmm5
divsd xmm6, xmm0
movaps xmm0, xmm6
addsd xmm0, xmm4
comisd xmm2, xmm0
jbe 0x140048968
xorps xmm6, xmm6
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400489a0
mov rdi, qword [0x14008a6f8]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov rdx, rdi
mov ecx, dword [rdi + 0x10]
call qword [sym.imp.XINPUT1_4.dll_Ordinal_2]
mov rax, qword [rdi]
shr rax, 0x30
test al, al
je 0x140048a3a
cvttsd2si ecx, xmm6
cvttsd2si eax, xmm7
mov dword [rsp + 0x48], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], ecx
mov edx, 0x1000
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140048a3a
movups xmm0, xmmword [0x14008a698]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x14008a6a8]
movsd qword [rax + 0x10], xmm1
mov edi, dword [0x14008a6b0]
mov dword [rax + 0x18], edi
movzx edi, word [0x14008a6b4]
mov word [rax + 0x1c], di
mov edx, 1
lea rcx, [rsp + 0x40]
call rsi
mov rdi, rsi
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
xor rbx, rbp
mov qword [r14], rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004f500
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
ret