Function at 0x1400a4087
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
jmp 0x1401e7bb0
push rbp
push rsi
push rdi
sub rsp, 0x200
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14025bb80]
xor rax, rbp
mov qword [rbp + 0x1b0], rax
lea rcx, [0x1402733d9]
call fcn.1400a676f
nop
mov r8d, 0x30
xor edx, edx
lea rcx, [0x140263e20]
call fcn.1400a5dce
nop
cmp dword [0x140263e28], 0x12
je 0x1401e80e4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x140263dd8]
lea rcx, [0x140263e20]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1401e7c53
lea rcx, [0x140263e20]
call qword [sym.imp.USER32.dll_TranslateMessage]
nop
lea rcx, [0x140263e20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop
cmp qword [0x140263e50], 0
jne 0x1401e7c66
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 8], rax
mov rax, qword [0x140263e50]
cmp qword [rbp + 8], rax
jne 0x1401e7cc2
mov edx, 3
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbp + 0x28], rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [0x140263dd8]
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
jmp 0x1401e7ce0
mov ecx, dword [0x140263edc]
call fcn.1400a4bef
mov qword [0x140263e50], rax
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov r8d, 0x10
xor edx, edx
lea rcx, [rbp + 0x48]
call fcn.1400a5dce
nop
mov r8d, 8
xor edx, edx
lea rcx, [rbp + 0x78]
call fcn.1400a5dce
nop
mov eax, dword [rbp + 0x78]
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x7c]
mov dword [rbp + 0x4c], eax
call fcn.1400a5e28
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
movss xmm0, dword [0x14020bdd4]
movss dword [rax + 0x10], xmm0
lea rcx, [rbp + 0xb8]
call qword [sym.imp.USER32.dll_GetCursorPos]
nop
mov eax, dword [rbp + 0x78]
mov ecx, dword [rbp + 0xb8]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov rax, qword [rbp + 0x98]
movss dword [rax + 0xdf8], xmm0
mov eax, dword [rbp + 0x7c]
mov ecx, dword [rbp + 0xbc]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov rax, qword [rbp + 0x98]
movss dword [rax + 0xdfc], xmm0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1401e7e14
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x98]
mov byte [rcx + rax + 0xe00], 1
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x98]
mov byte [rcx + rax + 0x3738], 1
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x98]
movss xmm0, dword [rdx + 0xdf8]
movss dword [rcx + rax + 0x36e8], xmm0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x98]
movss xmm0, dword [rdx + 0xdfc]
movss dword [rcx + rax + 0x36e8], xmm0
jmp 0x1401e7e2c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x98]
mov byte [rcx + rax + 0xe00], 0
mov eax, dword [0x140263e90]
cmp dword [rbp + 0x48], eax
jne 0x1401e7e5c
mov eax, dword [0x140263e98]
cmp dword [rbp + 0x50], eax
jne 0x1401e7e5c
mov eax, dword [0x140263e94]
cmp dword [rbp + 0x4c], eax
jne 0x1401e7e5c
mov eax, dword [0x140263e9c]
cmp dword [rbp + 0x54], eax
je 0x1401e7eff
lea rax, [0x140263e90]
lea rcx, [rbp + 0x48]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rbp + 0x50]
mov dword [0x140263ef0], eax
mov eax, dword [rbp + 0x54]
mov dword [0x140263ef4], eax
mov eax, dword [0x140263ef0]
mov dword [0x140263de0], eax
mov eax, dword [0x140263ef4]
mov dword [0x140263de4], eax
mov dword [rsp + 0x30], 8
mov eax, dword [0x140263ef4]
mov dword [rsp + 0x28], eax
mov eax, dword [0x140263ef0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x7c]
mov r8d, dword [rbp + 0x78]
xor edx, edx
mov rcx, qword [0x140263dd8]
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x1a8], rax
lea rdx, [0x140263de0]
mov rcx, qword [0x140263dd0]
call qword [rbp + 0x1a8]
nop
call fcn.1400a5040
nop
call fcn.1400a5937
nop
call fcn.1400a5d1f
nop
call fcn.1400a68eb
nop
call fcn.1400a5d60
nop
call fcn.1400a4a37
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rbp + 0x1a8], rax
xor r8d, r8d
mov edx, 7
mov rcx, qword [0x140263dd0]
call qword [rbp + 0x1a8]
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rbp + 0x1a8], rax
xor r8d, r8d
mov edx, 0x1b
mov rcx, qword [0x140263dd0]
call qword [rbp + 0x1a8]
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rbp + 0x1a8], rax
xor r8d, r8d
mov edx, 0xae
mov rcx, qword [0x140263dd0]
call qword [rbp + 0x1a8]
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rax, qword [rax + 0x158]
mov qword [rbp + 0x1a8], rax
mov dword [rsp + 0x30], 0
movss xmm0, dword [0x14020be2c]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140263dd0]
call qword [rbp + 0x1a8]
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rcx, qword [0x140263dd0]
call qword [rax + 0x148]
test eax, eax
jl 0x1401e8043
call fcn.1400a6620
nop
call fcn.1400a63dc
mov rcx, rax
call fcn.1400a6440
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rcx, qword [0x140263dd0]
call qword [rax + 0x150]
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rax, qword [rax + 0x88]
mov qword [rbp + 0x1a8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140263dd0]
call qword [rbp + 0x1a8]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0x88760868
jne 0x1401e80df
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rcx, qword [0x140263dd0]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x1401e80df
call fcn.1400a4cd0
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x1a8], rax
lea rdx, [0x140263de0]
mov rcx, qword [0x140263dd0]
call qword [rbp + 0x1a8]
nop
call fcn.1400a65bc
nop
jmp 0x1401e7c04
call fcn.1400a5a27
nop
call fcn.1400a46ea
nop
xor ecx, ecx
call fcn.1400a59ff
nop
cmp qword [0x140263dd0], 0
je 0x1401e812f
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rcx, qword [0x140263dd0]
call qword [rax + 0x150]
nop
mov rax, qword [0x140263dd0]
mov rax, qword [rax]
mov rcx, qword [0x140263dd0]
call qword [rax + 0x10]
nop
cmp qword [0x140263dc8], 0
je 0x1401e814e
mov rax, qword [0x140263dc8]
mov rax, qword [rax]
mov rcx, qword [0x140263dc8]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140263dd8]
call qword [sym.imp.USER32.dll_DestroyWindow]
nop
mov rax, qword [0x140263e30]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1402434d0]
call fcn.1400a60df
mov rax, rdi
mov rcx, qword [rbp + 0x1b0]
xor rcx, rbp
call fcn.1400a52ac
lea rsp, [rbp + 0x1c0]
pop rdi
pop rsi
pop rbp
ret