Function at 0x140005f00
Capabilities:
Log keystrokes via polling
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov eax, dword [0x14000b048]
mov rsi, rcx
add eax, 0x139
movaps xmmword [rsp + 0x40], xmm7
movss xmm7, dword [0x1400097dc]
mov dword [rsp + 0x28], 0xdc000000
movss dword [rsp + 0x20], xmm7
movd xmm0, eax
mov eax, dword [0x14000b04c]
add eax, 0x3c
cvtdq2ps xmm0, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movaps xmm2, xmm0
addss xmm1, dword [0x1400097c0]
addss xmm2, dword [0x140009834]
movaps xmm3, xmm1
call fcn.140004ba0
movss xmm2, dword [0x140009798]
movaps xmm3, xmm7
mov eax, dword [0x14000b04c]
add eax, 0x3b
mov dword [rsp + 0x28], 0xff6495ed
movss dword [rsp + 0x20], xmm2
movss xmm2, dword [0x140009834]
movd xmm1, eax
mov eax, dword [0x14000b048]
add eax, 0x138
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
call fcn.140004000
lea rcx, str.Tbwf_Tfuujoht
call fcn.140007d90
mov r9, rax
xor ebp, ebp
mov eax, dword [0x14000b04c]
or r8d, 0xffffffff
add eax, 0x3c
mov dword [rsp + 0x20], ebp
movd xmm1, eax
mov eax, dword [0x14000b048]
add eax, 0x156
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
call fcn.140004970
mov ebx, dword [0x14000b04c]
lea rcx, [0x14001ff18]
mov edi, dword [0x14000b048]
add ebx, 0x3c
add edi, 0x13b
mov dword [0x14001ff18], 0x18
call qword [sym.imp.USER32.dll_GetCursorInfo]
mov ecx, dword [0x14001ff28]
cmp ecx, edi
jl 0x140006158
lea eax, [rdi + 0x82]
cmp ecx, eax
jg 0x140006158
mov ecx, dword [0x14001ff2c]
cmp ecx, ebx
jl 0x140006158
lea eax, [rbx + 0xf]
cmp ecx, eax
jg 0x140006158
mov eax, dword [0x14000b048]
add eax, 0x139
mov dword [rsp + 0x28], 0x1effffff
movss dword [rsp + 0x20], xmm7
movd xmm0, eax
mov eax, dword [0x14000b04c]
add eax, 0x3c
cvtdq2ps xmm0, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movaps xmm2, xmm0
addss xmm1, dword [0x1400097c0]
addss xmm2, dword [0x140009834]
movaps xmm3, xmm1
call fcn.140004ba0
mov rax, qword [0x14001ff88]
test rax, rax
jne 0x140006172
lea rcx, str.OuVtfsHfuLfzTubuf
call fcn.140007d90
lea rcx, str.win32u.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001ff88], rax
test rax, rax
jne 0x140006172
lea ecx, [rbp + 1]
call qword [sym.imp.USER32.dll_GetKeyState]
movsx rcx, ax
shr rcx, 0x10
test cx, cx
jne 0x14000618a
mov byte [0x140023278], bpl
cmp dword [0x1400202ac], ebp
jle 0x140006158
lea rcx, str.Tbwfe
call fcn.140007d90
mov r9, rax
mov dword [rsp + 0x20], ebp
mov eax, dword [0x14000b04c]
or r8d, 0xffffffff
add eax, 0x50
movd xmm1, eax
mov eax, dword [0x14000b048]
add eax, 0x159
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
call fcn.140004970
dec dword [0x1400202ac]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
mov ecx, 1
call rax
movsx rcx, ax
shr rcx, 0x10
test cx, cx
je 0x140006105
cmp byte [0x140023278], bpl
je 0x1400061b1
cmp dword [0x14002327c], ebp
je 0x14000610c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x14002327c], eax
ja 0x14000610c
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, str.settings
mov edx, 0x40000000
mov byte [0x140023278], 1
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000620b
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
mov r8d, 0x620
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1400202ac], 0x14
jmp 0x140006114