Function at 0x14007d2f0
Capabilities:
Check for foreground window switch
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x418
call fcn.14007c710
movzx eax, al
test eax, eax
jne 0x14007d675
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x41]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x60], al
movabs rax, 0xf0b6b65f96645370
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0xa0], rax
movabs rax, 0xbc41dc73850bcab4
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0xa8], rax
movabs rax, 0x65625de31d922a1f
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0xb0], rax
movabs rax, 0x1d4ac8fe7ebcb568
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xb8], rax
movabs rax, 0xf0d9b62d96165335
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x260], rax
movabs rax, 0xbc70dc50852bcac6
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x268], rax
movabs rax, 0x65625de31d922a1f
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x270], rax
movabs rax, 0x1d4ac8fe7ebcb568
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x278], rax
xor eax, eax
test eax, eax
je 0x14007d4b9
jmp 0x14007d509
movdqa xmm0, xmmword [rsp + 0x260]
movdqa xmmword [rsp + 0x3f0], xmm0
movdqa xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x3e0], xmm0
movdqa xmm0, xmmword [rsp + 0x3e0]
xorps xmm0, xmmword [rsp + 0x3f0]
movdqa xmmword [rsp + 0x290], xmm0
movdqa xmm0, xmmword [rsp + 0x290]
movdqa xmmword [rsp + 0xa0], xmm0
xor eax, eax
test eax, eax
je 0x14007d511
jmp 0x14007d56a
lea rax, [rsp + 0x270]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2b0], xmm0
lea rax, [rsp + 0xb0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2a0], xmm0
movdqa xmm0, xmmword [rsp + 0x2a0]
xorps xmm0, xmmword [rsp + 0x2b0]
movdqa xmmword [rsp + 0x2c0], xmm0
lea rax, [rsp + 0xb0]
movdqa xmm0, xmmword [rsp + 0x2c0]
movdqu xmmword [rax], xmm0
xor eax, eax
cmp eax, 1
je 0x14007d573
jmp 0x14007d5cc
lea rax, [rsp + 0x280]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x370], xmm0
lea rax, [rsp + 0xc0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2d0], xmm0
movdqa xmm0, xmmword [rsp + 0x2d0]
xorps xmm0, xmmword [rsp + 0x370]
movdqa xmmword [rsp + 0x2e0], xmm0
lea rax, [rsp + 0xc0]
movdqa xmm0, xmmword [rsp + 0x2e0]
movdqu xmmword [rax], xmm0
xor eax, eax
cmp eax, 1
je 0x14007d5d5
jmp 0x14007d62e
lea rax, [rsp + 0x290]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x300], xmm0
lea rax, [rsp + 0xd0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2f0], xmm0
movdqa xmm0, xmmword [rsp + 0x2f0]
xorps xmm0, xmmword [rsp + 0x300]
movdqa xmmword [rsp + 0x310], xmm0
lea rax, [rsp + 0xd0]
movdqa xmm0, xmmword [rsp + 0x310]
movdqu xmmword [rax], xmm0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x160], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x160]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rsp + 0x430]
call fcn.140077960
nop
mov rcx, qword [rsp + 0x438]
call fcn.140077960
jmp 0x14007e0b9
call fcn.14007c1e0
movzx eax, al
test eax, eax
jne 0x14007d9e7
lea rax, [rsp + 0x43]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x45]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x43]
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0x44]
mov byte [rsp + 0x70], al
movzx eax, byte [rsp + 0x45]
mov byte [rsp + 0x78], al
movabs rax, 0xf0b6b65f96645370
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0xd0], rax
movabs rax, 0xbc42dc73850bcab4
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0xd8], rax
movabs rax, 0x65625de31d922a1f
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0xe0], rax
movabs rax, 0x1d4ac8fe7ebcb568
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xe8], rax
movabs rax, 0xf0d9b62d96165335
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x230], rax
movabs rax, 0xbc70dc50852bcac6
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x238], rax
movabs rax, 0x65625de31d922a1f
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x240], rax
movabs rax, 0x1d4ac8fe7ebcb568
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x248], rax
xor eax, eax
test eax, eax
je 0x14007d82b
jmp 0x14007d87b
movdqa xmm0, xmmword [rsp + 0x230]
movdqa xmmword [rsp + 0x330], xmm0
movdqa xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x320], xmm0
movdqa xmm0, xmmword [rsp + 0x320]
xorps xmm0, xmmword [rsp + 0x330]
movdqa xmmword [rsp + 0x340], xmm0
movdqa xmm0, xmmword [rsp + 0x340]
movdqa xmmword [rsp + 0xd0], xmm0
xor eax, eax
test eax, eax
je 0x14007d883
jmp 0x14007d8dc
lea rax, [rsp + 0x240]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x360], xmm0
lea rax, [rsp + 0xe0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x350], xmm0
movdqa xmm0, xmmword [rsp + 0x350]
xorps xmm0, xmmword [rsp + 0x360]
movdqa xmmword [rsp + 0x400], xmm0
lea rax, [rsp + 0xe0]
movdqa xmm0, xmmword [rsp + 0x400]
movdqu xmmword [rax], xmm0
xor eax, eax
cmp eax, 1
je 0x14007d8e5
jmp 0x14007d93e
lea rax, [rsp + 0x250]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x390], xmm0
lea rax, [rsp + 0xf0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x380], xmm0
movdqa xmm0, xmmword [rsp + 0x380]
xorps xmm0, xmmword [rsp + 0x390]
movdqa xmmword [rsp + 0x3a0], xmm0
lea rax, [rsp + 0xf0]
movdqa xmm0, xmmword [rsp + 0x3a0]
movdqu xmmword [rax], xmm0
xor eax, eax
cmp eax, 1
je 0x14007d947
jmp 0x14007d9a0
lea rax, [rsp + 0x260]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x3c0], xmm0
lea rax, [rsp + 0x100]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x3b0], xmm0
movdqa xmm0, xmmword [rsp + 0x3b0]
xorps xmm0, xmmword [rsp + 0x3c0]
movdqa xmmword [rsp + 0x3d0], xmm0
lea rax, [rsp + 0x100]
movdqa xmm0, xmmword [rsp + 0x3d0]
movdqu xmmword [rax], xmm0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x1c8], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1c8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rsp + 0x430]
call fcn.140077960
nop
mov rcx, qword [rsp + 0x438]
call fcn.140077960
jmp 0x14007e0b9
mov r8d, 0x30
xor edx, edx
lea rcx, [0x140091130]
call sub.VCRUNTIME140.dll_memset
cmp dword [0x140091138], 0x12
je 0x14007e098
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x140091060]
lea rcx, [0x140091130]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14007da48
lea rcx, [0x140091130]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x140091130]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x100], rax
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14007da74
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rax, qword [0x140091068]
cmp qword [rsp + 0x100], rax
jne 0x14007dad3
mov edx, 3
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1d0]
mov rcx, qword [0x140091060]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0x90]
call sub.VCRUNTIME140.dll_memset
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x90]
mov rcx, qword [0x140091068]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rdx, [rsp + 0x80]
mov rcx, qword [0x140091068]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x94], eax
call fcn.140014cf0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [0x140091068]
mov qword [rax + 0x100], rcx
mov rax, qword [rsp + 0x48]
movss xmm0, dword [0x14008b800]
movss dword [rax + 0x10], xmm0
lea rcx, [rsp + 0x108]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x80]
mov ecx, dword [rsp + 0x108]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov rax, qword [rsp + 0x48]
movss dword [rax + 0x110], xmm0
mov eax, dword [rsp + 0x84]
mov ecx, dword [rsp + 0x10c]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov rax, qword [rsp + 0x48]
movss dword [rax + 0x114], xmm0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14007dc4c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
mov byte [rcx + rax + 0x118], 1
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
mov byte [rcx + rax + 0x428], 1
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
movss xmm0, dword [rdx + 0x110]
movss dword [rcx + rax + 0x3d4], xmm0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
movss xmm0, dword [rdx + 0x114]
movss dword [rcx + rax + 0x3d4], xmm0
jmp 0x14007dc62
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
mov byte [rcx + rax + 0x118], 0
mov eax, dword [0x140091120]
cmp dword [rsp + 0x90], eax
jne 0x14007dca2
mov eax, dword [0x140091128]
cmp dword [rsp + 0x98], eax
jne 0x14007dca2
mov eax, dword [0x140091124]
cmp dword [rsp + 0x94], eax
jne 0x14007dca2
mov eax, dword [0x14009112c]
cmp dword [rsp + 0x9c], eax
je 0x14007ddc0
lea rax, [0x140091120]
lea rcx, [rsp + 0x90]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_Sleep]
cvtsi2ss xmm0, dword [rsp + 0x98]
movss xmm1, dword [0x140090080]
addss xmm1, xmm0
movaps xmm0, xmm1
movss dword [0x140090080], xmm0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cvtsi2ss xmm0, dword [rsp + 0x9c]
movss dword [0x140090084], xmm0
movss xmm0, dword [0x140090080]
addss xmm0, dword [0x140090088]
cvttss2si rax, xmm0
mov dword [0x140091090], eax
movss xmm0, dword [0x140090084]
addss xmm0, dword [0x140090088]
cvttss2si rax, xmm0
mov dword [0x140091094], eax
movss xmm0, dword [0x140090084]
addss xmm0, dword [0x140090088]
cvttss2si eax, xmm0
movss xmm0, dword [0x140090080]
addss xmm0, dword [0x140090088]
cvttss2si ecx, xmm0
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsp + 0x84]
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, qword [0x140091060]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x1d8], rax
lea rdx, [0x140091090]
mov rcx, qword [0x140091080]
call qword [rsp + 0x1d8]
call fcn.140042cf0
call fcn.140044020
call fcn.14001f0b0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x110], rax
mov rax, qword [0x140091060]
cmp qword [rsp + 0x110], rax
jne 0x14007de3c
mov edx, 3
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rsp + 0x1e0], rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1e0]
mov rcx, qword [0x140091060]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14007de9c
movzx eax, byte [0x140091058]
xor eax, 1
mov byte [0x140091058], al
movzx eax, byte [0x140091058]
test eax, eax
je 0x14007de77
mov dword [rsp + 0x88], 0xa0
jmp 0x14007de82
mov dword [rsp + 0x88], 0x800a0
mov r8d, dword [rsp + 0x88]
mov edx, 0xffffffec
mov rcx, qword [0x140091060]
call qword [sym.imp.USER32.dll_SetWindowLongA]
call fcn.140015910
xorps xmm0, xmm0
movss dword [rax + 0xc], xmm0
call fcn.140015910
xorps xmm0, xmm0
movss dword [rax + 0x3c], xmm0
movzx eax, byte [0x140091058]
test eax, eax
je 0x14007dece
mov rcx, qword [rsp + 0x430]
call fcn.140077790
mov rcx, qword [rsp + 0x438]
call fcn.140077790
call fcn.1400115d0
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rsp + 0x1e8], rax
xor r8d, r8d
mov edx, 7
mov rcx, qword [0x140091080]
call qword [rsp + 0x1e8]
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rsp + 0x1f0], rax
xor r8d, r8d
mov edx, 0x1b
mov rcx, qword [0x140091080]
call qword [rsp + 0x1f0]
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rax, qword [rax + 0x1c8]
mov qword [rsp + 0x1f8], rax
xor r8d, r8d
mov edx, 0xae
mov rcx, qword [0x140091080]
call qword [rsp + 0x1f8]
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rax, qword [rax + 0x158]
mov qword [rsp + 0x200], rax
mov dword [rsp + 0x30], 0
movss xmm0, dword [0x140087200]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140091080]
call qword [rsp + 0x200]
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rcx, qword [0x140091080]
call qword [rax + 0x148]
test eax, eax
jl 0x14007e001
call fcn.140020e40
call fcn.140014850
mov rcx, rax
call fcn.140042d10
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rcx, qword [0x140091080]
call qword [rax + 0x150]
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140091080]
call qword [rsp + 0x208]
cmp eax, 0x88760868
jne 0x14007e093
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rcx, qword [0x140091080]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14007e093
call fcn.140042c30
mov rax, qword [0x140091080]
mov rax, qword [rax]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x210], rax
lea rdx, [0x140091090]
mov rcx, qword [0x140091080]
call qword [rsp + 0x210]
call fcn.1400429f0
jmp 0x14007d9fb
call fcn.14007e0d0
nop
mov rcx, qword [rsp + 0x430]
call fcn.140077960
nop
mov rcx, qword [rsp + 0x438]
call fcn.140077960
add rsp, 0x418
pop rdi
pop rsi
ret