Function at 0x1400055b0
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x150
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x1402e9060]
xor rax, rsp
mov qword [rbp + 0x18], rax
xor r14d, r14d
cmp byte [0x1402fa380], r14b
jne 0x140005693
movabs rdi, 0x7ffffffed5fa0dff
movabs rsi, 0x7fffffffffffffff
movabs r15, 0x12a05f200
nop dword [rax + rax]
lea rcx, [0x1402fa300]
call fcn.14001e460
cmp byte [0x1402fa380], r14b
jne 0x140005693
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140005653
imul rax, rax, 0x64
jmp 0x14000566e
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x14000567d
lea rcx, [rax + r15]
mov qword [rbp - 0x78], rcx
jmp 0x140005681
mov qword [rbp - 0x78], rsi
lea rcx, [rbp - 0x78]
call fcn.140007b50
cmp byte [0x1402fa380], r14b
je 0x140005620
mov ecx, dword [0x1402fa3c8]
call fcn.140071c40
call fcn.140071e10
mov ecx, 1
call fcn.1400c84b0
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140008020]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140005ebb
cmp dword [rbp - 0x68], 0
je 0x140005eaf
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140005eaf
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
lea ecx, [rax + 1]
call fcn.1400c84b0
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140008050]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140005e9f
cmp dword [rbp - 0x68], 0
je 0x140005e93
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140005e93
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
lea ecx, [rax + 1]
call fcn.1400c84b0
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140008080]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140005e83
cmp dword [rbp - 0x68], 0
je 0x140005e77
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140005e77
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
lea ecx, [rax + 1]
call fcn.1400c84b0
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400080b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140005e67
cmp dword [rbp - 0x68], 0
je 0x140005e5b
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140005e5b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
cmp byte [0x1402fa0a4], al
je 0x140005e1b
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
mov rsi, qword [0x1402fa190]
mov rdi, qword [0x1402fa180]
mov dword [rbp - 0x28], 1
mov byte [rbp - 0x24], 1
mov rax, qword [0x1402fa188]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], rdi
mov rbx, qword [0x1402fa120]
mov ecx, 0x61c8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rax
mov r8, qword [0x1402fa120]
test r8, r8
je 0x140005908
mov r10d, dword [r8 + 0x3f90]
movsx rax, word [r8 + 0x6078]
lea rdx, [r8 + 0x607c]
lea rdx, [rdx + rax*8]
cmp dword [rdx], r10d
je 0x1400058fd
lea ecx, [rax + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rdx, [r8 + 0x607c]
lea rdx, [rdx + rax*8]
mov dword [rdx], r10d
mov dword [rdx + 4], r14d
inc word [rdx + 4]
inc dword [r8 + 0x6070]
mov qword [rbp - 0x50], r9
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
test r9, r9
je 0x14000592c
xor edx, edx
mov rcx, r9
call fcn.14003db30
jmp 0x14000592f
mov rax, r14
mov qword [0x1402fa120], rax
call fcn.140041790
test rbx, rbx
je 0x140005947
mov qword [0x1402fa120], rbx
mov rcx, qword [rbp - 0x40]
call fcn.14006beb0
mov rdx, rsi
mov rcx, rdi
call fcn.14006bcf0
nop
lea rax, [0x1400dca60]
mov qword [rsp + 0x48], rax
lea rax, [0x140071920]
mov qword [rsp + 0x50], rax
movzx eax, byte [rbp - 0x68]
mov byte [rsp + 0x58], al
movzx eax, byte [rbp - 0x67]
mov byte [rsp + 0x59], al
movzx eax, byte [rbp - 0x66]
mov byte [rsp + 0x5a], al
movzx eax, byte [rbp - 0x65]
mov byte [rsp + 0x5b], al
lea rax, [rbp - 0x40]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x50], rax
lea rdx, [rsp + 0x48]
call fcn.140072400
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400059d4
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movss xmm6, dword [0x1402d484c]
movss xmm7, dword [0x1402d48d0]
movss xmm8, dword [0x1402d4880]
nop dword [rax]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1402fa188]
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140005a37
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rcx, qword [0x1402fa120]
movzx eax, byte [rbp - 0x24]
mov byte [rcx + 0x58], al
lea rcx, [0x1402fa300]
call fcn.140024090
call fcn.1400269f0
mov r8d, dword [rbp - 0x20]
mov r9d, dword [rbp - 0x1c]
test r9d, r9d
jne 0x140005a68
test r8d, r8d
je 0x140005ae5
mov rcx, qword [0x1402fa1b8]
test rcx, rcx
je 0x140005a89
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1402fa1b8], r14
mov r9d, dword [rbp - 0x1c]
mov r8d, dword [rbp - 0x20]
mov rcx, qword [0x1402fa1a0]
mov rax, qword [rcx]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor edx, edx
call qword [rax + 0x68]
mov qword [rbp - 0x20], r14
mov rcx, qword [0x1402fa1a0]
mov rax, qword [rcx]
lea r9, [rbp - 0x78]
lea r8, [0x1402d47e0]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [0x1402fa180]
mov rax, qword [rcx]
lea r9, [0x1402fa1b8]
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov ecx, dword [reloc.WLDAP32.dll_Ordinal_45]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140005b31
cmp byte [0x1402fa2e8], 0
jne 0x140005b38
mov byte [0x1402fa2e8], 1
cmp byte [rbp - 0x24], 0
sete al
mov byte [rbp - 0x24], al
mov edx, 0xffffffec
mov r8d, 0x80800a8
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x140005b38
mov byte [0x1402fa2e8], 0
lea rdx, [rbp - 0x70]
mov rcx, qword [0x1402fa198]
call qword [sym.imp.USER32.dll_GetClientRect]
mov r9d, 2
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, qword [0x1402fa198]
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rbp - 0x64]
mov r8d, dword [rbp - 0x6c]
sub eax, r8d
mov r9d, dword [rbp - 0x68]
mov edx, dword [rbp - 0x70]
sub r9d, edx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
mov rcx, qword [0x1402fa188]
call qword [sym.imp.USER32.dll_MoveWindow]
mov rax, qword [0x1402fa120]
test rax, rax
je 0x140005ba1
mov rax, qword [rax + 0x98]
jmp 0x140005ba4
mov rax, r14
cmp qword [rax + 0x48], 0
jne 0x140005bb0
call fcn.14006b690
call fcn.14006c8c0
call fcn.140043c90
mov rax, qword [0x1402fa120]
cmp byte [0x1402f8c4c], 0
je 0x140005c8e
mov rax, qword [rax + 0x4b00]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140043340
mov rbx, rax
movaps xmm0, xmmword [0x1402d4ad0]
movups xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call fcn.14003fde0
mov edi, eax
movd xmm2, dword [reloc.WS2_32.dll_ioctlsocket]
cvtdq2ps xmm2, xmm2
mov rax, qword [0x1402fa120]
movss xmm1, dword [rax + 0x14]
mulss xmm1, xmm6
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm6
movss dword [rsp + 0x38], xmm0
movss dword [rsp + 0x3c], xmm1
test edi, 0xff000000
je 0x140005c8e
comiss xmm6, xmm2
ja 0x140005c8e
subss xmm2, xmm6
mov dword [rsp + 0x28], 0x167
movss dword [rsp + 0x20], xmm7
xorps xmm3, xmm3
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140061fa0
movss dword [rsp + 0x28], xmm8
mov dword [rsp + 0x20], 1
mov r9d, edi
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.1400605c0
mov dword [rbx + 0x78], r14d
mov rax, qword [0x1402fa120]
cmp byte [0x1402f8c4d], 0
je 0x140005d53
mov rax, qword [rax + 0x4b00]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.140043340
mov rbx, rax
movaps xmm0, xmmword [0x1402d4ab0]
movups xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call fcn.14003fde0
mov edi, eax
movd xmm2, dword [0x1402f8b8c]
cvtdq2ps xmm2, xmm2
mov rcx, qword [0x1402fa120]
movss xmm1, dword [rcx + 0x14]
mulss xmm1, xmm6
movss xmm0, dword [rcx + 0x10]
mulss xmm0, xmm6
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x44], xmm1
test eax, 0xff000000
je 0x140005d53
comiss xmm6, xmm2
ja 0x140005d53
subss xmm2, xmm6
mov dword [rsp + 0x28], 0x167
movss dword [rsp + 0x20], xmm7
xorps xmm3, xmm3
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140061fa0
movss dword [rsp + 0x28], xmm8
mov dword [rsp + 0x20], 1
mov r9d, edi
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.1400605c0
mov dword [rbx + 0x78], r14d
cmp byte [0x1402f8c30], 0
je 0x140005d61
call fcn.14001c940
cmp byte [0x1402f8ba0], 0
je 0x140005d6f
call fcn.1400190d0
call fcn.140045880
call fcn.140045c80
mov rcx, qword [0x1402fa190]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1402fa1b8]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rcx, qword [0x1402fa190]
mov rax, qword [rcx]
lea r8, [0x1402fa2f0]
mov rdx, qword [0x1402fa1b8]
call qword [rax + 0x190]
mov rax, qword [0x1402fa120]
mov rax, qword [rax + 0x4b00]
mov rcx, qword [rax]
add rcx, 0x48
mov rax, r14
cmp byte [rcx], r14b
cmovne rax, rcx
mov rcx, rax
call fcn.14006ac20
mov rcx, qword [0x1402fa1a0]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x40]
cmp byte [0x1402f8c78], 0
jne 0x140005e53
movsxd rax, dword [reloc.WS2_32.dll_accept]
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x50]
call fcn.140006f90
cmp dword [rbp - 0x10], 0x12
jne 0x140005a00
call fcn.140071970
nop
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1400c8490
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140071970
nop
jmp 0x140005e1b
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3