Function at 0x1400296b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1401793c0]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov qword [rsp + 0x30], rcx
cmp byte [0x1402223f2], 0
je 0x14002a0b6
lea rdx, [rcx + 0xb0]
lea rcx, [rbp + 0xd8]
call fcn.1400090e0
lea rdx, [rbp + 0xd8]
mov r13, qword [rbp + 0xd8]
mov rbx, qword [rbp + 0xf0]
cmp rbx, 0xf
cmova rdx, r13
lea rcx, [0x1401ad808]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1401ad808]
mov r8, qword [0x1401ad818]
mov r12, qword [rbp + 0xe8]
cmp r8, r12
jne 0x14002975d
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140029789
mov byte [0x14022241c], 0
lea rdx, [rbp + 0xd8]
cmp rbx, 0xf
cmova rdx, r13
mov r8, r12
lea rcx, [0x1401ad808]
call fcn.140022ba0
mov r13, qword [rbp + 0xd8]
vpxor xmm0, xmm0, xmm0
xor eax, eax
vmovups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
mov byte [rbp + 0xc0], 0x5a
mov al, reloc.WLDAP32.dll_Ordinal_41
mov cl, 0x37
mov dl, 0x35
mov r8b, Ordinal_50
mov r9b, 0x3f
mov r10b, 0x3d
mov r11b, Ordinal_41
movzx ebx, r9b
mov dil, 0x34
mov sil, Ordinal_60
mov r14b, 0x3e
movzx r15d, r9b
xor r12d, r12d
xor al, 0x5a
mov byte [rbp + 0xc1], al
xor cl, 0x5a
mov byte [rbp + 0xc2], cl
xor dl, 0x5a
mov byte [rbp + 0xc3], dl
xor r8b, 0x5a
mov byte [rbp + 0xc4], r8b
xor r9b, 0x5a
mov byte [rbp + 0xc5], r9b
xor r10b, 0x5a
mov byte [rbp + 0xc6], r10b
xor r11b, 0x5a
mov byte [rbp + 0xc7], r11b
xor bl, 0x5a
mov byte [rbp + 0xc8], bl
xor dil, 0x5a
mov byte [rbp + 0xc9], dil
xor sil, 0x5a
mov byte [rbp + 0xca], sil
xor r14b, 0x5a
mov byte [rbp + 0xcb], r14b
xor r15b, 0x5a
mov byte [rbp + 0xcc], r15b
mov byte [rbp + 0xcd], r12b
vmovups xmmword [rsp + 0x40], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp + 0xc1]
mov r14, 0xffffffffffffffff
mov r8, r14
mov r12, qword [rbp + 0xe8]
inc r8
cmp byte [rax + r8], 0
jne 0x140029875
lea rdx, [rbp + 0xc1]
lea rcx, [rsp + 0x40]
call fcn.1400079a0
mov byte [rbp + 0xc0], WSAGetLastError
mov al, 8
mov cl, 2
mov dl, reloc.WS2_32.dll_ntohs
mov r8b, Ordinal_30
mov r9b, 6
mov r10b, ntohl
movzx r11d, dl
xor bl, bl
mov dil, 9
xor esi, esi
xor al, 0x6e
mov byte [rbp + 0xc1], al
xor cl, 0x6e
mov byte [rbp + 0xc2], cl
xor dl, 0x6e
mov byte [rbp + 0xc3], dl
xor r8b, 0x6e
mov byte [rbp + 0xc4], r8b
xor r9b, 0x6e
mov byte [rbp + 0xc5], r9b
xor r10b, 0x6e
mov byte [rbp + 0xc6], r10b
xor r11b, 0x6e
mov byte [rbp + 0xc7], r11b
xor bl, 0x6e
mov byte [rbp + 0xc8], bl
xor dil, 0x6e
mov byte [rbp + 0xc9], dil
mov byte [rbp + 0xca], sil
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x60], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
inc r8
cmp byte [rax + r8], sil
jne 0x140029930
lea rdx, [rbp + 0xc1]
lea rcx, [rsp + 0x60]
call fcn.1400079a0
mov byte [rbp + 0xc0], WSAGetLastError
mov al, 2
mov cl, reloc.WS2_32.dll_ntohs
mov dl, reloc.WS2_32.dll_listen
mov r8b, Ordinal_26
movzx r9d, cl
mov r10b, 4
mov r11b, listen
mov bl, reloc.WS2_32.dll_ntohl
movzx edi, cl
xor al, 0x6a
mov byte [rbp + 0xc1], al
xor cl, 0x6a
mov byte [rbp + 0xc2], cl
xor dl, 0x6a
mov byte [rbp + 0xc3], dl
xor r8b, 0x6a
mov byte [rbp + 0xc4], r8b
xor r9b, 0x6a
mov byte [rbp + 0xc5], r9b
xor r10b, 0x6a
mov byte [rbp + 0xc6], r10b
xor r11b, 0x6a
mov byte [rbp + 0xc7], r11b
xor bl, 0x6a
mov byte [rbp + 0xc8], bl
xor dil, 0x6a
mov byte [rbp + 0xc9], dil
mov byte [rbp + 0xca], sil
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x80], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
inc r8
cmp byte [rax + r8], sil
jne 0x1400299e6
lea rdx, [rbp + 0xc1]
lea rcx, [rbp - 0x80]
call fcn.1400079a0
mov byte [rbp + 0xc0], Ordinal_46
mov al, 0x41
mov cl, 0x43
mov dl, 0x40
movzx r8d, cl
mov r9b, 0x58
movzx r10d, cl
mov r11b, 0x5a
xor ebx, ebx
xor al, 0x2c
mov byte [rbp + 0xc1], al
xor cl, 0x2c
mov byte [rbp + 0xc2], cl
xor dl, 0x2c
mov byte [rbp + 0xc3], dl
xor r8b, 0x2c
mov byte [rbp + 0xc4], r8b
xor r9b, 0x2c
mov byte [rbp + 0xc5], r9b
xor r10b, 0x2c
mov byte [rbp + 0xc6], r10b
xor r11b, 0x2c
mov byte [rbp + 0xc7], r11b
mov byte [rbp + 0xc8], bl
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x60], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x50], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
inc r8
cmp byte [rax + r8], bl
jne 0x140029a84
lea rdx, [rbp + 0xc1]
lea rcx, [rbp - 0x60]
call fcn.1400079a0
mov byte [rbp + 0xc0], reloc.WLDAP32.dll_Ordinal_32
mov al, 0x44
mov cl, 0x45
mov dl, 0x43
mov r8b, reloc.WLDAP32.dll_Ordinal_79
mov r9b, 0x59
xor al, 0x20
mov byte [rbp + 0xc1], al
xor cl, 0x20
mov byte [rbp + 0xc2], cl
xor dl, 0x20
mov byte [rbp + 0xc3], dl
xor r8b, 0x20
mov byte [rbp + 0xc4], r8b
xor r9b, 0x20
mov byte [rbp + 0xc5], r9b
mov byte [rbp + 0xc6], bl
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x40], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x30], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
inc r8
cmp byte [rax + r8], bl
jne 0x140029b02
lea rdx, [rbp + 0xc1]
lea rcx, [rbp - 0x40]
call fcn.1400079a0
mov byte [rbp + 0xc0], 0x40
mov al, reloc.WLDAP32.dll_Ordinal_41
mov cl, reloc.WLDAP32.dll_Ordinal_46
mov dl, reloc.WLDAP32.dll_Ordinal_35
mov r8b, Ordinal_41
mov r9b, reloc.WLDAP32.dll_Ordinal_50
mov r10b, 0x25
movzx r11d, cl
mov bl, reloc.WLDAP32.dll_Ordinal_33
mov dil, 0x24
movzx esi, r10b
xor r15d, r15d
xor al, 0x40
mov byte [rbp + 0xc1], al
xor cl, 0x40
mov byte [rbp + 0xc2], cl
xor dl, 0x40
mov byte [rbp + 0xc3], dl
xor r8b, 0x40
mov byte [rbp + 0xc4], r8b
xor r9b, 0x40
mov byte [rbp + 0xc5], r9b
xor r10b, 0x40
mov byte [rbp + 0xc6], r10b
xor r11b, 0x40
mov byte [rbp + 0xc7], r11b
xor bl, 0x40
mov byte [rbp + 0xc8], bl
xor dil, 0x40
mov byte [rbp + 0xc9], dil
xor sil, 0x40
mov byte [rbp + 0xca], sil
mov byte [rbp + 0xcb], r15b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x20], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x10], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140029bd0
lea rdx, [rbp + 0xc1]
lea rcx, [rbp - 0x20]
call fcn.1400079a0
mov byte [rbp + 0xc0], Ordinal_60
mov al, 0x57
mov cl, 0x41
mov dl, 0x46
xor r8d, r8d
xor al, 0x36
mov byte [rbp + 0xc1], al
xor cl, 0x36
mov byte [rbp + 0xc2], cl
xor dl, 0x36
mov byte [rbp + 0xc3], dl
mov byte [rbp + 0xc4], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x10], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
inc r8
cmp byte [rax + r8], r15b
jne 0x140029c36
lea rdx, [rbp + 0xc1]
lea rcx, [rbp]
call fcn.1400079a0
mov byte [rbp + 0xc0], 0x61
mov al, reloc.WS2_32.dll_select
movzx ecx, al
mov dl, 6
mov r8b, 0x51
mov r9b, 0x59
xor r10d, r10d
xor al, 0x61
mov byte [rbp + 0xc1], al
xor cl, 0x61
mov byte [rbp + 0xc2], cl
xor dl, 0x61
mov byte [rbp + 0xc3], dl
xor r8b, 0x61
mov byte [rbp + 0xc4], r8b
xor r9b, 0x61
mov byte [rbp + 0xc5], r9b
mov byte [rbp + 0xc6], r10b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x20], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x30], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], r10b
jne 0x140029cc0
lea rdx, [rbp + 0xc1]
lea rcx, [rbp + 0x20]
call fcn.1400079a0
mov byte [rbp + 0xc0], WSAGetLastError
mov al, 0xb
mov cl, Ordinal_32
mov dl, reloc.WS2_32.dll_listen
xor r8d, r8d
xor al, 0x6a
mov byte [rbp + 0xc1], al
xor cl, 0x6a
mov byte [rbp + 0xc2], cl
xor dl, 0x6a
mov byte [rbp + 0xc3], dl
mov byte [rbp + 0xc4], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x40], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
inc r8
cmp byte [rax + r8], r15b
jne 0x140029d26
lea rdx, [rbp + 0xc1]
lea rcx, [rbp + 0x40]
call fcn.1400079a0
mov byte [rbp + 0xc0], WSAStartup
mov al, 2
mov cl, reloc.WLDAP32.dll_Ordinal_22
mov dl, 0x44
movzx r8d, dl
mov r9b, 0x47
xor r10d, r10d
xor al, 0x71
mov byte [rbp + 0xc1], al
xor cl, 0x71
mov byte [rbp + 0xc2], cl
xor dl, 0x71
mov byte [rbp + 0xc3], dl
xor r8b, 0x71
mov byte [rbp + 0xc4], r8b
xor r9b, 0x71
mov byte [rbp + 0xc5], r9b
mov byte [rbp + 0xc6], r10b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x60], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x70], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], r10b
jne 0x140029db0
lea rdx, [rbp + 0xc1]
lea rcx, [rbp + 0x60]
call fcn.1400079a0
mov byte [rbp + 0xc0], 0x47
mov al, Ordinal_45
mov cl, reloc.WLDAP32.dll_Ordinal_41
mov dl, reloc.WLDAP32.dll_Ordinal_46
mov r8b, reloc.WLDAP32.dll_Ordinal_33
mov r9b, Ordinal_35
xor r10d, r10d
xor al, 0x47
mov byte [rbp + 0xc1], al
xor cl, 0x47
mov byte [rbp + 0xc2], cl
xor dl, 0x47
mov byte [rbp + 0xc3], dl
xor r8b, 0x47
mov byte [rbp + 0xc4], r8b
xor r9b, 0x47
mov byte [rbp + 0xc5], r9b
mov byte [rbp + 0xc6], r10b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x80], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x90], xmm1
lea rax, [rbp + 0xc1]
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r10b
jne 0x140029e40
lea rdx, [rbp + 0xc1]
lea rcx, [rbp + 0x80]
call fcn.1400079a0
mov byte [rbp + 0xc0], 0xa
mov al, 0x69
mov cl, 0x3e
xor edx, edx
xor al, 0xa
mov byte [rbp + 0xc1], al
xor cl, 0xa
mov byte [rbp + 0xc2], cl
mov byte [rbp + 0xc3], dl
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xa0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0xc1]
nop
inc r14
cmp byte [rax + r14], dl
jne 0x140029ea0
mov r8, r14
lea rdx, [rbp + 0xc1]
lea rcx, [rbp + 0xa0]
call fcn.1400079a0
lea rax, [rsp + 0x40]
mov qword [rbp + 0xc0], rax
lea rax, [rbp + 0xc0]
mov qword [rbp + 0xc8], rax
vmovups xmm0, xmmword [rbp + 0xc0]
vmovdqa xmmword [rbp + 0xc0], xmm0
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x100]
call fcn.140008ff0
lea r9, [fcn.140006cf0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, recv
lea rcx, [rsp + 0x40]
call fcn.14012e7cc
mov rbx, qword [rbp + 0x100]
mov rdi, qword [rbp + 0x108]
cmp rbx, rdi
je 0x140029f80
mov rsi, qword [rbp + 0xf0]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp + 0xd8]
cmp rsi, 0xf
cmova rdx, r13
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140029f60
mov rcx, qword [rbx]
cmp r8, r12
jne 0x140029f6e
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140029f77
add rbx, 0x20
cmp rbx, rdi
jne 0x140029f40
cmp rbx, rdi
jne 0x14002a09d
xor esi, esi
mov rcx, qword [0x1402224d8]
mov rdi, qword [rsp + 0x30]
test rcx, rcx
je 0x140029ffa
mov eax, dword [0x1402224e0]
test eax, eax
je 0x140029fcc
mov edx, dword [0x1401ad754]
add rdx, qword [rdi + 0x58]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [0x1402224e0]
mov rcx, qword [0x1402224d8]
test rcx, rcx
je 0x140029ffa
test eax, eax
je 0x140029ffa
mov edx, dword [0x1401ad7e8]
add rdx, qword [rbp + 0xf8]
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp + 0xd0], sil
je 0x14002a00a
mov byte [0x14022241c], sil
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
cmp byte [reloc.WS2_32.dll_accept], sil
jne 0x14002a053
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14002a053
mov ecx, ebx
sub ecx, dword [0x140222420]
cmp ecx, 0x1f4
jb 0x14002a053
cmp byte [0x14022241c], sil
sete al
mov byte [0x14022241c], al
mov dword [0x140222420], ebx
jmp 0x14002a05a
movzx eax, byte [0x14022241c]
test al, al
je 0x14002a09d
mov dword [rbp + 0xc0], reloc.WLDAP32.dll_Ordinal_45
mov rcx, qword [0x1402224d8]
test rcx, rcx
je 0x14002a09d
cmp dword [0x1402224e0], esi
je 0x14002a09d
mov edx, dword [0x1401ad7ac]
add rdx, qword [rdi]
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x100]
call fcn.140021af0
lea rcx, [rbp + 0xd8]
call fcn.140006ec0
nop
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.14012e650
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret