Function at 0x14001cd50
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x18]
sub rsp, 0x110
mov rax, qword [0x1403d3080]
xor rax, rsp
mov qword [rbp - 0x20], rax
cmp byte [0x1403ec8e0], 0
jne 0x14001d42d
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
xor esi, esi
mov qword [r11 + 0x20], r12
mov qword [r11 - 0x10], r14
movabs r14, 0x7fffffffffffffff
mov qword [r11 - 0x18], r15
movabs r15, 0x7ffffffffa0a1efe
movaps xmmword [r11 - 0x28], xmm6
xorps xmm6, xmm6
mov qword [r11 + 0x18], rdi
mov r12d, 4
nop word [rax + rax]
mov eax, dword [reloc.WS2_32.dll_accept]
lea rcx, [rsp + 0x48]
inc eax
movsxd rbx, eax
call fcn.140001c50
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x80], rax
cmp rbx, 1
jl 0x14001ce04
imul rdx, rbx, 0xf4240
mov rcx, r14
sub rcx, rdx
cmp rax, rcx
jge 0x14001ce00
lea rcx, [rdx + rax]
mov qword [rbp - 0x80], rcx
jmp 0x14001ce04
mov qword [rbp - 0x80], r14
lea rcx, [rbp - 0x80]
call fcn.140004c30
mov r8, qword [0x140424718]
test r8, r8
je 0x14001d3e8
cmp byte [0x1403ec8a4], sil
je 0x14001ced8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r12 + rcx]
cmp dword [0x140424780], eax
jle 0x14001ce8f
lea rcx, [0x140424780]
call fcn.140161be0
cmp dword [0x140424780], 0xffffffff
jne 0x14001ce88
mov rcx, qword [0x140424718]
test rcx, rcx
jne 0x14001ce68
movaps xmm0, xmm6
jmp 0x14001ce74
add rcx, qword [0x140423e70]
call fcn.14001d450
lea rcx, [0x140424780]
movss dword [0x14042477c], xmm0
call fcn.140161b74
mov r8, qword [0x140424718]
test r8, r8
je 0x14001ced8
mov rcx, qword [0x140423f30]
movss xmm0, dword [0x14042477c]
movss dword [rbp - 0x78], xmm0
test rcx, rcx
je 0x14001cedf
cmp dword [0x140423e9c], esi
je 0x14001cedf
lea rdx, [r8 + 0x280]
mov qword [rsp + 0x20], rsi
lea r8, [rbp - 0x78]
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8, qword [0x140424718]
mov rcx, qword [0x140423f30]
cmp byte [0x1403ec8a7], sil
je 0x14001cf59
test r8, r8
jne 0x14001cef2
mov rdx, rsi
jmp 0x14001cf29
test rcx, rcx
je 0x14001cf25
cmp dword [0x140423e9c], esi
je 0x14001cf25
mov rdx, qword [0x140423e48]
mov r9d, 8
add rdx, r8
mov qword [rsp + 0x20], rsi
lea r8, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140423f30]
mov rdx, qword [rbp - 0x70]
mov dword [rbp - 0x80], 0x42c40000
test rcx, rcx
je 0x14001cf59
cmp dword [0x140423e9c], esi
je 0x14001cf59
add rdx, qword [0x140423e58]
lea r8, [rbp - 0x80]
mov r9d, 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x1403ec8ac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001cf6f
call fcn.14001c970
mov rbx, qword [0x140424718]
movzx edi, byte [0x1403ec8a5]
mov r10, qword [0x140423f30]
test rbx, rbx
je 0x14001d00f
test r10, r10
je 0x14001cfc0
cmp dword [0x140423e9c], esi
je 0x14001cfc0
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x68]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
bts rcx, 8
btr rax, 8
test dil, dil
cmove rcx, rax
mov qword [rbp - 0x60], rcx
test r10, r10
je 0x14001d00f
cmp dword [0x140423e9c], esi
je 0x14001d00f
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x140423f30]
mov rcx, qword [0x140424718]
test rcx, rcx
je 0x14001d179
test r10, r10
je 0x14001d055
cmp dword [0x140423e9c], esi
je 0x14001d055
mov rdx, qword [0x140423e50]
lea r8, [rbp - 0x58]
add rdx, rcx
mov qword [rsp + 0x20], rsi
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x14001d179
test r10, r10
je 0x14001d098
cmp dword [0x140423e9c], esi
je 0x14001d098
mov rdx, qword [0x140423e68]
lea r8, [rbp - 0x50]
add rdx, rbx
mov qword [rsp + 0x20], rsi
mov r9d, 8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
mov rax, qword [0x140424718]
cmp qword [rbp - 0x50], rax
jne 0x14001d197
mov byte [0x140423e00], 1
test r10, r10
je 0x14001d0e0
cmp dword [0x140423e9c], esi
je 0x14001d0e0
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x48]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
mov rax, qword [rbp - 0x48]
mov qword [0x140423df8], rax
mov qword [0x140423e08], rbx
test r10, r10
je 0x14001d122
cmp dword [0x140423e9c], esi
je 0x14001d122
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x40]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
mov rax, qword [rbp - 0x40]
mov qword [0x140423df0], rax
test r10, r10
je 0x14001d161
cmp dword [0x140423e9c], esi
je 0x14001d161
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
lea r8, [rsp + 0x58]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
movsd xmm0, qword [rsp + 0x58]
mov eax, dword [rsp + 0x60]
movsd qword [0x1404243b0], xmm0
mov dword [0x1404243b8], eax
cmp byte [0x140423e00], sil
jne 0x14001d29e
mov rdx, qword [0x140424718]
test rdx, rdx
jne 0x14001d1a0
mov rax, rsi
jmp 0x14001d1d4
mov byte [0x140423e00], sil
jmp 0x14001d186
test r10, r10
je 0x14001d1d0
cmp dword [0x140423e9c], esi
je 0x14001d1d0
add rdx, 0x20
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x38]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
mov rax, qword [rbp - 0x38]
mov rdx, qword [0x140424718]
mov qword [0x140423df8], rax
mov qword [0x140423e08], rdx
test rdx, rdx
jne 0x14001d1f3
mov rax, rsi
jmp 0x14001d227
test r10, r10
je 0x14001d223
cmp dword [0x140423e9c], esi
je 0x14001d223
add rdx, 0x30
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
mov rax, qword [rbp - 0x30]
cmp qword [0x140424718], rsi
mov qword [0x140423df0], rax
jne 0x14001d24b
movaps xmm0, xmm6
movss dword [rsp + 0x38], xmm6
unpcklps xmm0, xmm6
movsd qword [rsp + 0x30], xmm0
jmp 0x14001d286
test r10, r10
je 0x14001d286
cmp dword [0x140423e9c], esi
je 0x14001d286
mov rdx, qword [0x140424718]
lea r8, [rsp + 0x30]
add rdx, 0x90
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
movsd xmm0, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
movsd qword [0x1404243b0], xmm0
mov dword [0x1404243b8], eax
mov rdx, qword [0x140424650]
test rdx, rdx
je 0x14001d312
test r10, r10
je 0x14001d2dd
cmp dword [0x140423e9c], esi
je 0x14001d2dd
add rdx, 0x3c0
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x28]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140423f30]
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14001d312
test r10, r10
je 0x14001d31b
cmp dword [0x140423e9c], esi
je 0x14001d31b
add rdx, 0x40
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
lea r8, [rsp + 0x3c]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14001d31b
mov qword [rsp + 0x3c], rsi
mov dword [rsp + 0x44], esi
movsd xmm0, qword [rsp + 0x3c]
lea rcx, [rsp + 0x70]
mov eax, dword [rsp + 0x44]
movsd qword [rsp + 0x70], xmm0
mov dword [rsp + 0x78], eax
call fcn.14001c530
cmp byte [0x1403ec8b5], sil
mov rbx, qword [0x140424718]
je 0x14001d3b8
nop dword [rax]
xor r8d, r8d
mov edx, 0x156
mov rcx, rbx
call fcn.14001c3a0
mov r8b, 1
mov edx, 0xfc
mov rcx, rbx
call fcn.14001c3a0
mov r8b, 1
mov edx, Ordinal_143
mov rcx, rbx
call fcn.14001c3a0
lea rcx, [rsp + 0x50]
call fcn.140001c50
mov rax, qword [rsp + 0x50]
cmp rax, r15
jg 0x14001d3a0
add rax, 0x5f5e100
mov qword [rbp - 0x80], rax
jmp 0x14001d3a4
mov qword [rbp - 0x80], r14
lea rcx, [rbp - 0x80]
call fcn.140004c30
cmp byte [0x1403ec8b5], sil
jne 0x14001d350
jmp 0x14001d3e8
mov r8b, 1
mov edx, 0x156
mov rcx, rbx
call fcn.14001c3a0
xor r8d, r8d
mov edx, 0xfc
mov rcx, rbx
call fcn.14001c3a0
xor r8d, r8d
mov edx, Ordinal_143
mov rcx, rbx
call fcn.14001c3a0
cmp byte [0x1403ec8e0], sil
je 0x14001cdc0
movaps xmm6, xmmword [rsp + 0xf0]
mov r15, qword [rsp + 0x100]
mov r14, qword [rsp + 0x108]
mov r12, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x130]
mov rsi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x120]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140161860
add rsp, 0x110
pop rbp
ret