Function at 0x14001d1f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xf0
mov rax, qword [0x14038c080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
cmp byte [0x1403a55a8], 0
jne 0x14001d777
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
movabs rsi, 0x7fffffffffffffff
mov qword [r11 + 0x18], rdi
xor edi, edi
mov qword [r11 - 0x10], r14
mov qword [r11 - 0x18], r15
mov r15d, 0xff
movaps xmmword [r11 - 0x28], xmm6
xorps xmm6, xmm6
mov r14d, 4
nop
mov eax, dword [reloc.WS2_32.dll_accept]
lea rcx, [rbp - 0x51]
inc eax
movsxd rbx, eax
call fcn.140001fb0
mov rax, qword [rbp - 0x51]
mov qword [rbp - 0x29], rax
test rbx, rbx
je 0x14001d2a0
js 0x14001d2a0
imul r8, rbx, 0xf4240
mov rdx, rsi
sub rdx, r8
cmp rax, rdx
je 0x14001d29c
mov ecx, 1
cmovl ecx, r15d
test cl, cl
jns 0x14001d29c
lea rcx, [r8 + rax]
mov qword [rbp - 0x29], rcx
jmp 0x14001d2a0
mov qword [rbp - 0x29], rsi
lea rcx, [rbp - 0x29]
call fcn.140004cd0
mov r8, qword [0x1403a7298]
test r8, r8
je 0x14001d73a
cmp byte [0x1403a5574], dil
je 0x14001d3a3
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r14 + rcx]
cmp dword [0x1403a72f0], eax
jle 0x14001d35a
lea rcx, [0x1403a72f0]
call fcn.14014a210
cmp dword [0x1403a72f0], 0xffffffff
jne 0x14001d353
mov rcx, qword [0x1403a7298]
test rcx, rcx
jne 0x14001d304
movaps xmm0, xmm6
jmp 0x14001d33f
mov r10, qword [0x1403a6c50]
test r10, r10
je 0x14001d33a
cmp dword [0x1403a6bb4], edi
je 0x14001d33a
mov rdx, qword [0x1403a6b90]
lea r8, [rbp - 0x21]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, r10
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x21]
lea rcx, [0x1403a72f0]
movss dword [0x1403a72ec], xmm0
call fcn.14014a1a4
mov r8, qword [0x1403a7298]
test r8, r8
je 0x14001d3a3
mov rcx, qword [0x1403a6c50]
movss xmm0, dword [0x1403a72ec]
movss dword [rbp - 0x19], xmm0
test rcx, rcx
je 0x14001d3aa
cmp dword [0x1403a6bb4], edi
je 0x14001d3aa
lea rdx, [r8 + 0x280]
mov qword [rsp + 0x20], rdi
lea r8, [rbp - 0x19]
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8, qword [0x1403a7298]
mov rcx, qword [0x1403a6c50]
cmp byte [0x1403a5576], dil
je 0x14001d424
test r8, r8
jne 0x14001d3bd
mov rdx, rdi
jmp 0x14001d3f4
test rcx, rcx
je 0x14001d3f0
cmp dword [0x1403a6bb4], edi
je 0x14001d3f0
mov rdx, qword [0x1403a6b68]
mov r9d, 8
add rdx, r8
mov qword [rsp + 0x20], rdi
lea r8, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
mov rdx, qword [rbp - 0x11]
mov dword [rbp - 0x29], 0x42c40000
test rcx, rcx
je 0x14001d424
cmp dword [0x1403a6bb4], edi
je 0x14001d424
add rdx, qword [0x1403a6b78]
lea r8, [rbp - 0x29]
mov r9d, 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x1403a5578]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001d43a
call fcn.14001cde0
mov rdx, qword [0x1403a7298]
mov rcx, qword [0x1403a6c50]
test rdx, rdx
je 0x14001d596
test rcx, rcx
je 0x14001d481
cmp dword [0x1403a6bb4], edi
je 0x14001d481
add rdx, qword [0x1403a6b70]
lea r8, [rbp - 9]
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
mov rbx, qword [rbp - 9]
test rbx, rbx
je 0x14001d596
test rcx, rcx
je 0x14001d4c1
cmp dword [0x1403a6bb4], edi
je 0x14001d4c1
mov rdx, qword [0x1403a6b88]
lea r8, [rbp - 1]
add rdx, rbx
mov qword [rsp + 0x20], rdi
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
mov rax, qword [0x1403a7298]
cmp qword [rbp - 1], rax
jne 0x14001d5b4
mov byte [0x1403a6b30], 1
test rcx, rcx
je 0x14001d506
cmp dword [0x1403a6bb4], edi
je 0x14001d506
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
mov rax, qword [rbp + 7]
mov qword [0x1403a6b28], rax
mov qword [0x1403a6b38], rbx
test rcx, rcx
je 0x14001d545
cmp dword [0x1403a6bb4], edi
je 0x14001d545
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
mov rax, qword [rbp + 0xf]
mov qword [0x1403a6b20], rax
test rcx, rcx
je 0x14001d580
cmp dword [0x1403a6bb4], edi
je 0x14001d580
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], rdi
mov r9d, listen
lea r8, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
movsd xmm0, qword [rbp - 0x49]
mov eax, dword [rbp - 0x41]
movsd qword [0x1403a6f20], xmm0
mov dword [0x1403a6f28], eax
cmp byte [0x1403a6b30], dil
jne 0x14001d6ad
mov rdx, qword [0x1403a7298]
test rdx, rdx
jne 0x14001d5bd
mov rax, rdi
jmp 0x14001d5ee
mov byte [0x1403a6b30], dil
jmp 0x14001d5a3
test rcx, rcx
je 0x14001d5ea
cmp dword [0x1403a6bb4], edi
je 0x14001d5ea
add rdx, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
mov rax, qword [rbp + 0x17]
mov rdx, qword [0x1403a7298]
mov qword [0x1403a6b28], rax
mov qword [0x1403a6b38], rdx
test rdx, rdx
jne 0x14001d60d
mov rax, rdi
jmp 0x14001d63e
test rcx, rcx
je 0x14001d63a
cmp dword [0x1403a6bb4], edi
je 0x14001d63a
add rdx, 0x30
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
mov rax, qword [rbp + 0x1f]
cmp qword [0x1403a7298], rdi
mov qword [0x1403a6b20], rax
jne 0x14001d660
movaps xmm0, xmm6
movss dword [rbp - 0x61], xmm6
unpcklps xmm0, xmm6
movsd qword [rbp - 0x69], xmm0
jmp 0x14001d697
test rcx, rcx
je 0x14001d697
cmp dword [0x1403a6bb4], edi
je 0x14001d697
mov rdx, qword [0x1403a7298]
lea r8, [rbp - 0x69]
add rdx, 0x90
mov qword [rsp + 0x20], rdi
mov r9d, listen
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
movsd xmm0, qword [rbp - 0x69]
mov eax, dword [rbp - 0x61]
movsd qword [0x1403a6f20], xmm0
mov dword [0x1403a6f28], eax
mov rdx, qword [0x1403a71d0]
test rdx, rdx
je 0x14001d71a
test rcx, rcx
je 0x14001d6e9
cmp dword [0x1403a6bb4], edi
je 0x14001d6e9
add rdx, 0x3c0
mov qword [rsp + 0x20], rdi
mov r9d, 8
lea r8, [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403a6c50]
mov rdx, qword [rbp + 0x27]
test rdx, rdx
je 0x14001d71a
test rcx, rcx
je 0x14001d721
cmp dword [0x1403a6bb4], edi
je 0x14001d721
add rdx, 0x40
mov qword [rsp + 0x20], rdi
mov r9d, listen
lea r8, [rbp - 0x5d]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14001d721
mov qword [rbp - 0x5d], rdi
mov dword [rbp - 0x55], edi
movsd xmm0, qword [rbp - 0x5d]
lea rcx, [rbp - 0x39]
mov eax, dword [rbp - 0x55]
movsd qword [rbp - 0x39], xmm0
mov dword [rbp - 0x31], eax
call fcn.14001c9a0
cmp byte [0x1403a55a8], dil
je 0x14001d250
movaps xmm6, xmmword [rsp + 0xd0]
mov r15, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140149e90
add rsp, 0xf0
pop rbp
ret