Function at 0x140104d50
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push r14
push r15
sub rsp, 0x88
mov rax, qword [rdx + 8]
mov rsi, rcx
xor ecx, ecx
inc rax
mov dword [rsp + 0x38], ecx
mov r14d, ecx
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + 0x10]
lea rdx, [rsp + 0x30]
dec eax
lea rcx, [rsp + 0x40]
mov r15d, r9d
mov dword [rsp + 0x3c], eax
mov ebx, r8d
call fcn.140103450
test eax, eax
je 0x140105542
mov eax, 0xa2
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0x80], r13
mov qword [rsp + 0xc8], r12
lea ecx, [rax + 1]
lea edx, [rax - 2]
lea r8d, [rax - 1]
lea r9d, [rax + 2]
lea r10d, [rax + 3]
nop word [rax + rax]
movzx ebp, word [rsp + 0x42]
movzx r13d, word [rsp + 0x44]
add bp, word [rsi + 0x38]
add r13w, word [rsi + 0x3c]
cmp dword [rsp + 0x50], 0
mov word [rsp + 0x42], bp
mov word [rsp + 0x44], r13w
je 0x140104e35
lea rcx, [rsi + 0x30]
movsx r8d, r13w
movsx edx, bp
call fcn.140109c10
test eax, eax
je 0x1401054f4
mov eax, 0xa2
lea ecx, [rax + 1]
lea edx, [rax - 2]
lea r8d, [rax - 1]
lea r9d, [rax + 2]
lea r10d, [rax + 3]
movzx r12d, byte [rsp + 0x40]
movzx edi, word [rsp + 0x46]
cmp r12b, 9
jne 0x140104fc1
cmp di, 0x11
je 0x140104f10
cmp di, ax
je 0x140104f10
cmp di, cx
je 0x140104f10
cmp di, dx
je 0x140104f10
cmp di, r8w
je 0x140104f10
cmp di, 0x10
je 0x140104f10
cmp di, r9w
je 0x140104f10
cmp di, 0x12
je 0x140104f10
cmp di, r10w
je 0x140104f10
cmp di, 0x5b
je 0x140104f10
cmp di, 0x5c
je 0x140104f10
cmp di, 0x2e
jne 0x140104ef1
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140105076
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140105076
mov dword [rsi + 0x374], 1
call fcn.1401017e0
jmp 0x140105076
cmp qword [rsi + 0x390], 0
jbe 0x140105076
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x374], eax
jmp 0x140105076
mov r8, qword [rsi + 0x390]
mov rcx, qword [rsi + 0x388]
mov ebx, 0xa
lea rdx, [r8 + 1]
cmp rdx, rcx
jbe 0x140104f64
lea rax, [rcx + 0xa]
cmp rdx, rax
jbe 0x140104f3e
mov rbx, r8
sub rbx, rcx
inc rbx
lea rdx, [rcx + rbx]
mov rcx, qword [rsi + 0x380]
add rdx, rdx
call fcn.1401e78d4
test rax, rax
je 0x140104fa9
add qword [rsi + 0x388], rbx
mov qword [rsi + 0x380], rax
mov rdx, qword [rsi + 0x390]
xor eax, eax
test rdx, rdx
je 0x140104f97
mov rcx, qword [rsi + 0x380]
nop dword [rax]
cmp word [rcx], di
je 0x140104f93
inc rax
add rcx, 2
cmp rax, rdx
jb 0x140104f80
jmp 0x140104f97
test eax, eax
jns 0x140104fa9
mov rax, qword [rsi + 0x380]
mov word [rax + rdx*2], di
inc qword [rsi + 0x390]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0xc0]
mov dword [rsi + 0x374], eax
jmp 0x140105076
cmp r12b, 0xa
jne 0x140105076
cmp di, 0x11
je 0x14010500a
cmp di, ax
je 0x14010500a
cmp di, cx
je 0x14010500a
cmp di, dx
je 0x14010500a
cmp di, r8w
je 0x14010500a
cmp di, 0x10
je 0x14010500a
cmp di, r9w
je 0x14010500a
cmp di, 0x12
je 0x14010500a
cmp di, r10w
je 0x14010500a
cmp di, 0x5b
je 0x14010500a
cmp di, 0x5c
jne 0x140105076
mov r8, qword [rsi + 0x390]
xor ecx, ecx
mov rdx, rcx
test r8, r8
je 0x140105033
mov rax, qword [rsi + 0x380]
cmp word [rax], di
je 0x140105033
inc rdx
add rax, 2
cmp rdx, r8
jb 0x140105022
cmp rdx, r8
jae 0x140105066
lea rax, [r8 - 1]
cmp rdx, rax
jae 0x14010505f
mov rax, qword [rsi + 0x380]
sub r8, rdx
lea rcx, [rax + rdx*2]
lea r8, [r8 + r8 - 2]
lea rdx, [rcx + 2]
call fcn.1401e75a0
xor ecx, ecx
dec qword [rsi + 0x390]
cmp qword [rsi + 0x390], 0
jne 0x140105076
mov dword [rsi + 0x374], ecx
movzx r12d, r12b
lea eax, [r12 - 1]
cmp eax, 0xe
ja case.default.0x14010509b
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x105550]
add rcx, rdx
jmp rcx
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8001
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1401032d0
jmp case.default.0x14010509b
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8008
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1401032d0
jmp case.default.0x14010509b
mov ecx, dword [0x1402e47dc]
cmp ecx, 1
jbe 0x140105124
cmp r14d, 3
jne 0x140105124
call qword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8010
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1401032d0
jmp case.default.0x14010509b
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8002
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1401032d0
jmp case.default.0x14010509b
mov ecx, dword [0x1402e47dc]
cmp ecx, 1
jbe 0x1401051ab
cmp r14d, 1
jne 0x1401051ab
call qword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8004
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1401032d0
jmp case.default.0x14010509b
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8020
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1401032d0
jmp case.default.0x14010509b
mov ecx, dword [0x1402e47dc]
cmp ecx, 1
jbe 0x140105232
cmp r14d, 0xe
jne 0x140105232
call qword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8040
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1401032d0
jmp case.default.0x14010509b
movsx eax, r13w
xor r13d, r13d
xor r9d, r9d
mov ecx, 0x8002
mov qword [rsp + 0x20], r13
imul eax, eax, 0xffff
cdq
idiv r15d
mov edi, eax
movsx eax, bp
mov r8d, edi
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
mov ebx, eax
call fcn.1401032d0
mov ecx, dword [0x1402e47dc]
cmp ecx, 1
jbe 0x1401052b3
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8004
mov qword [rsp + 0x20], r13
call fcn.1401032d0
jmp case.default.0x14010509b
movsx eax, r13w
xor r13d, r13d
xor r9d, r9d
mov ecx, 0x8008
mov qword [rsp + 0x20], r13
imul eax, eax, 0xffff
cdq
idiv r15d
mov edi, eax
movsx eax, bp
mov r8d, edi
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
mov ebx, eax
call fcn.1401032d0
mov ecx, dword [0x1402e47dc]
cmp ecx, 1
jbe 0x140105318
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8010
mov qword [rsp + 0x20], r13
call fcn.1401032d0
jmp case.default.0x14010509b
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8002
imul eax, eax, 0xffff
cdq
idiv r15d
mov ebx, eax
movsx eax, bp
xor ebp, ebp
mov r8d, ebx
mov qword [rsp + 0x20], rbp
imul eax, eax, 0xffff
cdq
idiv dword [rsp + 0xc0]
mov edx, eax
mov edi, eax
call fcn.1401032d0
xor r9d, r9d
mov r8d, ebx
mov edx, edi
mov ecx, 0x8004
mov qword [rsp + 0x20], rbp
call fcn.1401032d0
xor r9d, r9d
mov r8d, ebx
mov edx, edi
mov ecx, 0x8002
mov qword [rsp + 0x20], rbp
call fcn.1401032d0
xor r9d, r9d
mov r8d, ebx
mov edx, edi
mov ecx, 0x8004
mov qword [rsp + 0x20], rbp
call fcn.1401032d0
jmp case.default.0x14010509b
xor eax, eax
movsx r9d, bp
xor r8d, r8d
xor edx, edx
mov ecx, 0x800
mov qword [rsp + 0x20], rax
call fcn.1401032d0
jmp case.default.0x14010509b
movzx ecx, di
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.140103350
jmp case.default.0x14010509b
xor r9d, r9d
movzx ecx, di
xor edx, edx
lea r8d, [r9 + 2]
call fcn.140103350
jmp case.default.0x14010509b
mov rcx, qword [rsp + 0x48]
xor r13d, r13d
mov rbx, r13
test rcx, rcx
je 0x14010541c
call fcn.140001980
mov rbx, rax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, r13
not rcx
sub rcx, 1
mov rbp, rcx
je 0x1401054dd
nop dword [rax + rax]
movzx eax, word [rbx + rdi*2]
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x64], 4
mov dword [rsp + 0x68], r13d
mov word [rsp + 0x60], r13w
mov word [rsp + 0x62], ax
test eax, eax
jne 0x140105486
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rsp + 0x62], ax
test ax, ax
je 0x140105486
or dword [rsp + 0x64], 8
mov r8d, 0x28
lea rdx, [rsp + 0x58]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
cmp eax, 1
je 0x1401054d1
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1401054d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Injection_failed._err_d
lea rdx, str..TShareApe.cpp
mov r8d, 0x522
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.1400045f0
inc rdi
cmp rdi, rbp
jb 0x140105440
test rbx, rbx
je case.default.0x14010509b
mov rcx, rbx
call fcn.1401e64f8
mov ebx, dword [rsp + 0xc0]
mov r14d, r12d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140103450
test eax, eax
mov eax, 0xa2
lea ecx, [rax + 1]
lea edx, [rax - 2]
lea r8d, [rax - 1]
lea r9d, [rax + 2]
lea r10d, [rax + 3]
jne 0x140104de0
mov r13, qword [rsp + 0x80]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
add rsp, 0x88
pop r15
pop r14
pop rsi
pop rbx
ret