Function at 0x14003c850
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
jmp 0x14003c850
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140112718]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor edi, edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov ecx, dword [str.wtd_a]
mov dword [rbp - 0x20], ecx
movzx edx, word [0x1400fe214]
mov word [rbp - 0x1c], dx
movzx ecx, byte [0x1400fe216]
mov byte [rbp - 0x20], 0x47
xor byte [rbp - 0x1f], 0x31
xor byte [rbp - 0x1e], 0x32
xor byte [rbp - 0x1d], 0x33
xor dl, 0x34
mov byte [rbp - 0x1c], dl
xor byte [rbp - 0x1b], 0x35
xor cl, 0x36
mov byte [rbp - 0x1a], cl
xor edx, edx
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_FindWindowA]
movabs rsi, 0x7fffffffffffffff
cmp rbx, rax
jne 0x14003cafe
mov dword [rbp - 0x40], Ordinal_27
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp - 0x2c], eax
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x14003c91c
mov rax, qword [rbp - 0x38]
add rax, 0xffffffffffff3caf
cmp rax, 0xc34e
jbe 0x14003cafe
mov ecx, dword [0x140114a5c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003cafe
cmp byte [0x140114a58], dil
je 0x14003cafe
mov ecx, dword [0x140114a5c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003c9d3
movabs rdi, 0x7ffffffffff0bdbf
nop dword [rax]
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14003c9d1
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003c987
imul rax, rax, 0x64
jmp 0x14003c9a2
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x14003c9b3
add rax, 0xf4240
mov qword [rbp - 0x20], rax
jmp 0x14003c9b7
mov qword [rbp - 0x20], rsi
lea rcx, [rbp - 0x20]
call fcn.14002d590
mov ecx, dword [0x140114a5c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14003c960
xor edi, edi
cmp byte [0x1401146c8], 0
jne 0x14003caf7
mov byte [0x1401146c8], 1
mov ecx, 8
call fcn.1400c1680
lea rcx, [0x140037120]
mov qword [rax], rcx
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140031c10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14003cae8
cmp dword [rbp - 0x38], 0
je 0x14003cadc
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003cadc
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea ecx, [rax + 8]
call fcn.1400c1680
lea rcx, [0x1400371f0]
mov qword [rax], rcx
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140031c10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14003cacd
cmp dword [rbp - 0x38], 0
je 0x14003cac1
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003cac1
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
jmp 0x14003cafe
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov byte [0x1401146c8], 0
movzx ecx, byte [0x140114a34]
movzx eax, byte [0x14011461c]
test cl, cl
je 0x14003cb19
test al, al
je 0x14003cb21
jmp 0x14003cc5a
test al, al
je 0x14003cc5a
sete byte [0x14011461c]
mov ebx, dword [0x140114a4c]
movzx edi, byte [0x140114a45]
mov esi, dword [0x140114a40]
mov r14d, dword [0x140114a54]
movzx r15d, byte [0x140114a2d]
movzx r12d, byte [0x140114a3c]
mov r13d, dword [0x140114a50]
mov eax, dword [0x140114a48]
mov dword [rbp - 0x4c], eax
movzx eax, byte [0x140114a44]
mov byte [rbp - 0x50], al
mov eax, dword [0x140114a38]
mov dword [rbp - 0x48], eax
mov eax, dword [0x140114a30]
mov dword [rbp - 0x20], eax
cmp byte [0x140114778], cl
je 0x14003cc49
test cl, cl
je 0x14003cc49
mov byte [0x140114778], 1
mov ecx, gethostname
call fcn.1400c1680
mov dword [rax], ebx
mov byte [rax + 4], dil
mov dword [rax + 8], esi
mov dword [rax + 0xc], r14d
mov byte [rax + 0x10], r15b
mov byte [rax + 0x14], r12b
mov dword [rax + 0x18], r13d
mov ecx, dword [rbp - 0x4c]
mov dword [rax + 0x1c], ecx
movzx ecx, byte [rbp - 0x50]
mov byte [rax + 0x20], cl
mov ecx, dword [rbp - 0x48]
mov dword [rax + 0x24], ecx
mov ecx, dword [rbp - 0x20]
mov dword [rax + 0x28], ecx
lea rcx, [0x140038cc0]
mov qword [rax + 0x30], rcx
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14003a1f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14003cc3a
cmp dword [rbp - 0x38], ebx
je 0x14003cc2e
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003cc2e
jmp 0x14003cc50
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov byte [0x140114778], 0
movabs rsi, 0x7fffffffffffffff
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003cc78
imul rax, rax, 0x64
jmp 0x14003cc96
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7ffffffffff0bdbe
cmp rax, rcx
jg 0x14003ccb1
add rax, 0xf4240
mov qword [rbp - 0x20], rax
jmp 0x14003ccb5
mov qword [rbp - 0x20], rsi
lea rcx, [rbp - 0x20]
call fcn.14002d590
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c1540
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret