Function at 0x14015696a
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140192820
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x3c0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x84
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3e8]
mov rax, qword [0x1404bf700]
xor rax, rbp
mov qword [rbp + 0x388], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140156884
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140192891
mov rax, qword [rbp + 0x3b0]
mov byte [rax + 0x28], 0x42
mov al, 1
jmp 0x140192bf7
call fcn.140155394
xorps xmm0, xmm0
comiss xmm0, dword [rax + 0xe10]
jbe 0x1401928b9
mov rax, qword [rbp + 0x3b0]
mov byte [rax + 0x28], 0x3f
mov al, 1
jmp 0x140192bf7
call fcn.140155394
movss xmm0, dword [rax + 0xe10]
comiss xmm0, dword [0x14040ebfc]
jbe 0x1401928e6
mov rax, qword [rbp + 0x3b0]
mov byte [rax + 0x28], 0x40
mov al, 1
jmp 0x140192bf7
mov edx, gethostname
lea rcx, str.__._0123456789_A
call fcn.1401525db
mov ecx, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140192921
mov rax, qword [rbp + 0x3b0]
mov byte [rax + 0x28], gethostname
mov al, 1
jmp 0x140192bf7
mov edx, 0x34
lea rcx, str.__._0123456789_A
call fcn.1401525db
mov ecx, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14019295c
mov rax, qword [rbp + 0x3b0]
mov byte [rax + 0x28], 0x34
mov al, 1
jmp 0x140192bf7
mov edx, gethostname
lea rcx, str.__._0123456789_A
call fcn.1401525db
mov ecx, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140192994
mov rax, qword [rbp + 0x3b0]
mov byte [rax + 0x28], 0x35
mov al, 1
jmp 0x140192bf7
mov edx, reloc.WLDAP32.dll_Ordinal_60
lea rcx, str.__._0123456789_A
call fcn.1401525db
mov ecx, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401929cc
mov rax, qword [rbp + 0x3b0]
mov byte [rax + 0x28], reloc.WLDAP32.dll_Ordinal_60
mov al, 1
jmp 0x140192bf7
mov edx, 0x3d
lea rcx, str.__._0123456789_A
call fcn.1401525db
mov ecx, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140192a02
mov rax, qword [rbp + 0x3b0]
mov byte [rax + 0x28], 0x3d
mov al, 1
jmp 0x140192bf7
mov dword [rbp + 4], 0
jmp 0x140192a13
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 5
jge 0x140192a43
xor edx, edx
mov ecx, dword [rbp + 4]
call fcn.140155a47
movzx eax, al
test eax, eax
je 0x140192a41
mov eax, dword [rbp + 4]
add eax, 0x39
mov rcx, qword [rbp + 0x3b0]
mov byte [rcx + 0x28], al
mov al, 1
jmp 0x140192bf7
jmp 0x140192a0b
mov dword [rbp + 0x24], 0
jmp 0x140192a54
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x28c
jge 0x140192bf5
call fcn.140155394
add rax, 0xb28
mov qword [rbp + 0x378], rax
movsxd rax, dword [rbp + 0x24]
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov rcx, qword [rbp + 0x378]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
test eax, eax
jne 0x140192a9b
jmp 0x140192a4c
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp + 0x48]
call fcn.140155934
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rbp + 0x24]
lea r8, str.__._0123456789_A
lea rdx, [rbp + 0x48]
lea rcx, [0x140410a2a]
call fcn.140151564
lea rdx, [rbp + 0x208]
lea rcx, str.__._0123456789_A
call fcn.1401567a8
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.1401520cc
movzx eax, al
test eax, eax
jne 0x140192bf0
lea rax, [rbp + 0x2c8]
lea rcx, [rbp + 0x48]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x248]
lea rcx, str.__._0123456789_A
call fcn.14015380a
lea rcx, [rbp + 0x288]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_32
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x350]
lea rcx, [rbp + 0x2c8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x310]
lea rcx, [rbp + 0x288]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WLDAP32.dll_Ordinal_32
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x310]
call fcn.14015240f
mov rcx, qword [rbp + 0x3b0]
mov byte [rcx + 0x28], al
mov rax, qword [rbp + 0x3b0]
movzx eax, byte [rax + 0x28]
cmp eax, 0x35
jne 0x140192bec
call fcn.140155394
add rax, 0xb28
mov qword [rbp + 0x378], rax
mov edx, 0x53
lea rcx, str.__._0123456789_A
call fcn.1401525db
movsxd rax, dword [rax + 0x10]
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov rcx, qword [rbp + 0x378]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
test eax, eax
je 0x140192bec
mov rax, qword [rbp + 0x3b0]
mov byte [rax + 0x28], 0x53
mov al, 1
jmp 0x140192bf7
jmp 0x140192a4c
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.1401559a2
mov rax, rdi
mov rcx, qword [rbp + 0x388]
xor rcx, rbp
call fcn.140153acb
lea rsp, [rbp + 0x390]
pop rdi
pop rsi
pop rbp
ret