Function at 0x14005ab60
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x140141080]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ecx, dword [0x140295848]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005ab9b
cmp byte [0x14029584d], 0
sete byte [0x14029584d]
mov rdx, qword [0x140295e10]
add rdx, qword [0x140295df8]
mov rcx, qword [0x140295d60]
mov qword [rsp + 0x120], rdi
xor edi, edi
cmp byte [0x14029584c], dil
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 1]
je 0x14005abd6
mov byte [rbp - 0x69], r9b
lea r8, [rbp - 0x69]
jmp 0x14005abde
mov byte [rbp - 0x61], 0
lea r8, [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14029584f], 0
je 0x14005ac2a
cmp byte [0x140295a48], 0
jne 0x14005ac65
mov rdx, qword [0x140295df8]
lea r8, [rbp - 0x59]
mov rcx, qword [0x140295d60]
add rdx, 0x2c
mov r9d, 1
mov byte [rbp - 0x59], 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x140295a48], 1
jmp 0x14005ac65
cmp byte [0x140295a48], 0
je 0x14005ac65
mov rdx, qword [0x140295df8]
lea r8, [rbp - 0x51]
mov rcx, qword [0x140295d60]
add rdx, 0x2c
mov r9d, 1
mov byte [rbp - 0x51], gethostname
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x140295a48], 0
cmp byte [0x14029584e], 0
je 0x14005acce
mov rdx, qword [0x140295e38]
lea r8, [rbp + 0x27]
add rdx, qword [0x140295df8]
mov r9d, 8
mov rcx, qword [0x140295d60]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x14005acce
mov rdx, qword [0x140295e18]
lea r8, [rbp - 0x19]
add rdx, rcx
mov dword [rbp - 0x19], 0x4000
mov rcx, qword [0x140295d60]
mov r9d, 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x140295862], 0
mov qword [rsp + 0x110], rbx
je 0x14005adc3
mov rdx, qword [0x140295e20]
lea r8, [rbp - 0x39]
mov rcx, qword [0x140295d60]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140295d90]
lea r8, [rbp + 0xf]
add rdx, qword [0x140295df8]
mov r9d, 8
mov rcx, qword [0x140295d60]
mov rbx, qword [rbp - 0x39]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xf]
lea r8, [rbp + 7]
mov rcx, qword [0x140295d60]
add rdx, 0x20
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movd xmm0, dword [0x14028b6dc]
lea r8, [rbp - 0x31]
mov rdx, qword [rbp + 7]
mov r9d, 4
mov rcx, qword [0x140295d60]
add rdx, 0x2fc
cvtdq2ps xmm0, xmm0
mov qword [rsp + 0x20], rdi
movss dword [rbp - 0x31], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movd xmm0, dword [0x14028b6dc]
lea rdx, [rbx + 0x30]
mov rcx, qword [0x140295d60]
lea r8, [rbp - 0x11]
cvtdq2ps xmm0, xmm0
mov r9d, 4
mov qword [rsp + 0x20], rdi
movss dword [rbp - 0x11], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1402956a8], 0
je 0x14005af2b
mov qword [rsp + 0x118], rsi
mov rsi, qword [0x140295dd8]
add rsi, qword [0x140295d68]
mov qword [rsp + 0x128], r14
mov r14d, 0x7d0
mov rcx, qword [0x140295d60]
lea r8, [rbp + 0x2f]
mov r9d, 8
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x2f]
test rdx, rdx
je 0x14005af0d
mov rcx, qword [0x140295d60]
lea r8, [rbp + 0x37]
add rdx, 0x10
mov qword [rsp + 0x20], rdi
mov r9d, listen
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x1402956a8], 0
je 0x14005af0d
mov ebx, 5
mov rdx, qword [0x140295df8]
lea r8, [rbp - 0x39]
mov rcx, qword [0x140295d60]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x39]
lea r8, [rbp - 0x49]
movss xmm0, dword [rbp + 0x37]
add rdx, 0x30
movss xmm1, dword [rbp + 0x3b]
mov r9d, listen
mov rcx, qword [0x140295d60]
movss dword [rbp - 0x49], xmm0
movss dword [rbp - 0x45], xmm1
mov dword [rbp - 0x41], 0xc3480000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140295df8]
lea r8, [rbp - 0x29]
movss xmm0, dword [rbp + 0x37]
add rdx, 0x90
movss xmm1, dword [rbp + 0x3b]
mov r9d, listen
mov rcx, qword [0x140295d60]
movss dword [rbp - 0x29], xmm0
movss dword [rbp - 0x25], xmm1
mov dword [rbp - 0x21], 0xc3480000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub rbx, 1
jne 0x14005ae52
mov byte [0x1402956a8], bl
add rsi, 8
sub r14, 1
jne 0x14005adf4
mov r14, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x118]
cmp byte [0x140295861], 0
je 0x14005af65
mov rdx, qword [0x140295de0]
lea r8, [rbp - 0x31]
add rdx, qword [0x140295df8]
mov r9d, 4
mov rcx, qword [0x140295d60]
mov dword [rbp - 0x31], 0x43480000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x140295858], 0
je 0x14005af9f
mov rdx, qword [0x140295df0]
lea r8, [rbp - 9]
add rdx, qword [0x140295df8]
mov r9d, 4
mov rcx, qword [0x140295d60]
mov dword [rbp - 9], 0x42c80000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x140295863], 0
je 0x14005afe6
mov rdx, qword [0x140295de0]
lea r8, [rbp - 1]
movss xmm0, dword [0x14028b6fc]
mov r9d, 4
add rdx, qword [0x140295df8]
mov rcx, qword [0x140295d60]
movss dword [rbp - 1], xmm0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x140295863], 0
cmp byte [0x140295860], 0
je 0x14005b055
mov rdx, qword [0x140295e38]
lea r8, [rbp + 0x17]
add rdx, qword [0x140295df8]
mov r9d, 8
mov rcx, qword [0x140295d60]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x14005b055
mov rdx, qword [0x140295db8]
lea r8, [rbp + 7]
movss xmm0, dword [0x14028b6e8]
add rdx, rcx
mov rcx, qword [0x140295d60]
mov r9d, 4
movss dword [rbp + 7], xmm0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x140295859], 0
je 0x14005b0c1
mov rdx, qword [0x140295e38]
lea r8, [rbp + 0x1f]
add rdx, qword [0x140295df8]
mov r9d, 8
mov rcx, qword [0x140295d60]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x1f]
test rdx, rdx
je 0x14005b0c1
movss xmm0, dword [0x14028b6f0]
lea r8, [rbp + 0xf]
mov rcx, qword [0x140295d60]
add rdx, 0x170
mov r9d, 4
movss dword [rbp + 0xf], xmm0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x140295850], 0
je 0x14005b108
mov rdx, qword [0x140295df0]
lea r8, [rbp - 0x39]
movss xmm0, dword [0x14028b6f4]
mov r9d, 4
add rdx, qword [0x140295df8]
mov rcx, qword [0x140295d60]
movss dword [rbp - 0x39], xmm0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x140295850], 0
cmp byte [0x14029584d], 0
mov rcx, qword [0x140295d60]
mov qword [rsp + 0x20], rdi
je 0x14005b3fe
mov rdx, qword [0x140295e20]
lea r8, [rbp - 0x49]
add rdx, 0x3d0
mov r9d, listen
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140295df8]
lea r8, [rbp - 0x79]
mov rcx, qword [0x140295d60]
add rdx, 0x90
mov r9d, listen
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140295df8]
lea r8, [rbp + 0x1f]
mov rcx, qword [0x140295d60]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140295df8]
lea r8, [rbp + 0x17]
mov rcx, qword [0x140295d60]
add rdx, 0x20
mov rbx, qword [rbp + 0x1f]
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x17]
lea r8, [rbp - 0x39]
mov rcx, qword [0x140295d60]
add rdx, 0x2c
mov r9d, 4
mov dword [rbp - 0x39], 0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x14028b6e0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005b241
movss xmm1, dword [rbp - 0x79]
movd xmm2, dword [reloc.WS2_32.dll_accept]
cvtdq2ps xmm2, xmm2
movaps xmm0, xmm2
mulss xmm0, dword [rbp - 0x49]
addss xmm1, xmm0
movaps xmm0, xmm2
mulss xmm0, dword [rbp - 0x45]
mulss xmm2, dword [rbp - 0x41]
movss dword [rbp - 0x79], xmm1
movss xmm1, dword [rbp - 0x75]
addss xmm1, xmm0
movss xmm0, dword [rbp - 0x71]
addss xmm0, xmm2
movss dword [rbp - 0x75], xmm1
movss dword [rbp - 0x71], xmm0
mov ecx, dword [0x14028b6f8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005b29c
movss xmm1, dword [rbp - 0x79]
movd xmm2, dword [reloc.WS2_32.dll_accept]
cvtdq2ps xmm2, xmm2
movaps xmm0, xmm2
mulss xmm0, dword [rbp - 0x49]
subss xmm1, xmm0
movaps xmm0, xmm2
mulss xmm0, dword [rbp - 0x45]
mulss xmm2, dword [rbp - 0x41]
movss dword [rbp - 0x79], xmm1
movss xmm1, dword [rbp - 0x75]
subss xmm1, xmm0
movss xmm0, dword [rbp - 0x71]
subss xmm0, xmm2
movss dword [rbp - 0x75], xmm1
movss dword [rbp - 0x71], xmm0
mov ecx, dword [0x14028b6ec]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005b2f7
movss xmm1, dword [rbp - 0x79]
movd xmm2, dword [reloc.WS2_32.dll_accept]
cvtdq2ps xmm2, xmm2
movaps xmm0, xmm2
mulss xmm0, dword [rbp - 0x45]
subss xmm1, xmm0
movaps xmm0, xmm2
mulss xmm0, dword [rbp - 0x49]
mulss xmm2, dword [rbp - 0x41]
movss dword [rbp - 0x79], xmm1
movss xmm1, dword [rbp - 0x75]
addss xmm1, xmm0
movss xmm0, dword [rbp - 0x71]
addss xmm0, xmm2
movss dword [rbp - 0x75], xmm1
movss dword [rbp - 0x71], xmm0
mov ecx, dword [0x14028b700]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005b352
movss xmm1, dword [rbp - 0x79]
movd xmm2, dword [reloc.WS2_32.dll_accept]
cvtdq2ps xmm2, xmm2
movaps xmm0, xmm2
mulss xmm0, dword [rbp - 0x45]
addss xmm1, xmm0
movaps xmm0, xmm2
mulss xmm0, dword [rbp - 0x49]
mulss xmm2, dword [rbp - 0x41]
movss dword [rbp - 0x79], xmm1
movss xmm1, dword [rbp - 0x75]
subss xmm1, xmm0
movss xmm0, dword [rbp - 0x71]
subss xmm0, xmm2
movss dword [rbp - 0x75], xmm1
movss dword [rbp - 0x71], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005b37b
movss xmm1, dword [rbp - 0x71]
movd xmm0, dword [reloc.WS2_32.dll_accept]
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movss dword [rbp - 0x71], xmm1
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005b3a4
movss xmm1, dword [rbp - 0x71]
movd xmm0, dword [reloc.WS2_32.dll_accept]
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
movss dword [rbp - 0x71], xmm1
movsd xmm0, qword [rbp - 0x79]
lea rdx, [rbx + 0x50]
mov eax, dword [rbp - 0x71]
lea r8, [rbp - 0x29]
mov rcx, qword [0x140295d60]
mov r9d, listen
movsd qword [rbp - 0x29], xmm0
mov dword [rbp - 0x21], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsd xmm0, qword [rbp - 0x79]
lea r8, [rbp + 0x37]
mov rdx, qword [0x140295df8]
mov r9d, listen
mov eax, dword [rbp - 0x71]
add rdx, 0x90
movsd qword [rbp + 0x37], xmm0
mov dword [rbp + 0x3f], eax
jmp 0x14005b432
mov rdx, qword [0x140295df8]
lea r8, [rbp - 0x79]
add rdx, 0x20
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x79]
lea r8, [rbp - 0x39]
add rdx, 0x2c
mov dword [rbp - 0x39], 0x3f800000
mov r9d, 4
mov rcx, qword [0x140295d60]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x110]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14010c810
add rsp, 0x100
pop rbp
ret