Function at 0x14004d100
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xf8
mov rax, qword [0x1400ef080]
xor rax, rsp
mov qword [rbp + 0x27], rax
xorps xmm0, xmm0
lea rcx, [rbp + 7]
xor esi, esi
mov edi, esi
movups xmmword [0x1400ef160], xmm0
lea edx, [rsi + 0xa]
movups xmmword [0x1400ef170], xmm0
movups xmmword [0x1400ef180], xmm0
call fcn.14003a7e0
mov rbx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14004d154
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14004d1a4
mov rcx, qword [rbp + 7]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d19f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d19f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2ee4
mov qword [rsp + 0x120], r12
lea r8, [0x14004c2e0]
mov qword [rsp + 0x128], r13
xor r9d, r9d
mov qword [rsp + 0x130], r14
xor edx, edx
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov qword [rsp + 0xf0], r15
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x14004cfe0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x14003b170]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1400ef168], 0x12
je 0x14004d4be
movabs rbx, 0x32fde5ad5ab68a65
movabs r15, 0x57898cc32ec4e523
movabs r12, 0x23d93bb800d1ac06
movabs r14, 0x23d93bb800d18c26
movabs r13, 0x5baa89cc3fc4e430
nop word [rax + rax]
mov ecx, 0xfc
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14004d4be
cmp byte [0x1400f0920], sil
jne 0x14004d4be
cmp byte [reloc.WS2_32.dll_accept], sil
jne 0x14004d2b5
lea rcx, [rbp - 0x51]
call fcn.14003af10
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [0x1400f03a0], xmm0
movsd xmm0, qword [rax + 0x20]
movsd qword [0x1400f03c0], xmm0
movups xmmword [0x1400f03b0], xmm1
mov eax, 0x10624dd3
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul ecx, edx, 0x1f4
cmp edi, ecx
jne 0x14004d32d
mov qword [rbp - 0x79], r15
lea rdx, [rbp - 0x79]
mov qword [rbp - 0x71], r12
lea rcx, [rbp - 0x69]
movdqa xmm0, xmmword [rbp - 0x79]
movabs rax, 0x23d93bb877bee848
mov qword [rbp - 0x69], r13
mov qword [rbp - 0x61], rax
mov qword [rbp - 9], rbx
mov qword [rbp - 1], r14
xorps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 0x79], xmm0
movdqa xmm0, xmmword [rbp - 0x69]
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], r14
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x69], xmm0
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14004d5eb
mov rdx, qword [0x1400f0350]
lea rcx, [0x1400ef160]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
inc edi
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14004d36f
lea rcx, [0x1400ef160]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x1400ef160]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [0x1400f0470]
cmp rax, rcx
jne 0x14004d3bc
mov edx, 3
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov rcx, qword [0x1400f0350]
xor r9d, r9d
mov dword [rsp + 0x30], 3
mov rdx, rax
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x1400f0470]
xorps xmm0, xmm0
mov qword [rbp - 0x29], rsi
lea rdx, [rbp - 0x21]
movups xmmword [rbp - 0x21], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1400f0470]
lea rdx, [rbp - 0x29]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp - 0x29]
mov rcx, qword [0x1400f0470]
mov dword [rbp - 0x21], eax
mov eax, dword [rbp - 0x25]
mov dword [rbp - 0x1d], eax
mov rax, qword [0x1400f02f0]
mov qword [rax + 0x120], rcx
mov eax, dword [0x1400f0930]
mov ecx, dword [rbp - 0x15]
mov edx, dword [rbp - 0x19]
cmp dword [rbp - 0x21], eax
jne 0x14004d42f
cmp edx, dword [0x1400f0938]
jne 0x14004d42f
mov eax, dword [0x1400f0934]
cmp dword [rbp - 0x1d], eax
jne 0x14004d42f
cmp ecx, dword [0x1400f093c]
je 0x14004d490
movups xmm0, xmmword [rbp - 0x21]
mov r9d, dword [rbp - 0x25]
mov r8d, dword [rbp - 0x29]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov dword [0x1400f0480], edx
mov dword [0x1400f0484], ecx
mov dword [0x1400ef110], edx
xor edx, edx
mov dword [0x1400ef114], ecx
mov rcx, qword [0x1400f0350]
movups xmmword [0x1400f0930], xmm0
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x1400ef108]
lea rdx, [0x1400ef110]
mov rax, qword [rcx]
call qword [rax + 0x80]
call fcn.14004bfb0
mov eax, 0x3e8
cdq
idiv dword [0x1400ef208]
movsxd rcx, eax
mov qword [rbp - 0x59], rcx
lea rcx, [rbp - 0x59]
call fcn.14004fad0
cmp dword [0x1400ef168], 0x12
jne 0x14004d260
call fcn.1400293a0
mov rax, qword [0x1400f02f0]
test rax, rax
je 0x14004d4d8
mov rbx, qword [rax + 0xe8]
jmp 0x14004d4db
mov rbx, rsi
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x14004d4f5
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1400f02f0]
mov qword [rdi + 0xd0], rsi
mov qword [rdi + 0xe0], rsi
test rax, rax
je 0x14004d50e
dec dword [rax + 0x3b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x1400f02f0]
mov rcx, rbx
call fcn.140009c10
cmp qword [0x1400f02f0], rbx
jne 0x14004d536
mov qword [0x1400f02f0], rsi
test rbx, rbx
je 0x14004d55e
mov rcx, rbx
call fcn.1400188e0
mov rax, qword [0x1400f02f0]
test rax, rax
je 0x14004d555
dec dword [rax + 0x3b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1400ef108]
test rcx, rcx
je 0x14004d580
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x1400ef108]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1400ef100]
test rcx, rcx
je 0x14004d592
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1400f0350]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [0x1400f0318]
mov rcx, qword [0x1400f0340]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov r14, qword [rsp + 0x130]
mov r13, qword [rsp + 0x128]
mov r12, qword [rsp + 0x120]
mov r15, qword [rsp + 0xf0]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400b2b70
add rsp, 0xf8
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor ecx, ecx
call fcn.14003abb0
int3