Function at 0x1400016a0
Capabilities:
Create thread
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.140001290
mov ebx, eax
mov ecx, eax
call fcn.140001340
mov r13, rax
lea rdx, str.pid:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001cd0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.client:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001cd0
mov rdx, r13
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, ebx
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
xor r12d, r12d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400013f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [r12 + 0x2e]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x14000192e
lea rcx, [r13 + 0x1729348]
call fcn.1400020c0
mov rbx, rax
test rax, rax
je 0x14000191b
lea rcx, [rsp + 0x30]
call fcn.1400019c0
nop
lea rcx, [rbx + 0x1308]
call fcn.1400020c0
lea rcx, [rax + 0x10]
call fcn.1400020c0
lea rcx, [rax + 0x20]
call fcn.1400020c0
mov qword [rsp + 0x20], r12
mov r9d, 0x104
lea r8, [0x140007710]
mov rdx, rax
mov rcx, qword [0x140007818]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, [rsp + 0x30]
call fcn.140001940
lea rcx, [rbx + 0x3cb]
call fcn.140002110
mov r14d, eax
lea rcx, [rbx + 0x1400]
call fcn.140002160
movzx r15d, al
lea rcx, [rbx + 0x15a4]
call fcn.140002110
mov ebx, eax
test eax, eax
jle 0x140001905
lea rcx, [r13 + 0x18b3fa8]
call fcn.1400020c0
mov ecx, ebx
sar ecx, 9
shl ecx, 3
movsxd rcx, ecx
add rax, 0x10
add rcx, rax
call fcn.1400020c0
and ebx, 0x1ff
imul ecx, ebx, 0x78
add rcx, rax
call fcn.1400020c0
mov rbx, rax
lea rcx, [rax + 0x3cb]
call fcn.140002110
mov edi, eax
lea rcx, [rbx + 0x334]
call fcn.140002110
mov esi, eax
movzx edx, r15b
lea rcx, [rsp + 0x30]
call fcn.140001540
mov ebx, eax
cmp edi, r14d
je 0x140001905
test esi, esi
jle 0x140001905
test eax, eax
je 0x140001905
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8002
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8004
call qword [sym.imp.USER32.dll_mouse_event]
lea rdx, str.clicked_with_delay:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001cd0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140002080]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x30]
call fcn.140001960
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001782
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]