Function at 0x140031560
Capabilities:
Log keystrokes via polling
Read file on windows
Terminate process

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov r14, qword [0x1400eda68]
lea rdx, [0x1400edaf8]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
jns 0x14003159c
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1400edba4]
lea rdx, [0x1400edb88]
mov rcx, qword [0x1400edaf8]
mov r9, r14
mov qword [rsp + 0x38], rdx
lea rdx, [0x1400edb40]
mov dword [0x1400edb40], eax
mov eax, dword [0x1400edba0]
mov qword [0x1400edb58], 1
mov dword [0x1400edb68], 1
mov qword [0x1400edb60], r14
mov dword [0x1400edb48], 0x15
mov dword [0x1400edb44], eax
mov dword [0x1400edb6c], 1
mov dword [0x1400edb70], 0x50
mov dword [0x1400edb7c], 0x80000000
mov qword [rsp + 0x1d0], rdi
xor edi, edi
mov qword [0x1400edb4c], rdi
mov qword [0x1400edb74], rdi
mov dword [0x1400edb54], edi
mov rax, qword [rcx]
lea r8d, [rdi + 1]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x20], 0x40
call qword [rax + 0xa0]
test eax, eax
jns 0x14003166f
mov rcx, qword [0x1400edaf8]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
lea ecx, [rdi + 4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1d8], r12
mov qword [rsp + 0x1a0], r15
call fcn.140005a20
mov rbx, qword [0x1400eda20]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
mov qword [rbx + 0x20], rdi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r15, qword [rbx + 0x50]
lea r12, str.C:WindowsFontsVerdana.ttf
mov rcx, r12
lea rdx, [0x1400b3a94]
call fcn.1400031f0
mov rbx, rax
test rax, rax
je 0x140031967
mov rcx, rax
mov qword [rsp + 0x1c8], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140031956
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140031956
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140031956
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140031956
cmp rdi, 0xffffffffffffffff
je 0x140031956
mov rax, qword [0x1400eda20]
test rax, rax
je 0x140031742
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140031956
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140031799
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400eda20]
test rax, rax
je 0x14003178b
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14003195f
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm7
movaps xmmword [rsp + 0x170], xmm8
movaps xmmword [rsp + 0x160], xmm9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
movss xmm1, dword [0x1400b87d4]
xor eax, eax
movss xmm0, dword [0x1400b88c4]
xorps xmm3, xmm3
mov qword [rbp - 0x40], rax
xorps xmm2, xmm2
movsd xmm9, qword [rbp - 0x40]
mov eax, 0xffff
movups xmmword [rbp - 0x70], xmm3
mov word [rbp - 0x6c], ax
shufps xmm2, xmm2, 0xe1
xorps xmm7, xmm7
movups xmm4, xmmword [rbp - 0x70]
movss xmm2, xmm0
movaps xmmword [rbp - 0x10], xmm3
movss xmm4, xmm1
shufps xmm2, xmm2, 0xe1
movups xmmword [rsp + 0x50], xmm3
mov dword [rsp + 0x58], 3
movups xmmword [rsp + 0x40], xmm3
mov byte [rsp + 0x4c], 1
movdqa xmm0, xmm4
mov dword [rsp + 0x5c], 1
movups xmm5, xmmword [rsp + 0x40]
movups xmm6, xmmword [rsp + 0x50]
psrldq xmm0, 6
xorps xmm1, xmm1
movd eax, xmm0
xorps xmm8, xmm8
movaps xmmword [rbp - 0x30], xmm5
movaps xmmword [rbp - 0x20], xmm6
movaps xmmword [rbp], xmm7
movaps xmmword [rbp + 0x10], xmm2
movaps xmmword [rbp + 0x20], xmm4
movaps xmmword [rbp + 0x30], xmm1
movaps xmmword [rbp + 0x40], xmm8
movsd qword [rbp + 0x50], xmm9
movups xmmword [rbp - 0x80], xmm2
movups xmmword [rbp - 0x70], xmm4
test al, al
jne 0x1400318e3
lea r9, [0x1400b8484]
nop
movzx eax, byte [r9 - 1]
lea rcx, [r9 - 1]
cmp al, 0x2f
je 0x140031899
cmp al, 0x5c
je 0x140031899
mov r9, rcx
cmp rcx, r12
ja 0x140031880
movsd xmm0, qword [0x1400b87f8]
lea r8, str._s___.0fpx
mov edx, Ordinal_41
movsd qword [rsp + 0x20], xmm0
lea rcx, [rbp + 0x26]
call fcn.140003000
movaps xmm1, xmmword [rbp + 0x30]
movaps xmm4, xmmword [rbp + 0x20]
movaps xmm2, xmmword [rbp + 0x10]
movaps xmm3, xmmword [rbp - 0x10]
movaps xmm5, xmmword [rbp - 0x30]
movsd xmm9, qword [rbp + 0x50]
movaps xmm8, xmmword [rbp + 0x40]
movaps xmm7, xmmword [rbp]
movaps xmm6, xmmword [rbp - 0x20]
movss xmm0, dword [0x1400b8844]
lea rdx, [rsp + 0x40]
movaps xmmword [rsp + 0x40], xmm5
mov rcx, r15
movaps xmmword [rsp + 0x50], xmm6
movss dword [rsp + 0x54], xmm0
movaps xmmword [rsp + 0x60], xmm3
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rbp - 0x80], xmm2
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm1
movaps xmmword [rbp - 0x50], xmm8
movsd qword [rbp - 0x40], xmm9
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
call fcn.140023ea0
movaps xmm9, xmmword [rsp + 0x160]
movaps xmm8, xmmword [rsp + 0x170]
movaps xmm7, xmmword [rsp + 0x180]
movaps xmm6, xmmword [rsp + 0x190]
jmp 0x14003195f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x1c8]
call fcn.1400311f0
mov rcx, r14
call fcn.140029260
call fcn.140028ec0
mov r15, qword [rsp + 0x1a0]
xor eax, eax
mov r12, qword [rsp + 0x1d8]
mov rbx, qword [rsp + 0x1c0]
mov rdi, qword [rsp + 0x1d0]
add rsp, 0x1a8
pop r14
pop rbp
ret