Function at 0x14007d9d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14050d700]
xor rax, rsp
mov qword [rbp + 7], rax
mov r14, rdx
xor r15d, r15d
movabs r12, 0x7fffffffff0bdbff
movabs r13, 0x7fffffffffffffff
movsd xmm7, qword [0x1404f4cb0]
nop dword [rax + rax]
cmp byte [0x140587679], r15b
jne 0x14007da94
mov rbx, r15
lea rdi, [0x1404f16c0]
mov esi, Ordinal_32
nop dword [rax + rax]
movzx eax, byte [rdi]
mov byte [rbp - 0x49], al
mov rdx, qword [0x1405bd3f0]
add rdx, 0xa2eee4
add rdx, rbx
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc rbx
lea rdi, [rdi + 8]
sub rsi, 1
jne 0x14007da50
mov byte [0x140587679], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
mov esi, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
mov edi, eax
call fcn.14005fba0
mov ecx, dword [0x140586810]
mov dword [rsp + 0x20], ecx
movzx r9d, byte [reloc.WS2_32.dll_accept]
movzx r8d, byte [0x140586814]
mov rdx, r14
call fcn.14005fdc0
mov rbx, rax
mov rdx, qword [0x1405c0990]
add rdx, 0x90
mov qword [rsp + 0x20], r15
mov r9d, recv
lea r8, [rbp - 9]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.14009a2a0
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp - 0x19]
call fcn.14009a330
call fcn.14009a2a0
movsd xmm0, qword [rbp - 0x19]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x11]
mov dword [rbp - 0x21], eax
mov r9, r14
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x31]
call fcn.14009a640
movss xmm0, dword [rbp - 0x2d]
cvtps2pd xmm0, xmm0
movd xmm1, edi
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
movaps xmm1, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
movss xmm0, dword [rbp - 0x31]
cvtps2pd xmm0, xmm0
movd xmm1, esi
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
movaps xmm1, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm6
ja 0x14007db92
sqrtsd xmm6, xmm6
jmp 0x14007db9d
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movaps xmm6, xmm0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, 4
mov eax, dword [rax + rcx]
cmp dword [0x1405c0e48], eax
jle 0x14007dc08
lea rcx, [0x1405c0e48]
call fcn.140131bc0
cmp dword [0x1405c0e48], 0xffffffff
jne 0x14007dc08
mov qword [0x1405c0e30], 1
mov dword [0x1405c0e3c], 0x50
mov dword [0x1405c0e40], 0x1f4
mov word [0x1405c0e44], 0x100
lea rcx, [0x1405c0e48]
call fcn.140131b54
movd xmm0, dword [0x1405c0e3c]
cvtdq2pd xmm0, xmm0
comisd xmm0, xmm6
jbe 0x14007dd59
call fcn.14008b680
mov ecx, dword [rax + 4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14007dd47
cmp byte [0x14058767a], r15b
jne 0x14007dd20
mov byte [rbp - 0x49], 0xe9
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7ef8
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rbp - 0x49], 0xe7
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7ef9
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rbp - 0x49], reloc.WS2_32.dll_WSAGetLastError
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7efa
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rbp - 0x49], 0xa4
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7efb
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rbp - 0x49], 0xff
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7efc
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14058767a], 1
mov rdx, qword [0x1405bd3f0]
add rdx, 0xa2ef39
mov qword [rsp + 0x20], r15
mov r9d, recv
lea r8, [rbp - 0x19]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp - 0x41]
call fcn.14000f700
mov rax, qword [rbp - 0x41]
jmp 0x14007de64
cmp byte [0x14058767a], r15b
je 0x14007de53
mov byte [rbp - 0x49], 0xf3
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7ef8
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rbp - 0x49], 0x41
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7ef9
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rbp - 0x49], reloc.WS2_32.dll_ntohs
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7efa
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rbp - 0x49], reloc.WS2_32.dll_recv
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7efb
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [rbp - 0x49], Ordinal_26
mov rdx, qword [0x1405bd3f0]
add rdx, 0xfe7efc
mov qword [rsp + 0x20], r15
mov r9d, 1
lea r8, [rbp - 0x49]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov byte [0x14058767a], r15b
lea rcx, [rbp - 0x41]
call fcn.14000f700
mov rax, qword [rbp - 0x41]
jmp 0x14007de64
lea rcx, [rbp - 0x41]
call fcn.14000f700
mov rax, qword [rbp - 0x41]
mov qword [rbp - 0x39], rax
cmp rax, r12
je 0x14007de92
mov ecx, 1
mov edx, 0xff
cmovl ecx, edx
test cl, cl
jns 0x14007de92
add rax, 0xf42400
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x39]
call fcn.14005e6a0
jmp 0x14007da30
mov qword [rbp - 0x39], r13
lea rcx, [rbp - 0x39]
call fcn.14005e6a0
jmp 0x14007da30