Function at 0x140044de0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140044e1c
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140044e3b
mov rcx, qword [0x140481cc0]
mov edx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov byte [reloc.WS2_32.dll_accept], 0
jmp 0x140044e3b
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x140044e3b
mov rcx, qword [0x140481cc0]
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov byte [reloc.WS2_32.dll_accept], 1
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140044e77
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140044e77
mov ecx, reloc.WLDAP32.dll_Ordinal_46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x140044e77
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140044e85
cmp byte [reloc.WS2_32.dll_accept], 0
sete byte [0x140122e4d]
mov rax, qword [0x140481780]
xor esi, esi
test rax, rax
je 0x140044e9c
mov rcx, qword [rax + 0xa0]
jmp 0x140044e9f
mov rcx, rsi
cmp qword [rcx + 0x18], rsi
jne 0x140044ec0
test rax, rax
je 0x140044ec0
mov rcx, qword [rax + 0xa0]
test rcx, rcx
je 0x140044ec0
cmp qword [rcx], rsi
je 0x140044ec0
call fcn.14002ba60
call fcn.14002c440
call fcn.140007a50
cmp byte [reloc.WS2_32.dll_accept], sil
je 0x140044ed8
call fcn.14004db60
mov rcx, qword [0x140481968]
mov rbx, qword [0x140481780]
mov rdi, rcx
mov qword [rsp + 0x50], rcx
test rcx, rcx
jne 0x140044f0f
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140044f07
mov rax, qword [rbx + 0x58]
mov rcx, qword [rax + 0x50]
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
mov rdi, rcx
call fcn.1400101f0
lea rdx, [rsp + 0x50]
lea rcx, [rbx + 0x4020]
call fcn.1400190f0
mov rdx, qword [rdi + 0x40]
mov rcx, qword [rbx + 0x3e90]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x280]
call fcn.140021f90
call fcn.14004f6f0
mov rbx, qword [0x140481780]
mov rax, qword [rbx + 0x3e90]
mov rcx, qword [rax + 0x280]
movsxd rdx, dword [rcx + 0x68]
lea eax, [rdx - 1]
mov dword [rcx + 0x68], eax
test eax, eax
jne 0x140044f6d
mov rax, rsi
jmp 0x140044f76
mov rax, qword [rcx + 0x70]
mov rax, qword [rax + rdx*8 - 0x10]
mov qword [rcx + 0x98], rax
call fcn.140021d40
movsxd rcx, dword [rbx + 0x4020]
lea eax, [rcx - 1]
mov dword [rbx + 0x4020], eax
test eax, eax
jne 0x140044fb3
mov rax, qword [0x140481780]
mov rcx, qword [rax + 0x68]
test rcx, rcx
jne 0x140044fbf
mov rax, qword [rax + 0x58]
mov rcx, qword [rax + 0x50]
mov rcx, qword [rcx]
jmp 0x140044fbf
mov rax, qword [rbx + 0x4028]
mov rcx, qword [rax + rcx*8 - 0x10]
call fcn.1400101f0
call fcn.14000a290
mov rcx, qword [0x140481cc8]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 7]
call qword [rax + 0x1c8]
mov rcx, qword [0x140481cc8]
xor r8d, r8d
mov rax, qword [rcx]
lea edx, [r8 + 0x1b]
call qword [rax + 0x1c8]
mov rcx, qword [0x140481cc8]
xor r8d, r8d
mov edx, 0xae
mov rax, qword [rcx]
call qword [rax + 0x1c8]
mov rcx, qword [0x140481cc8]
mov r9d, 1
movss xmm0, dword [0x1400cf17c]
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
movss dword [rsp + 0x28], xmm0
mov rax, qword [rcx]
mov dword [rsp + 0x20], esi
call qword [rax + 0x158]
mov rcx, qword [0x140481cc8]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14004508a
call fcn.14000a5e0
mov rax, qword [0x140481780]
mov rcx, qword [rax + 0x4090]
mov rcx, qword [rcx]
add rcx, 0x48
cmp byte [rcx], sil
cmove rcx, rsi
call fcn.14002b4b0
mov rcx, qword [0x140481cc8]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x140481cc8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140045168
mov rcx, qword [0x140481cc8]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x140045168
mov rbx, qword [0x140481780]
test rbx, rbx
je 0x14004512f
mov rbx, qword [rbx + 0xa0]
test rbx, rbx
je 0x14004512f
cmp qword [rbx], rsi
je 0x14004512f
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400450fa
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004510d
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14004512f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [0x140481780]
mov qword [rbx + 0x18], rsi
mov rcx, qword [rax + 0x58]
mov qword [rcx + 8], rsi
mov rcx, qword [0x140481cc8]
lea rdx, [0x1404817b0]
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rax, qword [0x140481780]
test rax, rax
je 0x140045168
mov rax, qword [rax + 0xa0]
test rax, rax
je 0x140045168
cmp qword [rax], rsi
je 0x140045168
call fcn.14002ba60
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret