Function at 0x14003d270
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14003d270
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140112718]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov edx, dword [str.wtd_a]
mov dword [rbp - 0x20], edx
movzx r8d, word [0x1400fe214]
mov word [rbp - 0x1c], r8w
movzx edx, byte [0x1400fe216]
mov byte [rbp - 0x20], 0x47
xor byte [rbp - 0x1f], 0x31
xor byte [rbp - 0x1e], 0x32
xor byte [rbp - 0x1d], 0x33
xor r8b, 0x34
mov byte [rbp - 0x1c], r8b
xor byte [rbp - 0x1b], 0x35
xor dl, 0x36
mov byte [rbp - 0x1a], dl
xor edx, edx
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_FindWindowA]
movabs r14, 0x7fffffffffffffff
cmp rbx, rax
jne 0x14003d401
mov dword [rbp - 0x40], Ordinal_27
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp - 0x2c], eax
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x14003d33b
mov rax, qword [rbp - 0x38]
add rax, 0xffffffffffff3caf
cmp rax, 0xc34e
jbe 0x14003d401
mov ecx, dword [0x140114a64]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003d401
cmp byte [0x140114a68], 0
je 0x14003d401
mov ecx, dword [0x140114a64]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movabs rsi, 0x7ffffffffff0bdbf
test ax, ax
jns 0x14003d3f1
nop dword [rax + rax]
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14003d3f1
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003d3a7
imul rax, rax, 0x64
jmp 0x14003d3c2
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rsi
jge 0x14003d3d3
add rax, 0xf4240
mov qword [rbp - 0x20], rax
jmp 0x14003d3d7
mov qword [rbp - 0x20], r14
lea rcx, [rbp - 0x20]
call fcn.14002d590
mov ecx, dword [0x140114a64]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14003d380
cmp byte [0x14011461a], 0
je 0x14003d426
mov byte [0x14011461a], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003d529
imul rax, rax, 0x64
jmp 0x14003d547
cmp byte [0x14011461b], 0
je 0x14003d490
nop
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003d44e
imul rax, rax, 0x64
jmp 0x14003d469
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rsi
jge 0x14003d47a
add rax, 0xf4240
mov qword [rbp - 0x20], rax
jmp 0x14003d47e
mov qword [rbp - 0x20], r14
lea rcx, [rbp - 0x20]
call fcn.14002d590
cmp byte [0x14011461b], 0
jne 0x14003d430
mov byte [0x14011461b], 1
mov byte [0x14011461a], 1
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400c1680
mov qword [rax], rdi
lea rcx, [0x14003ccf0]
mov qword [rax + 8], rcx
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140031c40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14003d516
cmp dword [rbp - 0x38], 0
je 0x14003d50a
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14003d50a
jmp 0x14003d401
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7ffffffffff0bdbe
cmp rax, rcx
jg 0x14003d562
add rax, 0xf4240
mov qword [rbp - 0x20], rax
jmp 0x14003d566
mov qword [rbp - 0x20], r14
lea rcx, [rbp - 0x20]
call fcn.14002d590
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c1540
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret