Function at 0x1400602f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140129080]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [0x14020b610], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea rcx, [rsp + 0x30]
mov dword [0x14020b388], eax
call qword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [reloc.WS2_32.dll_accept], 0
mov edi, dword [rsp + 0x30]
mov esi, dword [rsp + 0x34]
je 0x14006057c
mov ecx, dword [0x14020fd90]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
test al, 1
je 0x1400604b1
cmp byte [0x14020fa9d], bl
mov eax, dword [0x14020b610]
mov ecx, dword [0x14020b388]
sete r8b
cdq
mov byte [0x14020fa9d], r8b
sub eax, edx
movzx r9d, r8b
sar eax, 1
mov r10d, eax
cmp edi, eax
je 0x1400603b7
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
je 0x1400603b7
mov eax, dword [0x14020fee0]
cmp dword [0x1401da078], eax
jne 0x1400603b7
mov byte [0x14020fa9d], bl
jmp 0x1400603f9
test r9b, r9b
je 0x1400603f9
cmp edi, r10d
jne 0x1400603f9
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x1400603f9
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x14020b388]
cmp dword [0x14020fe38], ebx
je 0x140060477
mov eax, dword [0x14020b610]
cdq
sub eax, edx
sar eax, 1
cmp edi, eax
jne 0x140060477
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x140060477
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8cfc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8f3c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, gethostname
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x14020b388]
cmp byte [0x14020fa9d], bl
jne 0x1400604c3
movzx ecx, byte [0x1401d8cfc]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8f3c]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x14020fd80], ebx
cmp byte [0x14020fa9d], bl
je 0x140060751
mov ecx, dword [0x14020b388]
cmp byte [0x14020b959], bl
je 0x140060751
mov eax, dword [0x14020b610]
cdq
sub eax, edx
sar eax, 1
cmp edi, eax
jne 0x140060751
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x140060751
mov ecx, dword [0x1401d8fd0]
inc dword [0x14020fd80]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, dword [0x1401d8d84]
call qword [sym.imp.KERNEL32.dll_Sleep]
cvttss2si rcx, dword [0x1401d907c]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x1401d8f4c]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
jmp 0x140060751
mov eax, dword [0x14020b610]
cdq
sub eax, edx
sar eax, 1
cmp edi, eax
jne 0x140060751
mov eax, dword [0x14020b388]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x140060751
mov ecx, dword [0x14020fd90]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140060714
mov eax, dword [0x14020fd80]
xor ebx, ebx
test eax, eax
jne 0x1400605f0
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea ecx, [rbx + 0x18]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
lea r8d, [rbx + 2]
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x14020fd80]
cmp dword [0x14020fe38], ebx
je 0x140060658
test eax, eax
jne 0x140060658
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8cfc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8f3c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, gethostname
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x14020fd80]
inc eax
cmp byte [0x14020b959], bl
mov dword [0x14020fd80], eax
je 0x140060751
mov eax, dword [0x14020b610]
cdq
sub eax, edx
sar eax, 1
cmp edi, eax
jne 0x140060751
mov eax, dword [0x14020b388]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x140060751
mov ecx, dword [0x1401d8fd0]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, dword [0x1401d8d84]
call qword [sym.imp.KERNEL32.dll_Sleep]
cvttss2si rcx, dword [0x1401d907c]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x1401d8f4c]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
jmp 0x140060751
cmp dword [0x14020fd80], 1
jl 0x140060751
movzx ecx, byte [0x1401d8cfc]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8f3c]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor ebx, ebx
mov dword [0x14020fd80], ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d4090
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret