Function at 0x1400068f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x58]
sub rsp, 0x158
cmp byte [rcx], 0
mov rdi, rcx
je 0x140006f04
movzx ecx, word [rcx + 0x122]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140006927
cmp dword [rdi + 8], 0
jne 0x140006f04
mov qword [rsp + 0x150], rbx
xor ecx, ecx
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x140], r12
mov qword [rsp + 0x138], r13
mov qword [rsp + 0x130], r14
mov qword [rsp + 0x128], r15
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 1
sub eax, edx
sar eax, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [rdi + 0x30]
lea r9, [rsp + 0x70]
cdq
sub eax, edx
mov edx, dword [rdi + 0x2c]
sar eax, 1
mov r8d, eax
mov eax, ecx
sub eax, edx
mov dword [rsp + 0x68], eax
lea r13d, [rcx + rdx]
mov ecx, dword [rdi + 0x34]
mov r15d, ecx
sub r15d, edx
lea eax, [rcx + rdx]
mov ecx, dword [rdi + 0x38]
mov dword [rbp + 0x88], eax
mov r12d, ecx
mov eax, dword [rdi + 0x10]
sub r12d, edx
lea r14d, [rcx + rdx]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, ebx
sub eax, ecx
mov dword [rbp + 0x78], eax
mov eax, dword [rdi + 0x14]
cdq
lea esi, [rcx + rbx]
mov rcx, qword [rdi + 0x118]
sub eax, edx
sar eax, 1
mov edx, r8d
sub edx, eax
xor ebx, ebx
add eax, r8d
mov qword [rsp + 0x70], rbx
mov dword [rbp + 0x80], eax
lea r8, [rbp - 0x18]
mov rax, qword [rcx]
mov dword [rbp + 0x70], edx
xor edx, edx
call qword [rax + 0x40]
test eax, eax
js 0x140006eca
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
lea rdx, [0x140134e58]
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test ebx, ebx
js 0x140006ebd
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov eax, dword [rbp - 0x48]
lea r9, [rsp + 0x58]
mov rcx, qword [rdi + 0xf8]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], eax
xor ebx, ebx
mov eax, dword [rbp - 0x44]
xor r8d, r8d
mov dword [rsp + 0x7c], eax
mov eax, dword [rbp - 0x38]
mov dword [rbp - 0x78], eax
mov dword [rbp - 0x80], 1
mov dword [rbp - 0x7c], 1
mov qword [rbp - 0x74], 1
mov qword [rbp - 0x6c], 3
mov qword [rbp - 0x64], 0x20000
mov qword [rsp + 0x58], rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jns 0x140006aa6
mov rcx, qword [rsp + 0x60]
jmp 0x140006eb7
mov rcx, qword [rdi + 0x100]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x178]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 0x100]
lea rdx, [rbp - 0x58]
mov qword [rsp + 0x28], rdx
mov r9d, 1
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_WSASetLastError]
test eax, eax
js 0x140006eb2
mov ecx, dword [rbp + 0x70]
cmp ecx, dword [rbp + 0x80]
jge 0x140006e92
mov eax, dword [rbp - 0x48]
mov r10d, ecx
mov r9, qword [rbp - 0x58]
mov r11d, dword [rbp + 0x88]
mov ebx, dword [rsp + 0x68]
imul r10d, eax
lea edx, [rax*4]
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x6c], edx
add r10d, eax
shl r10d, 2
mov edx, eax
cmp eax, esi
jge 0x140006b82
mov r8d, r10d
movsxd rax, r8d
movzx ecx, byte [rax + r9 + 2]
cmp ecx, ebx
jle 0x140006b72
cmp ecx, r13d
jge 0x140006b72
movzx ecx, byte [rax + r9 + 1]
cmp ecx, r15d
jle 0x140006b72
cmp ecx, r11d
jge 0x140006b72
movzx ecx, byte [rax + r9]
cmp ecx, r12d
jle 0x140006b72
cmp ecx, r14d
jl 0x140006b99
inc edx
add r8d, 4
cmp edx, esi
jl 0x140006b41
mov ecx, dword [rbp + 0x70]
mov eax, dword [rbp + 0x78]
add r10d, dword [rsp + 0x6c]
inc ecx
mov dword [rbp + 0x70], ecx
cmp ecx, dword [rbp + 0x80]
jl 0x140006b38
jmp 0x140006e92
lea rcx, [rbp + 0x70]
call fcn.140003380
mov eax, dword [rdi + 0x20]
sub eax, dword [rdi + 0x24]
mov rcx, qword [rbp + 0x70]
sub rcx, qword [rdi + 0x18]
movsxd r8, eax
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jl 0x140006e92
xor esi, esi
cmp byte [rdi + 4], sil
je 0x140006c21
xor eax, eax
lea rdx, [rsp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
movzx eax, word [rdi + 0x12c]
mov r8d, 0x28
movups xmmword [rsp + 0x30], xmm0
mov ecx, 1
mov word [rsp + 0x38], ax
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], esi
call qword [sym.imp.USER32.dll_SendInput]
cmp byte [rdi + 2], 0
mov ecx, dword [rdi + 0x24]
je 0x140006d12
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea rdx, [rsp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
movzx eax, word [rdi + 0x126]
mov r8d, 0x28
movups xmmword [rsp + 0x30], xmm0
mov ecx, 1
mov word [rsp + 0x38], ax
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], esi
call qword [sym.imp.USER32.dll_SendInput]
movzx eax, word [rdi + 0x126]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov word [rsp + 0x38], ax
mov ecx, 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x7d
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [rdi + 0x126]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov word [rsp + 0x38], ax
mov ecx, 1
mov dword [rsp + 0x3c], esi
call qword [sym.imp.USER32.dll_SendInput]
movzx eax, word [rdi + 0x126]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov word [rsp + 0x38], ax
mov ecx, 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rdi + 0xc], 1
jne 0x140006d84
mov ecx, 0x7d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006d34
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x30], 1
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
movzx eax, word [rdi + 0x126]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov word [rsp + 0x38], ax
mov ecx, 1
mov dword [rsp + 0x3c], esi
call qword [sym.imp.USER32.dll_SendInput]
movzx eax, word [rdi + 0x126]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov word [rsp + 0x38], ax
mov ecx, 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.USER32.dll_SendInput]
lea rcx, [rbp + 0x70]
call fcn.140003380
cmp byte [rdi + 4], 0
mov rcx, qword [rax]
mov qword [rdi + 0x18], rcx
je 0x140006deb
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea rdx, [rsp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
movzx eax, word [rdi + 0x12c]
mov r8d, 0x28
movups xmmword [rsp + 0x30], xmm0
mov ecx, 1
mov word [rsp + 0x38], ax
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.USER32.dll_SendInput]
cmp byte [rdi + 3], 0
je 0x140006e92
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400e3bcc
movsd xmm0, qword [0x14013c120]
lea rdx, [rsp + 0x30]
mov ecx, 1
mov r8d, 0x28
mov ebx, 0x41
movd xmm1, eax
xor eax, eax
cvtdq2pd xmm1, xmm1
mov qword [rsp + 0x50], rax
divsd xmm1, qword [0x14013c170]
comisd xmm0, xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x3c], esi
movups xmmword [rsp + 0x40], xmm0
ja 0x140006e59
mov ebx, 0x44
mov word [rsp + 0x38], bx
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov word [rsp + 0x38], bx
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x3c], 2
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x100]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 0x118]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_WSASetLastError]
mov r14, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
mov r12, qword [rsp + 0x140]
mov rsi, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x150]
mov r15, qword [rsp + 0x128]
add rsp, 0x158
pop rdi
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x158
pop rdi
pop rbp
ret