Function at 0x14016be20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
movaps xmmword [rbp - 0x10], xmm8
movapd xmmword [rbp - 0x20], xmm7
movapd xmmword [rbp - 0x30], xmm6
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov eax, dword [0x1406f18e0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406f18e4], 0xa
setl cl
or cl, al
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov rbx, rsp
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov rdx, rsp
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov rdi, rsp
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov rsi, rsp
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov r13, rsp
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov r15, rsp
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov r12, rsp
test cl, cl
je 0x14016be70
mov qword [rbp - 0x58], rsi
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov qword [rbp - 0x78], rsp
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401fc5d0
sub rsp, rax
mov rsi, rsp
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401fc5d0
sub rsp, rax
mov r14, rsp
xorps xmm0, xmm0
movups xmmword [0x1406ee7f0], xmm0
movups xmmword [0x1406ee7e0], xmm0
movups xmmword [0x1406ee7d0], xmm0
mov qword [rbp - 0x68], rbx
movups xmmword [rbx], xmm0
mov qword [rbp - 0x60], rdx
mov qword [rdx], 0
sub rsp, 0x20
nop word [rax + rax]
mov rcx, rdi
call fcn.1400daca0
add rsp, 0x20
mov eax, dword [0x1406f18e0]
mov ecx, dword [0x1406f18e4]
cmp ecx, 0xa
jl 0x14016bf86
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x14016bf86
sub rsp, 0x20
mov rcx, rdi
call fcn.1400daca0
jmp 0x14016bf50
cmp dword [0x1406ee7d8], 0x12
je 0x14016c722
lea rdx, [0x1406ee7d0]
xorps xmm8, xmm8
movsd xmm7, qword [0x1402657a0]
movapd xmm6, xmmword [str.123456789:_____]
mov rbx, qword [sym.imp.USER32.dll_DispatchMessageA]
mov qword [rbp - 0x70], rsi
mov rsi, rdx
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r13
jmp 0x14016bffc
test ax, ax
js 0x14016c010
cmp dword [0x1406ee7d8], 0x12
mov eax, dword [0x1406f18e0]
mov ecx, dword [0x1406f18e4]
mov rdi, qword [rbp - 0x40]
mov r15, rbx
mov rbx, qword [sym.imp.USER32.dll_DispatchMessageA]
je 0x14016c722
cmp ecx, 0xa
jl 0x14016c050
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14016c077
jmp 0x14016c050
sub rsp, 0x20
mov ecx, reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
add rsp, 0x20
test al, 1
je 0x14016bfd5
cmp dword [0x1406f18e4], 0xa
jl 0x14016c6b0
mov eax, dword [0x1406f18e0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14016c6df
jmp 0x14016c6b0
sub rsp, 0x20
call fcn.14014a5a0
add rsp, 0x20
cmp dword [0x1406f18e4], 0xa
jl 0x14016c090
mov ecx, dword [0x1406f18e0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x14016c090
sub rsp, 0x20
call fcn.14014a5a0
add rsp, 0x20
jmp 0x14016c050
test al, al
je 0x14016c722
mov rdx, qword [0x1406ee7c0]
sub rsp, 0x30
mov dword [rsp + 0x20], 1
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_PeekMessageA]
add rsp, 0x30
test eax, eax
je 0x14016c0f0
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.USER32.dll_TranslateMessage]
add rsp, 0x20
cmp dword [0x1406f18e4], 0xa
jl 0x14016c110
mov eax, dword [0x1406f18e0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14016c13b
jmp 0x14016c110
mov edx, dword [0x1406f18e0]
mov ecx, dword [0x1406f18e4]
lea eax, [rdx - 1]
imul eax, edx
and eax, 1
jmp 0x14016c150
sub rsp, 0x20
mov rcx, rsi
call rbx
add rsp, 0x20
mov edx, dword [0x1406f18e0]
mov ecx, dword [0x1406f18e4]
lea eax, [rdx - 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x14016c150
test eax, eax
je 0x14016c150
sub rsp, 0x20
mov rcx, rsi
call rbx
add rsp, 0x20
jmp 0x14016c110
cmp ecx, 0xa
jl 0x14016c160
test eax, eax
jne 0x14016c188
nop dword [rax]
sub rsp, 0x20
call qword [sym.imp.USER32.dll_GetForegroundWindow]
add rsp, 0x20
cmp dword [0x1406f18e4], 0xa
jl 0x14016c1a0
mov ecx, dword [0x1406f18e0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x14016c1a0
sub rsp, 0x20
call qword [sym.imp.USER32.dll_GetForegroundWindow]
add rsp, 0x20
jmp 0x14016c160
cmp rax, qword [0x1406ee7c8]
jne 0x14016c350
mov rbx, r15
sub rsp, 0x20
mov rcx, rax
mov edx, 3
call qword [sym.imp.USER32.dll_GetWindow]
add rsp, 0x20
mov rcx, qword [0x1406ee7c0]
sub rsp, 0x40
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetWindowPos]
add rsp, 0x40
mov rdi, qword [rbp - 0x68]
movups xmmword [rdi], xmm8
mov rsi, qword [rbp - 0x60]
mov qword [rsi], 0
mov rcx, qword [0x1406ee7c8]
sub rsp, 0x20
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetClientRect]
add rsp, 0x20
mov rcx, qword [0x1406ee7c8]
sub rsp, 0x20
mov rdx, rsi
call qword [sym.imp.USER32.dll_ClientToScreen]
add rsp, 0x20
mov eax, dword [rsi]
mov dword [rdi], eax
mov eax, dword [rsi + 4]
mov dword [rdi + 4], eax
sub rsp, 0x20
call fcn.14000e260
add rsp, 0x20
mov r15, rax
mov rax, qword [0x1406ee7c8]
mov qword [r15 + 0xc0], rax
mov dword [r15 + 0x10], 0x3c888889
sub rsp, 0x20
mov r12, qword [rbp - 0x58]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetCursorPos]
add rsp, 0x20
mov eax, dword [r12]
sub eax, dword [rsi]
cvtsi2ss xmm0, eax
movss dword [r15 + 0xd8c], xmm0
mov eax, dword [r12 + 4]
sub eax, dword [rsi + 4]
xorps xmm0, xmm0
cvtsi2ss xmm0, eax
movss dword [r15 + 0xd90], xmm0
sub rsp, 0x20
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
add rsp, 0x20
test ax, ax
je 0x14016c30d
mov edx, dword [0x1406f18e0]
mov ecx, dword [0x1406f18e4]
lea eax, [rdx - 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x14016c2e9
test eax, eax
jne 0x14016c720
mov byte [r15 + 0xd94], 1
mov byte [r15 + 0x36a8], 1
movss xmm0, dword [r15 + 0xd90]
movss dword [r15 + 0x3658], xmm0
jmp 0x14016c32a
mov byte [r15 + 0xd94], 0
mov edx, dword [0x1406f18e0]
mov ecx, dword [0x1406f18e4]
lea eax, [rdx - 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
mov r15, rbx
mov r13, qword [rbp - 0x48]
mov r12, qword [rbp - 0x50]
lea rsi, [0x1406ee7d0]
mov rdi, qword [rbp - 0x40]
jl 0x14016c350
test eax, eax
jne 0x14016c710
nop dword [rax]
sub rsp, 0x20
call fcn.140173500
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
add rsp, 0x20
test al, 1
jne 0x14016c722
cmp dword [0x1406f18e4], 0xa
jl 0x14016c390
mov eax, dword [0x1406f18e0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14016c400
nop word [rax + rax]
sub rsp, 0x20
mov rcx, r13
call fcn.1400daca0
add rsp, 0x20
mov rax, qword [rdi]
mov rcx, qword [r13]
cmp dword [0x1406f12c8], 0xa
jl 0x14016c3cc
mov edx, dword [0x1406f12cc]
lea esi, [rdx - 1]
imul esi, edx
and esi, 1
lea rsi, [0x1406ee7d0]
jne 0x14016c700
sub rcx, rax
mov qword [r12], rcx
sub rsp, 0x20
mov rcx, r15
mov rdx, r12
call fcn.140108d40
add rsp, 0x20
cmp dword [0x1406f18e4], 0xa
jl 0x14016c460
mov eax, dword [0x1406f18e0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14016c460
sub rsp, 0x20
mov rcx, r13
call fcn.1400daca0
add rsp, 0x20
mov rax, qword [rdi]
mov rcx, qword [r13]
cmp dword [0x1406f12c8], 0xa
jl 0x14016c43c
mov edx, dword [0x1406f12cc]
lea esi, [rdx - 1]
imul esi, edx
and esi, 1
lea rsi, [0x1406ee7d0]
jne 0x14016c6f0
sub rcx, rax
mov qword [r12], rcx
sub rsp, 0x20
mov rcx, r15
mov rdx, r12
call fcn.140108d40
add rsp, 0x20
jmp 0x14016c390
movsd xmm0, qword [r15]
ucomisd xmm0, xmm7
jb 0x14016c63f
sub rsp, 0x20
mov rsi, qword [rbp - 0x78]
mov rcx, rsi
call fcn.1400daca0
add rsp, 0x20
mov rax, qword [rsi]
mov rsi, qword [rbp - 0x70]
mov qword [rdi], rax
cmp dword [0x1406f18e4], 0xa
jl 0x14016c4b0
mov eax, dword [0x1406f18e0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14016c578
nop dword [rax + rax]
movups xmm0, xmmword [0x140265142]
movups xmmword [r14], xmm0
movups xmm0, xmmword [0x14026514e]
movups xmmword [r14 + 0xc], xmm0
mov byte [r14], 0x56
movupd xmm0, xmmword [r14 + 1]
xorpd xmm0, xmm6
movupd xmmword [r14 + 1], xmm0
xor byte [r14 + 0x11], 0x41
xor byte [r14 + 0x12], 0x42
xor byte [r14 + 0x13], 0x43
xor byte [r14 + 0x14], 0x44
xor byte [r14 + 0x15], 0x45
xor byte [r14 + 0x16], 0x46
xor byte [r14 + 0x17], 0x47
xor byte [r14 + 0x18], 0x48
xor byte [r14 + 0x19], 0x49
xor byte [r14 + 0x1a], 0x4a
xor byte [r14 + 0x1b], 0x4b
sub rsp, 0x20
mov rcx, rsi
call fcn.1400abec0
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rsp, 0x20
sub rsp, 0x20
mov rcx, rsi
mov rdx, r14
mov r8, rax
call fcn.14008d7b0
add rsp, 0x20
sub rsp, 0x20
mov rcx, rsi
call fcn.1400b5bd0
add rsp, 0x20
mov dword [0x1406ee5a8], eax
cmp dword [0x1406f18e4], 0xa
jl 0x14016c630
mov ecx, dword [0x1406f18e0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x14016c630
movups xmm0, xmmword [0x140265142]
movups xmmword [r14], xmm0
movups xmm0, xmmword [0x14026514e]
movups xmmword [r14 + 0xc], xmm0
mov byte [r14], 0x56
movupd xmm0, xmmword [r14 + 1]
xorpd xmm0, xmm6
movupd xmmword [r14 + 1], xmm0
xor byte [r14 + 0x11], 0x41
xor byte [r14 + 0x12], 0x42
xor byte [r14 + 0x13], 0x43
xor byte [r14 + 0x14], 0x44
xor byte [r14 + 0x15], 0x45
xor byte [r14 + 0x16], 0x46
xor byte [r14 + 0x17], 0x47
xor byte [r14 + 0x18], 0x48
xor byte [r14 + 0x19], 0x49
xor byte [r14 + 0x1a], 0x4a
xor byte [r14 + 0x1b], 0x4b
sub rsp, 0x20
mov rcx, rsi
call fcn.1400abec0
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rsp, 0x20
sub rsp, 0x20
mov rcx, rsi
mov rdx, r14
mov r8, rax
call fcn.14008d7b0
add rsp, 0x20
sub rsp, 0x20
mov rcx, rsi
call fcn.1400b5bd0
add rsp, 0x20
mov dword [0x1406ee5a8], eax
jmp 0x14016c4b0
test eax, eax
lea rsi, [0x1406ee7d0]
je 0x14016c722
mov rbx, r15
sub rsp, 0x20
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
nop word cs:[rax + rax]
nop dword [rax + rax]
add rsp, 0x20
cmp dword [0x1406f18e4], 0xa
jl 0x14016bfd0
mov ecx, dword [0x1406f18e0]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x14016bfd0
sub rsp, 0x20
mov ecx, reloc.WS2_32.dll_recvfrom
mov r15, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call r15
mov ecx, reloc.WS2_32.dll_recvfrom
call r15
jmp 0x14016c660
sub rsp, 0x20
call fcn.1401228c0
add rsp, 0x20
cmp dword [0x1406f18e4], 0xa
jl 0x14016bfd5
mov eax, dword [0x1406f18e0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14016bfd5
sub rsp, 0x20
call fcn.1401228c0
add rsp, 0x20
jmp 0x14016c6b0
jmp 0x14016c6f0
jmp 0x14016c700
jmp 0x14016c710
jmp 0x14016c720
sub rsp, 0x20
call fcn.140122e70
int3