Function at 0x140101a80
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push r14
push r15
sub rsp, 0x88
mov rax, qword [rdx + 8]
mov rsi, rcx
xor ecx, ecx
inc rax
mov dword [rsp + 0x38], ecx
mov r14d, ecx
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + 0x10]
lea rdx, [rsp + 0x30]
dec eax
lea rcx, [rsp + 0x40]
mov r15d, r9d
mov dword [rsp + 0x3c], eax
mov ebx, r8d
call fcn.1400fff00
test eax, eax
je 0x1401022b2
mov eax, 0xa2
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0x80], r13
mov qword [rsp + 0xc8], r12
lea ecx, [rax + 1]
lea edx, [rax - 2]
lea r8d, [rax - 1]
lea r9d, [rax + 2]
lea r10d, [rax + 3]
nop word [rax + rax]
movzx ebp, word [rsp + 0x42]
movzx r13d, word [rsp + 0x44]
add bp, word [rsi + 0x38]
add r13w, word [rsi + 0x3c]
cmp dword [rsp + 0x50], 0
mov word [rsp + 0x42], bp
mov word [rsp + 0x44], r13w
je 0x140101b65
lea rcx, [rsi + 0x30]
movsx r8d, r13w
movsx edx, bp
call fcn.140106cf0
test eax, eax
je 0x140102264
mov eax, 0xa2
lea ecx, [rax + 1]
lea edx, [rax - 2]
lea r8d, [rax - 1]
lea r9d, [rax + 2]
lea r10d, [rax + 3]
movzx r12d, byte [rsp + 0x40]
movzx edi, word [rsp + 0x46]
cmp r12b, 9
jne 0x140101d09
cmp di, 0x11
je 0x140101c5f
cmp di, ax
je 0x140101c5f
cmp di, cx
je 0x140101c5f
cmp di, dx
je 0x140101c5f
cmp di, r8w
je 0x140101c5f
cmp di, 0x10
je 0x140101c5f
cmp di, r9w
je 0x140101c5f
cmp di, 0x12
je 0x140101c5f
cmp di, r10w
je 0x140101c5f
cmp di, 0x5b
je 0x140101c5f
cmp di, 0x5c
je 0x140101c5f
cmp di, 0x2e
jne 0x140101c47
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140101c20
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140101c20
mov dword [rsi + 0x37c], 1
call fcn.1400fd600
movzx r12d, r12b
lea eax, [r12 - 1]
cmp eax, 0xe
ja case.default.0x140101c45
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1022c0]
add rcx, rdx
jmp rcx
cmp qword [rsi + 0x398], 0
jbe 0x140101c20
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x37c], eax
jmp 0x140101c20
mov r8, qword [rsi + 0x398]
mov rcx, qword [rsi + 0x390]
mov ebx, 0xa
lea rdx, [r8 + 1]
cmp rdx, rcx
jbe 0x140101cb3
lea rax, [rcx + 0xa]
cmp rdx, rax
jbe 0x140101c8d
mov rbx, r8
sub rbx, rcx
inc rbx
lea rdx, [rcx + rbx]
mov rcx, qword [rsi + 0x388]
add rdx, rdx
call fcn.1401e4a98
test rax, rax
je 0x140101cf1
add qword [rsi + 0x390], rbx
mov qword [rsi + 0x388], rax
mov rdx, qword [rsi + 0x398]
xor eax, eax
test rdx, rdx
je 0x140101cdf
mov rcx, qword [rsi + 0x388]
cmp word [rcx], di
je 0x140101cdb
inc rax
add rcx, 2
cmp rax, rdx
jb 0x140101cc8
jmp 0x140101cdf
test eax, eax
jns 0x140101cf1
mov rax, qword [rsi + 0x388]
mov word [rax + rdx*2], di
inc qword [rsi + 0x398]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0xc0]
mov dword [rsi + 0x37c], eax
jmp 0x140101c20
cmp r12b, 0xa
jne 0x140101dcd
cmp di, 0x11
je 0x140101d56
cmp di, ax
je 0x140101d56
cmp di, cx
je 0x140101d56
cmp di, dx
je 0x140101d56
cmp di, r8w
je 0x140101d56
cmp di, 0x10
je 0x140101d56
cmp di, r9w
je 0x140101d56
cmp di, 0x12
je 0x140101d56
cmp di, r10w
je 0x140101d56
cmp di, 0x5b
je 0x140101d56
cmp di, 0x5c
jne 0x140101c20
mov r8, qword [rsi + 0x398]
xor ecx, ecx
mov rdx, rcx
test r8, r8
je 0x140101d81
mov rax, qword [rsi + 0x388]
nop
cmp word [rax], di
je 0x140101d81
inc rdx
add rax, 2
cmp rdx, r8
jb 0x140101d70
cmp rdx, r8
jae 0x140101db4
lea rax, [r8 - 1]
cmp rdx, rax
jae 0x140101dad
mov rax, qword [rsi + 0x388]
sub r8, rdx
lea rcx, [rax + rdx*2]
lea r8, [r8 + r8 - 2]
lea rdx, [rcx + 2]
call fcn.1401e3ed0
xor ecx, ecx
dec qword [rsi + 0x398]
cmp qword [rsi + 0x398], 0
jne 0x140101c20
mov dword [rsi + 0x37c], ecx
jmp 0x140101c20
cmp r12b, 0x10
jne 0x140101c20
movzx eax, word [rsp + 0x46]
test ax, ax
jne 0x140101df1
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
jmp 0x140102264
cmp ax, 1
jne 0x140102264
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
jmp 0x140102264
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8001
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1400ffd80
jmp case.default.0x140101c45
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8008
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1400ffd80
jmp case.default.0x140101c45
mov ecx, dword [0x1402e2b5c]
cmp ecx, 1
jbe 0x140101e8f
cmp r14d, 3
jne 0x140101e8f
call qword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8010
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1400ffd80
jmp case.default.0x140101c45
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8002
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1400ffd80
jmp case.default.0x140101c45
mov ecx, dword [0x1402e2b5c]
cmp ecx, 1
jbe 0x140101f16
cmp r14d, 1
jne 0x140101f16
call qword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8004
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1400ffd80
jmp case.default.0x140101c45
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8020
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1400ffd80
jmp case.default.0x140101c45
mov ecx, dword [0x1402e2b5c]
cmp ecx, 1
jbe 0x140101f9d
cmp r14d, 0xe
jne 0x140101f9d
call qword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8040
imul eax, eax, 0xffff
cdq
idiv r15d
mov r8d, eax
movsx eax, bp
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.1400ffd80
jmp case.default.0x140101c45
movsx eax, r13w
xor r13d, r13d
xor r9d, r9d
mov ecx, 0x8002
mov qword [rsp + 0x20], r13
imul eax, eax, 0xffff
cdq
idiv r15d
mov edi, eax
movsx eax, bp
mov r8d, edi
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
mov ebx, eax
call fcn.1400ffd80
mov ecx, dword [0x1402e2b5c]
cmp ecx, 1
jbe 0x14010201e
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8004
mov qword [rsp + 0x20], r13
call fcn.1400ffd80
jmp case.default.0x140101c45
movsx eax, r13w
xor r13d, r13d
xor r9d, r9d
mov ecx, 0x8008
mov qword [rsp + 0x20], r13
imul eax, eax, 0xffff
cdq
idiv r15d
mov edi, eax
movsx eax, bp
mov r8d, edi
imul eax, eax, 0xffff
cdq
idiv ebx
mov edx, eax
mov ebx, eax
call fcn.1400ffd80
mov ecx, dword [0x1402e2b5c]
cmp ecx, 1
jbe 0x140102083
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8010
mov qword [rsp + 0x20], r13
call fcn.1400ffd80
jmp case.default.0x140101c45
movsx eax, r13w
xor r9d, r9d
mov ecx, 0x8002
imul eax, eax, 0xffff
cdq
idiv r15d
mov ebx, eax
movsx eax, bp
xor ebp, ebp
mov r8d, ebx
mov qword [rsp + 0x20], rbp
imul eax, eax, 0xffff
cdq
idiv dword [rsp + 0xc0]
mov edx, eax
mov edi, eax
call fcn.1400ffd80
xor r9d, r9d
mov r8d, ebx
mov edx, edi
mov ecx, 0x8004
mov qword [rsp + 0x20], rbp
call fcn.1400ffd80
xor r9d, r9d
mov r8d, ebx
mov edx, edi
mov ecx, 0x8002
mov qword [rsp + 0x20], rbp
call fcn.1400ffd80
xor r9d, r9d
mov r8d, ebx
mov edx, edi
mov ecx, 0x8004
mov qword [rsp + 0x20], rbp
call fcn.1400ffd80
jmp case.default.0x140101c45
xor eax, eax
movsx r9d, bp
xor r8d, r8d
xor edx, edx
mov ecx, 0x800
mov qword [rsp + 0x20], rax
call fcn.1400ffd80
jmp case.default.0x140101c45
movzx ecx, di
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.1400ffe00
jmp case.default.0x140101c45
xor r9d, r9d
movzx ecx, di
xor edx, edx
lea r8d, [r9 + 2]
call fcn.1400ffe00
jmp case.default.0x140101c45
mov rcx, qword [rsp + 0x48]
xor r13d, r13d
mov rbx, r13
test rcx, rcx
je 0x140102187
call fcn.140001930
mov rbx, rax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, r13
not rcx
sub rcx, 1
mov rbp, rcx
je 0x14010224d
nop word [rax + rax]
movzx eax, word [rbx + rdi*2]
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x64], 4
mov dword [rsp + 0x68], r13d
mov word [rsp + 0x60], r13w
mov word [rsp + 0x62], ax
test eax, eax
jne 0x1401021f6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rsp + 0x62], ax
test ax, ax
je 0x1401021f6
or dword [rsp + 0x64], 8
mov r8d, 0x28
lea rdx, [rsp + 0x58]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
cmp eax, 1
je 0x140102241
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140102241
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Injection_failed._err_d
lea rdx, str..TShareApe.cpp
mov r8d, 0x583
mov ecx, 3
mov dword [rsp + 0x20], eax
call fcn.1400045a0
inc rdi
cmp rdi, rbp
jb 0x1401021b0
test rbx, rbx
je case.default.0x140101c45
mov rcx, rbx
call fcn.1401e36c8
mov ebx, dword [rsp + 0xc0]
mov r14d, r12d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400fff00
test eax, eax
mov eax, 0xa2
lea ecx, [rax + 1]
lea edx, [rax - 2]
lea r8d, [rax - 1]
lea r9d, [rax + 2]
lea r10d, [rax + 3]
jne 0x140101b10
mov r13, qword [rsp + 0x80]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
add rsp, 0x88
pop r15
pop r14
pop rsi
pop rbx
ret