Function at 0x1400652c0
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140129080]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov ecx, dword [0x14020fdb4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edi, edi
test al, 1
je 0x140065357
cmp byte [0x14020fe5c], dil
je 0x14006530b
cmp byte [0x1401da0a6], dil
sete al
mov byte [0x1401da0a6], al
jmp 0x140065312
movzx eax, byte [0x1401da0a6]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
test al, al
je 0x14006532e
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
jmp 0x140065357
mov ecx, 4
mov byte [0x1401db19c], dil
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x57
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x1401d9ffc], edi
cmp byte [0x1401da0a6], dil
je 0x14006557b
cmp byte [0x14020fe5c], dil
je 0x14006557b
cmp byte [0x1401db19c], dil
mov qword [rsp + 0x90], rbx
mov ebx, edi
sete al
movaps xmmword [rsp + 0x70], xmm6
mov byte [0x1401db19c], al
test al, al
mov eax, dword [reloc.WS2_32.dll_accept]
je 0x140065463
test eax, eax
jle 0x140065405
movss xmm6, dword [0x140116b10]
nop word [rax + rax]
movss xmm0, dword [0x1401d90d0]
lea rdx, [rbp - 0x48]
xorps xmm0, xmm6
mov dword [rbp - 0x48], edi
cvttss2si eax, xmm0
mov r8d, Ordinal_41
mov qword [rbp - 0x3c], rdi
mov qword [rbp - 0x34], 1
lea ecx, [r8 - 0x27]
mov dword [rbp - 0x40], eax
call qword [sym.imp.USER32.dll_SendInput]
movsxd rax, dword [reloc.WS2_32.dll_ioctlsocket]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
call fcn.140071060
mov eax, dword [reloc.WS2_32.dll_accept]
inc ebx
cmp ebx, eax
jl 0x1400653b0
mov ebx, edi
test eax, eax
jle 0x14006556e
nop
cvttss2si eax, dword [0x1401d8e60]
mov r8d, Ordinal_41
mov dword [rbp - 0x48], edi
lea rdx, [rbp - 0x48]
mov dword [rbp - 0x38], edi
mov qword [rbp - 0x34], 1
mov dword [rbp - 0x40], edi
lea ecx, [r8 - 0x27]
mov dword [rbp - 0x3c], eax
call qword [sym.imp.USER32.dll_SendInput]
movsxd rax, dword [reloc.WS2_32.dll_ioctlsocket]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
call fcn.140071060
inc ebx
cmp ebx, dword [reloc.WS2_32.dll_accept]
jl 0x140065410
jmp 0x14006556e
inc dword [0x1401d9ffc]
test eax, eax
jle 0x1400654be
nop dword [rax]
cvttss2si eax, dword [0x1401d90d0]
mov r8d, Ordinal_41
mov dword [rbp - 0x48], edi
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x3c], rdi
mov qword [rbp - 0x34], 1
lea ecx, [r8 - 0x27]
mov dword [rbp - 0x40], eax
call qword [sym.imp.USER32.dll_SendInput]
movsxd rax, dword [reloc.WS2_32.dll_ioctlsocket]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
call fcn.140071060
mov eax, dword [reloc.WS2_32.dll_accept]
inc ebx
cmp ebx, eax
jl 0x140065470
mov ebx, edi
test eax, eax
jle 0x140065525
movss xmm6, dword [0x140116b10]
nop dword [rax]
movss xmm0, dword [0x1401d8e60]
lea rdx, [rbp - 0x48]
xorps xmm0, xmm6
mov dword [rbp - 0x48], edi
cvttss2si eax, xmm0
mov r8d, Ordinal_41
mov dword [rbp - 0x38], edi
mov qword [rbp - 0x34], 1
mov dword [rbp - 0x40], edi
lea ecx, [r8 - 0x27]
mov dword [rbp - 0x3c], eax
call qword [sym.imp.USER32.dll_SendInput]
movsxd rax, dword [reloc.WS2_32.dll_ioctlsocket]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
call fcn.140071060
inc ebx
cmp ebx, dword [reloc.WS2_32.dll_accept]
jl 0x1400654d0
mov eax, dword [reloc.WS2_32.dll_accept]
cmp dword [0x1401d9ffc], eax
jl 0x14006556e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x57
call qword [sym.imp.USER32.dll_keybd_event]
movsxd rax, dword [0x1401d8db0]
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
call fcn.140071060
xor r9d, r9d
xor edx, edx
mov cl, 0x57
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x1401d9ffc], edi
mov rbx, qword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x70]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1400d4090
mov rdi, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret