Function at 0x140074b60
Capabilities:
Get system information on windows
Log keystrokes via polling
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movsxd rbp, ecx
mov edi, 0x1008
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140074c1a
mov r14, 0xffffffffffffffff
nop dword [rax + rax]
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
mov rcx, rbx
mov eax, 2
mul rdi
cmovo rax, r14
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rbx, rax
test rax, rax
je 0x140074be0
add rdi, rdi
cmp esi, 0xc0000004
je 0x140074ba0
test rbx, rbx
je 0x140074c1a
mov edx, dword [rax]
xor ecx, ecx
test rdx, rdx
je 0x140074c0d
add rax, 0xc
cmp dword [rax - 4], 4
jne 0x140074c01
cmp byte [rax], 7
je 0x140074d74
inc rcx
add rax, 0x18
cmp rcx, rdx
jb 0x140074bf2
mov edx, 8
mov rcx, rbx
call fcn.1400d909c
xor edi, edi
add rdi, qword [0x14023d820]
mov edx, reloc.WS2_32.dll_sendto
lea ecx, [rdx - 0x13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140074c68
mov r8d, reloc.WS2_32.dll_sendto
mov qword [rax], rdi
mov rdx, rax
mov dword [rax + 8], reloc.WS2_32.dll_recv
mov ecx, 0x83064000
call fcn.140075a80
test al, al
je 0x140074c68
cmp dword [rbx], 0
jne 0x140074c68
movups xmm0, xmmword [rbx + 4]
movups xmmword [rsp + 0x20], xmm0
mov r14, qword [rsp + 0x20]
mov r15, rbp
mov rbp, qword [0x14023d808]
xor edi, edi
mov rsi, r14
sub rsi, qword [0x14023d820]
add rbp, rsi
lea edx, [rdi + 0xc]
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140074cc1
lea r8d, [rdi + 0xc]
mov qword [rax], rbp
mov rdx, rax
mov dword [rax + 8], 8
mov ecx, 0x83064000
call fcn.140075a80
test al, al
je 0x140074cc1
cmp dword [rbx], edi
jne 0x140074cc1
mov rdi, qword [rbx + 4]
mov rbx, qword [0x14023d810]
mov edx, 0x10003
mov ecx, 1
add rbx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test rax, rax
je 0x140074cfd
mov r8d, 0x10003
mov qword [rax], rbx
mov rdx, rax
mov dword [rax + 8], 0xffff
mov ecx, 0x83064000
call fcn.140075a80
mov rbp, qword [0x14023d820]
mov edx, reloc.WS2_32.dll_sendto
add rbp, rsi
lea ecx, [rdx - 0x13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140074d47
mov r8d, reloc.WS2_32.dll_sendto
mov qword [rax], rbp
mov rdx, rax
mov dword [rax + 8], reloc.WS2_32.dll_recv
mov ecx, 0x83064000
call fcn.140075a80
test al, al
je 0x140074d47
cmp dword [rbx], 0
jne 0x140074d47
mov r14, qword [rbx + 4]
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140074d5c
call fcn.140075940
cmp rdi, r15
je 0x140074d8f
cmp rdi, 4
je 0x140074d70
test rdi, rdi
jne 0x140074c70
xor eax, eax
jmp 0x140074d92
lea rax, [rcx + rcx*2]
mov edx, 8
mov rdi, qword [rbx + rax*8 + 0x10]
mov rcx, rbx
call fcn.1400d909c
jmp 0x140074c1c
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret