Function at 0x140005c00
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
lea r12, str.spawn
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [r12 + rdi], 0
jne 0x140005c30
xor r15d, r15d
movabs r14, 0x7fffffffffffffff
cmp byte [0x1401d80e5], r15b
je 0x140005d68
lea r8d, [r15 + 0x28]
mov dword [rbp - 0x31], 1
lea rdx, [rbp - 0x31]
mov qword [rbp - 0x29], 0x54
lea ecx, [r15 + 1]
mov dword [rbp - 0x21], r15d
mov qword [rbp - 0x19], r15
call qword [sym.imp.USER32.dll_SendInput]
lea r8d, [r15 + 0x28]
mov dword [rbp - 0x25], 2
lea rdx, [rbp - 0x31]
lea ecx, [r15 + 1]
call qword [sym.imp.USER32.dll_SendInput]
movsxd rbx, dword [reloc.WS2_32.dll_getpeername]
lea rcx, [rbp + 0x67]
call fcn.140005490
mov rcx, qword [rbp + 0x67]
mov qword [rbp + 0x67], rcx
test rbx, rbx
jle 0x140005cd3
imul rdx, rbx, 0xf4240
mov rax, r14
sub rax, rdx
cmp rcx, rax
jge 0x140005ccf
lea rax, [rcx + rdx]
mov qword [rbp + 0x67], rax
jmp 0x140005cd3
mov qword [rbp + 0x67], r14
lea rcx, [rbp + 0x67]
call fcn.14002aff0
mov r8d, Ordinal_45
mov dword [rbp - 0x59], 1
lea rdx, [rbp - 0x59]
mov qword [rbp - 0x51], reloc.WLDAP32.dll_Ordinal_46
mov dword [rbp - 0x49], r15d
mov qword [rbp - 0x41], r15
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, Ordinal_45
mov dword [rbp - 0x4d], 2
lea rdx, [rbp - 0x59]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
movsxd rbx, dword [reloc.WS2_32.dll_getpeername]
lea rcx, [rbp + 0x67]
call fcn.140005490
mov rcx, qword [rbp + 0x67]
mov qword [rbp + 0x67], rcx
test rbx, rbx
jle 0x140005d5f
imul rdx, rbx, 0xf4240
mov rax, r14
sub rax, rdx
cmp rcx, rax
jge 0x140005d5b
lea rax, [rcx + rdx]
mov qword [rbp + 0x67], rax
jmp 0x140005d5f
mov qword [rbp + 0x67], r14
lea rcx, [rbp + 0x67]
call fcn.14002aff0
lea rcx, [rbp + 0x67]
call fcn.140005490
mov rax, qword [rbp + 0x67]
movabs rbx, 0x7ffffffffd9da5ff
cmp rax, rbx
jge 0x140005d90
add rax, 0x2625a00
mov qword [rbp + 0x67], rax
jmp 0x140005d94
mov qword [rbp + 0x67], r14
lea rcx, [rbp + 0x67]
call fcn.14002aff0
mov r8d, Ordinal_45
mov dword [rbp - 9], 1
lea rdx, [rbp - 9]
mov qword [rbp - 1], reloc.WS2_32.dll_WSAGetLastError
mov dword [rbp + 7], 5
mov qword [rbp + 0xf], r15
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
lea rcx, [rbp + 0x67]
mov dword [rbp + 3], 2
call fcn.140005490
mov rax, qword [rbp + 0x67]
cmp rax, rbx
jge 0x140005df0
add rax, 0x2625a00
mov qword [rbp + 0x67], rax
jmp 0x140005df4
mov qword [rbp + 0x67], r14
lea rcx, [rbp + 0x67]
call fcn.14002aff0
mov r8d, Ordinal_45
lea rdx, [rbp - 9]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
movsxd rsi, edi
test edi, edi
jle 0x140005f0e
mov rdi, r15
nop
movsxd rbx, dword [reloc.WS2_32.dll_getpeername]
lea rcx, [rbp + 0x6f]
call fcn.140005490
mov rcx, qword [rbp + 0x6f]
mov qword [rbp + 0x67], rcx
test rbx, rbx
jle 0x140005e5d
imul rdx, rbx, 0xf4240
mov rax, r14
sub rax, rdx
cmp rcx, rax
jge 0x140005e59
lea rax, [rcx + rdx]
mov qword [rbp + 0x67], rax
jmp 0x140005e5d
mov qword [rbp + 0x67], r14
lea rcx, [rbp + 0x67]
call fcn.14002aff0
movzx ecx, byte [rdi + r12]
mov dword [rbp - 0x59], 1
mov word [rbp - 0x4f], r15w
mov dword [rbp - 0x49], r15d
mov qword [rbp - 0x41], r15
call qword [sym.imp.USER32.dll_VkKeyScanA]
mov r8d, Ordinal_45
mov dword [rbp - 0x4d], r15d
lea rdx, [rbp - 0x59]
mov word [rbp - 0x51], ax
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, Ordinal_45
mov dword [rbp - 0x4d], 2
lea rdx, [rbp - 0x59]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
movsxd rbx, dword [reloc.WS2_32.dll_getpeername]
lea rcx, [rbp + 0x77]
call fcn.140005490
mov rcx, qword [rbp + 0x77]
mov qword [rbp + 0x67], rcx
test rbx, rbx
jle 0x140005ef9
imul rdx, rbx, 0xf4240
mov rax, r14
sub rax, rdx
cmp rcx, rax
jge 0x140005ef5
lea rax, [rcx + rdx]
mov qword [rbp + 0x67], rax
jmp 0x140005ef9
mov qword [rbp + 0x67], r14
lea rcx, [rbp + 0x67]
call fcn.14002aff0
inc rdi
cmp rdi, rsi
jl 0x140005e20
mov r8d, Ordinal_45
mov dword [rbp - 0x59], 1
lea rdx, [rbp - 0x59]
mov qword [rbp - 0x51], reloc.WS2_32.dll_listen
mov dword [rbp - 0x49], r15d
mov qword [rbp - 0x41], r15
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, Ordinal_45
mov dword [rbp - 0x4d], 2
lea rdx, [rbp - 0x59]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
movsxd rbx, dword [reloc.WS2_32.dll_getpeername]
lea rcx, [rbp + 0x67]
call fcn.140005490
mov rcx, qword [rbp + 0x67]
mov qword [rbp + 0x67], rcx
test rbx, rbx
jle 0x140005f91
imul rdx, rbx, 0xf4240
mov rax, r14
sub rax, rdx
cmp rcx, rax
jge 0x140005f8d
lea rax, [rcx + rdx]
mov qword [rbp + 0x67], rax
jmp 0x140005f91
mov qword [rbp + 0x67], r14
lea rcx, [rbp + 0x67]
call fcn.14002aff0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret