Function at 0x140001ea0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400c9098]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
cmp byte [0x1400ca30d], bl
je 0x140001f90
mov rdx, qword [0x1400ca310]
test rdx, rdx
je 0x140001f90
cmp qword [0x1400ca300], rbx
je 0x140001f90
mov rcx, qword [0x1400ca2d0]
lea rax, [rbp + 7]
add rdx, 0x760
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
mov dword [rbp - 9], ebx
lea r8, [rbp - 9]
mov qword [rbp + 7], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 9]
lea rax, [rbp + 0x27]
subss xmm0, dword [0x1400ba504]
mov rdx, qword [0x1400ca310]
lea r9d, [rbx + 4]
mov rcx, qword [0x1400ca2d0]
lea r8, [rbp - 1]
add rdx, 0x760
mov qword [rbp + 0x27], rbx
mov qword [rsp + 0x20], rax
movss dword [rbp - 1], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400ca300]
lea rax, [rbp + 7]
mov rcx, qword [0x1400ca2d0]
lea r9d, [rbx + 4]
add rdx, 0x9e0
mov dword [rbp - 9], 1
lea r8, [rbp - 9]
mov qword [rbp + 7], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400ca30c], bl
mov rdx, qword [0x1400ca2e8]
je 0x140001fb9
test rdx, rdx
je 0x140001fb9
mov dword [rbp - 1], 0xbf800000
lea rax, [rbp + 0x3f]
mov qword [rbp + 0x3f], rbx
lea r8, [rbp - 1]
jmp 0x140001fcc
mov dword [rbp + 0x27], 0x3f800000
lea rax, [rbp + 0x47]
mov qword [rbp + 0x47], rbx
lea r8, [rbp + 0x27]
mov rcx, qword [0x1400ca2d0]
mov r9d, 4
add rdx, 0xc0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400ca30b], bl
je 0x140002056
cmp qword [0x1400ca318], rbx
je 0x140002056
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rdx, qword [0x1400ca2d8]
mov r9d, 4
mov rcx, qword [0x1400ca2d0]
add rdx, 0xc0
test ax, ax
je 0x140002038
mov dword [rbp - 9], ebx
lea rax, [rbp + 0x2f]
mov qword [rbp + 0x2f], rbx
lea r8, [rbp - 9]
jmp 0x14000204b
mov dword [rbp + 7], 0x3f800000
lea rax, [rbp + 0x37]
mov qword [rbp + 0x37], rbx
lea r8, [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400ca30a], bl
je 0x140002101
cmp qword [0x1400ca318], rbx
je 0x140002101
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400ca3ec], eax
jle 0x1400020b9
lea rcx, [0x1400ca3ec]
call fcn.1400a1124
cmp dword [0x1400ca3ec], 0xffffffff
jne 0x1400020b9
lea rcx, [0x1400ca3ec]
mov qword [0x1400ca3e0], rbx
mov dword [0x1400ca3e8], ebx
call fcn.1400a10b8
movsd xmm0, qword [0x1400ca3e0]
lea r8, [rbp - 0x29]
movss xmm1, dword [0x1400ca3e4]
mov eax, dword [0x1400ca3e8]
addss xmm1, dword [0x1400ba54c]
shufps xmm0, xmm0, 0xe1
mov dword [rbp - 0x21], eax
lea rax, [rbp + 0x17]
mov qword [rbp + 0x17], rbx
movss xmm0, xmm1
shufps xmm0, xmm0, 0xe1
movsd qword [0x1400ca3e0], xmm0
movsd qword [rbp - 0x29], xmm0
jmp 0x14000211a
mov dword [rbp - 0x39], ebx
lea rax, [rbp + 0xf]
mov dword [rbp - 0x35], 0xc2b40000
lea r8, [rbp - 0x39]
mov dword [rbp - 0x31], ebx
mov qword [rbp + 0xf], rbx
mov rdx, qword [0x1400ca318]
mov r9d, listen
mov rcx, qword [0x1400ca2d0]
add rdx, 0x170
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400ca2e0], bl
je 0x140002166
cmp qword [0x1400ca318], rbx
je 0x140002166
mov dword [rbp + 7], 0x3f800000
lea rax, [rbp + 0x37]
mov qword [rbp + 0x37], rbx
lea r8, [rbp + 7]
jmp 0x140002175
mov dword [rbp + 0x27], ebx
lea rax, [rbp + 0x2f]
mov qword [rbp + 0x2f], rbx
lea r8, [rbp + 0x27]
mov rdx, qword [0x1400ca2d8]
mov r9d, 4
mov rcx, qword [0x1400ca2d0]
add rdx, 0x2178
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400ca2f0], bl
mov rdx, qword [0x1400ca2d8]
je 0x1400021c1
test rdx, rdx
je 0x1400021c1
mov byte [rbp - 0x19], 1
lea rax, [rbp + 0xf]
mov qword [rbp + 0xf], rbx
lea r8, [rbp - 0x19]
jmp 0x1400021d0
mov byte [rbp - 0x11], bl
lea rax, [rbp + 0x17]
mov qword [rbp + 0x17], rbx
lea r8, [rbp - 0x11]
mov rcx, qword [0x1400ca2d0]
mov r9d, 1
add rdx, 0x24fd
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400ca308], bl
mov rdx, qword [0x1400ca2f8]
je 0x140002229
test rdx, rdx
je 0x140002229
movss xmm1, dword [0x1400ba4ec]
lea rax, [rbp + 0x37]
movaps xmm0, xmm1
movss dword [rbp - 0x21], xmm1
unpcklps xmm0, xmm1
lea r8, [rbp - 0x29]
movsd qword [rbp - 0x29], xmm0
mov qword [rbp + 0x37], rbx
jmp 0x14000224d
movss xmm1, dword [0x1400ba4ec]
lea rax, [rbp + 0x2f]
movaps xmm0, xmm1
movss dword [rbp - 0x31], xmm1
unpcklps xmm0, xmm1
lea r8, [rbp - 0x39]
movsd qword [rbp - 0x39], xmm0
mov qword [rbp + 0x2f], rbx
mov rcx, qword [0x1400ca2d0]
mov r9d, listen
add rdx, 0x17c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400ca309], bl
mov rdx, qword [0x1400ca318]
je 0x14000228a
test rdx, rdx
je 0x14000228a
movss xmm1, dword [0x1400c90d4]
jmp 0x140002292
movss xmm1, dword [0x1400ba4ec]
mov rcx, qword [0x1400ca2d0]
lea rax, [rbp + 0xf]
movaps xmm0, xmm1
movss dword [rbp + 0x1f], xmm1
unpcklps xmm0, xmm1
lea r8, [rbp + 0x17]
mov r9d, listen
movsd qword [rbp + 0x17], xmm0
add rdx, 0x17c
mov qword [rsp + 0x20], rax
mov qword [rbp + 0xf], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov al, 1
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400a0dd0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret