Function at 0x14005d130
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov ebx, 1
xorps xmm6, xmm6
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14005d15a
mov dword [0x14020fe78], 0
inc ebx
cmp ebx, 0x100
jl 0x14005d143
movss xmm0, dword [0x14020fe78]
ucomiss xmm0, xmm6
jp 0x14005d18b
jne 0x14005d18b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [0x14020fe78], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movss xmm0, dword [0x14020fe78]
xorps xmm1, xmm1
addss xmm0, dword [0x140116978]
mov eax, eax
cvtsi2ss xmm1, rax
comiss xmm1, xmm0
jbe 0x14005d39a
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000003
jge 0x14005d1c8
dec eax
or eax, 0xfffffffc
inc eax
mov dword [0x14020fdc4], eax
test eax, eax
je 0x14005d364
sub eax, 1
je 0x14005d30e
sub eax, 1
je 0x14005d2b8
cmp eax, 1
jne 0x14005d39a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov cl, reloc.WS2_32.dll_recv
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, gethostname
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x57
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov cl, 0x57
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x80
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov cl, reloc.WS2_32.dll_recv
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, gethostname
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x53
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
mov cl, 0x53
jmp 0x14005d381
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x44
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov cl, 0x44
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, gethostname
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x41
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
mov cl, 0x41
jmp 0x14005d381
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x57
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov cl, 0x57
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, gethostname
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x53
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call qword [sym.imp.KERNEL32.dll_Sleep]
mov cl, 0x53
jmp 0x14005d381
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, gethostname
call qword [sym.imp.KERNEL32.dll_Sleep]
mov cl, reloc.WLDAP32.dll_Ordinal_32
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x14020fe78], 0
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret