Function at 0x14009c2e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x248
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
movaps xmmword [rax - 0xc8], xmm14
movaps xmmword [rax - 0xd8], xmm15
movabs r14, 0x7fffffffffffffff
movabs r15, 0x7ffffffffff0bdbf
lea r12, [0x14038b680]
xor edi, edi
nop word [rax + rax]
mov rbx, qword [0x14038c970]
test rbx, rbx
je 0x14009c9e3
cmp qword [0x14038c990], 0
je 0x14009c9e3
cmp byte [0x14038c4d4], 0
jne 0x14009c395
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14009c360
mov ecx, dword [0x14038bbb4]
add rcx, rbx
je 0x14009c41e
mov eax, dword [0x14038b270]
mov dword [rsp + 0xc8], eax
mov dword [rsp + 0x90], edi
mov eax, dword [0x14038b268]
mov dword [rsp + 0x94], eax
mov eax, dword [0x14038b26c]
mov dword [rsp + 0x98], eax
mov qword [rsp + 0xa0], rcx
lea rax, [rsp + 0x280]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 8
mov rdx, qword [0x14038bb00]
test rdx, rdx
je 0x14009c425
lea rcx, [rsp + 0x90]
call rdx
test rax, rax
je 0x14009c41e
mov rdx, qword [0x14038bb00]
mov rsi, qword [rsp + 0x280]
jmp 0x14009c430
mov rdx, qword [0x14038bb00]
mov rsi, rdi
mov qword [rsp + 0x280], rdi
mov ecx, dword [0x14038bbb0]
add rcx, rbx
je 0x14009c4a1
mov eax, dword [0x14038b270]
mov dword [rsp + 0x108], eax
mov dword [rsp + 0xd0], edi
mov eax, dword [0x14038b268]
mov dword [rsp + 0xd4], eax
mov eax, dword [0x14038b26c]
mov dword [rsp + 0xd8], eax
mov qword [rsp + 0xe0], rcx
lea rax, [rsp + 0x298]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], 8
test rdx, rdx
je 0x14009c4a1
lea rcx, [rsp + 0xd0]
call rdx
test rax, rax
jne 0x14009c4a9
mov qword [rsp + 0x298], rdi
test rbx, rbx
jne 0x14009c4bf
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14009c360
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x14038c400]
je 0x14009c4e8
cmp rax, qword [0x14038c3f8]
je 0x14009c4e8
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14009c360
lea rcx, [rbx + 0x90]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
test rcx, rcx
je 0x14009c578
mov eax, dword [0x14038b270]
mov dword [rsp + 0x108], eax
mov dword [rsp + 0xd0], edi
mov eax, dword [0x14038b268]
mov dword [rsp + 0xd4], eax
mov eax, dword [0x14038b26c]
mov dword [rsp + 0xd8], eax
mov qword [rsp + 0xe0], rcx
lea rax, [rsp + 0x20]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], sendto
mov rdx, qword [0x14038bb00]
test rdx, rdx
je 0x14009c57f
lea rcx, [rsp + 0xd0]
call rdx
test rax, rax
je 0x14009c578
mov rdx, qword [0x14038bb00]
jmp 0x14009c58a
mov rdx, qword [0x14038bb00]
xor eax, eax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
lea rcx, [rsi + 0x90]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
test rcx, rcx
je 0x14009c611
mov eax, dword [0x14038b270]
mov dword [rsp + 0xc8], eax
mov dword [rsp + 0x90], edi
mov eax, dword [0x14038b268]
mov dword [rsp + 0x94], eax
mov eax, dword [0x14038b26c]
mov dword [rsp + 0x98], eax
mov qword [rsp + 0xa0], rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], sendto
test rdx, rdx
je 0x14009c611
lea rcx, [rsp + 0x90]
call rdx
mov rdx, qword [0x14038bb00]
test rax, rax
jne 0x14009c61c
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
cmp byte [0x14038c4dc], 0
jne 0x14009c6ba
mov edx, dword [0x14038bb80]
add rdx, 4
add rdx, rbx
call fcn.14000bba0
bt eax, 0x1e
jae 0x14009c675
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x40], xmm0
movss xmm1, dword [rsp + 0x34]
movss dword [rsp + 0x44], xmm1
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x48], xmm0
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rdx, rsi
call fcn.14009d7e0
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x50], xmm0
movss xmm1, dword [rsp + 0x24]
movss dword [rsp + 0x54], xmm1
movss xmm0, dword [rsp + 0x28]
movss dword [rsp + 0x58], xmm0
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdx, rbx
call fcn.14009d7e0
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14009c360
mov rax, qword [0x14038c980]
test rax, rax
jne 0x14009c6ce
mov rcx, rdi
jmp 0x14009c75c
lea rcx, [rax + 0x3c0]
test rcx, rcx
je 0x14009c751
mov eax, dword [0x14038b270]
mov dword [rsp + 0x148], eax
mov dword [rsp + 0x110], edi
mov eax, dword [0x14038b268]
mov dword [rsp + 0x114], eax
mov eax, dword [0x14038b26c]
mov dword [rsp + 0x118], eax
mov qword [rsp + 0x120], rcx
lea rax, [rsp + 0x288]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], 8
test rdx, rdx
je 0x14009c751
lea rcx, [rsp + 0x110]
call rdx
mov rdx, qword [0x14038bb00]
test rax, rax
je 0x14009c751
mov rcx, qword [rsp + 0x288]
jmp 0x14009c75c
mov rcx, rdi
mov qword [rsp + 0x288], rcx
test rcx, rcx
je 0x14009c7ba
mov eax, dword [0x14038b270]
mov dword [rsp + 0x188], eax
mov dword [rsp + 0x150], edi
mov eax, dword [0x14038b268]
mov dword [rsp + 0x154], eax
mov eax, dword [0x14038b26c]
mov dword [rsp + 0x158], eax
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x170], 0x3f0
test rdx, rdx
je 0x14009c7ba
lea rcx, [rsp + 0x150]
call rdx
movss xmm12, dword [0x14038ba58]
movss xmm10, dword [0x14038ba54]
movss xmm11, dword [0x14038ba50]
xorps xmm0, xmm0
ucomiss xmm11, xmm0
jne 0x14009c805
ucomiss xmm10, xmm0
jne 0x14009c805
ucomiss xmm12, xmm0
jne 0x14009c805
movss xmm11, dword [0x14038b6c0]
movss xmm10, dword [0x14038b6c4]
movss xmm12, dword [0x14038b6c8]
movss xmm8, dword [rsp + 0x20]
movaps xmm13, xmm8
movss xmm9, dword [rsp + 0x24]
movaps xmm14, xmm9
movss xmm7, dword [rsp + 0x28]
movaps xmm15, xmm7
movss xmm6, dword [0x14038c4e0]
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009c843
addss xmm6, xmm6
jmp 0x14009c85b
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009c85b
mulss xmm6, dword [0x140334e40]
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009c894
movaps xmm8, xmm11
mulss xmm8, xmm6
addss xmm8, xmm13
movaps xmm9, xmm10
mulss xmm9, xmm6
addss xmm9, xmm14
movaps xmm7, xmm12
mulss xmm7, xmm6
addss xmm7, xmm15
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009c8c8
movaps xmm0, xmm11
mulss xmm0, xmm6
subss xmm8, xmm0
movaps xmm1, xmm10
mulss xmm1, xmm6
subss xmm9, xmm1
mulss xmm12, xmm6
subss xmm7, xmm12
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009c8f2
movaps xmm0, xmm10
mulss xmm0, xmm6
subss xmm8, xmm0
movaps xmm1, xmm11
mulss xmm1, xmm6
addss xmm9, xmm1
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009c916
mulss xmm10, xmm6
addss xmm8, xmm10
mulss xmm11, xmm6
subss xmm9, xmm11
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009c92a
addss xmm7, xmm6
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14009c93e
subss xmm7, xmm6
mov edx, dword [0x14038bb80]
add rdx, 4
add rdx, rbx
call fcn.14000bba0
bt eax, 0x1e
jae 0x14009c97a
movss dword [rsp + 0x60], xmm8
movss dword [rsp + 0x64], xmm9
movss dword [rsp + 0x68], xmm7
mov r9b, 1
lea r8, [rsp + 0x60]
mov rdx, rsi
call fcn.14009d7e0
movss dword [rsp + 0x70], xmm8
movss dword [rsp + 0x74], xmm9
movss dword [rsp + 0x78], xmm7
mov r9b, 1
lea r8, [rsp + 0x70]
mov rdx, rbx
call fcn.14009d7e0
lea rcx, [rsp + 0x80]
call fcn.1400037b0
mov rax, qword [rsp + 0x80]
cmp rax, r15
jge 0x14009c9c8
add rax, 0xf4240
mov qword [rsp + 0x290], rax
jmp 0x14009c9d0
mov qword [rsp + 0x290], r14
lea rcx, [rsp + 0x290]
call fcn.1400055a0
nop
jmp 0x14009c360
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14009c360