Function at 0x1400309c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14003c510
mov r11, rsp
push rbp
push rdi
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x140112718]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [reloc.WS2_32.dll_accept], 0
mov rdi, rcx
je 0x14003c838
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
movabs rsi, 0x7fffffffffffffff
mov qword [r11 + 0x18], r12
movabs r12, 0x7ffffffffa0a1efe
mov qword [r11 + 0x20], r14
movabs r14, 0x7ffffffffff0bdbe
mov qword [r11 - 0x18], r15
movabs r15, 0x7fffffffff67697e
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
imul rax, rcx, 0x64
cmp eax, 0x5f
ja 0x14003c598
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
imul rax, rcx, 0x64
cmp eax, 0x60
jb 0x14003c587
shr rax, 0x20
cmp eax, dword [0x140114a1c]
jae 0x14003c7b2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [str.wtd_a]
mov rbx, rax
movzx edx, word [0x1400fe214]
mov dword [rbp - 0x38], ecx
movzx ecx, byte [0x1400fe216]
xor byte [rbp - 0x37], 0x31
xor cl, 0x36
xor byte [rbp - 0x36], 0x32
xor byte [rbp - 0x35], 0x33
mov word [rbp - 0x34], dx
xor dl, 0x34
xor byte [rbp - 0x33], 0x35
mov byte [rbp - 0x32], cl
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x34], dl
xor edx, edx
mov byte [rbp - 0x38], 0x47
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rbx, rax
jne 0x14003c7b2
cmp dword [rdi + 0x58], 0
jbe 0x14003c7b2
xorps xmm0, xmm0
mov dword [rbp - 0x28], Ordinal_27
xor eax, eax
lea rcx, [rbp - 0x28]
movups xmmword [rbp - 0x24], xmm0
mov dword [rbp - 0x14], eax
call qword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x14003c642
mov rax, qword [rbp - 0x20]
add rax, 0xffffffffffff3caf
cmp rax, 0xc34e
jbe 0x14003c7b2
cmp byte [0x140114a21], 0
je 0x14003c7b2
mov ecx, dword [0x14011276c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14003c66d
cmp byte [0x140114a22], 0
jne 0x14003c7b2
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003c68b
imul rax, rax, 0x64
jmp 0x14003c6a9
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jg 0x14003c6ba
add rax, 0x989680
mov qword [rbp - 0x30], rax
jmp 0x14003c6be
mov qword [rbp - 0x30], rsi
lea rcx, [rbp - 0x30]
call fcn.14002d590
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_32]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003c6fa
imul rax, rax, 0x64
jmp 0x14003c718
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r12
jg 0x14003c729
add rax, 0x5f5e100
mov qword [rbp - 0x30], rax
jmp 0x14003c72d
mov qword [rbp - 0x30], rsi
lea rcx, [rbp - 0x30]
call fcn.14002d590
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_32]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
cmp dword [rdi + 0x58], 0
jbe 0x14003c7b2
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003c770
imul rax, rax, 0x64
jmp 0x14003c78e
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jg 0x14003c79f
add rax, 0xf4240
mov qword [rbp - 0x30], rax
jmp 0x14003c7a3
mov qword [rbp - 0x30], rsi
lea rcx, [rbp - 0x30]
call fcn.14002d590
cmp dword [rdi + 0x58], 0
ja 0x14003c752
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14003c7d0
imul rax, rax, 0x64
jmp 0x14003c7ee
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jg 0x14003c7ff
add rax, 0xf4240
mov qword [rbp - 0x30], rax
jmp 0x14003c803
mov qword [rbp - 0x30], rsi
lea rcx, [rbp - 0x30]
call fcn.14002d590
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x14003c576
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c1540
add rsp, 0x58
pop rdi
pop rbp
ret