Function at 0x140037b70
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x14023a0c0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ecx, dword [reloc.WS2_32.dll_closesocket]
mov eax, dword [0x140246ce4]
cdq
sub eax, edx
sar eax, 1
mov edi, eax
sub edi, ecx
lea r14d, [rax + rcx]
mov ecx, dword [reloc.WS2_32.dll_closesocket]
mov eax, dword [0x140246ce0]
cdq
sub eax, edx
sar eax, 1
mov esi, eax
sub esi, ecx
lea ebx, [rax + rcx]
mov ecx, dword [reloc.WS2_32.dll_getsockname]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140037e01
cmp byte [0x14024980a], 0
je 0x140037e01
mov qword [rsp + 0xd0], r12
xor ecx, ecx
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xe0], r15
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ecx, ecx
mov dword [rbp - 1], Ordinal_45
mov r15, rax
mov dword [rsp + 0x28], ecx
xorps xmm0, xmm0
mov dword [rbp + 0x23], ecx
mov qword [rbp - 0x19], rcx
lea r9, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp - 1]
sub ebx, esi
mov qword [rbp + 0xb], 0x200001
mov eax, ebx
sub r14d, edi
neg eax
mov dword [rbp + 3], r14d
xor r8d, r8d
mov dword [rbp + 7], eax
mov rcx, r12
movdqu xmmword [rbp + 0x13], xmm0
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov r13, rax
test rax, rax
je 0x140037dd5
mov rdx, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, r14d
mov dword [rsp + 0x38], esi
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
mov qword [rsp + 0x28], r12
mov rcx, r15
mov dword [rsp + 0x20], ebx
call qword [sym.imp.GDI32.dll_BitBlt]
xor edi, edi
imul ebx, r14d
mov r8d, edi
test ebx, ebx
jle 0x140037dcc
mov rdx, qword [rbp - 0x19]
inc rdx
nop word [rax + rax]
movzx ecx, byte [rdx + 1]
sub ecx, 0xfe
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x5a
jge 0x140037cfb
movzx ecx, byte [rdx]
sub ecx, 0x63
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x5a
jge 0x140037cfb
movzx ecx, byte [rdx - 1]
sub ecx, 0x6a
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x5a
jl 0x140037d0c
inc r8d
add rdx, 4
cmp r8d, ebx
jl 0x140037cc0
jmp 0x140037dcc
mov ebx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140037dcc
mov rcx, qword [0x140244928]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140037d64
mov edx, dword [0x140244920]
lea r8, [rbp - 0x11]
mov qword [rsp + 0x38], rdi
mov r9d, recv
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov qword [rbp - 0x11], rdi
mov word [rbp - 9], bx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbp - 0x11]
mov qword [rbp - 0x11], rbx
call fcn.140042480
mov rcx, qword [0x140244928]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140037db8
mov edx, dword [0x140244920]
lea r8, [rbp - 0x11]
mov qword [rsp + 0x38], rdi
mov eax, 2
mov qword [rsp + 0x30], rdi
mov r9d, recv
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov qword [rbp - 0x11], rdi
mov word [rbp - 9], ax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movsxd rax, dword [reloc.WS2_32.dll_accept]
lea rcx, [rbp - 0x11]
mov qword [rbp - 0x11], rax
call fcn.140042480
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r15, qword [rsp + 0xe0]
mov r13, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400c1cc0
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret