Function at 0x140001000
Capabilities:
Link many functions at runtime
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword gs:[0x58]
xor dil, dil
mov ebx, 4
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x1400056c0], eax
jle 0x140001072
lea rcx, [0x1400056c0]
call fcn.1400016bc
cmp dword [0x1400056c0], 0xffffffff
jne 0x140001072
lea rcx, [0x1400056c0]
mov byte [0x1400056c4], dil
call fcn.140001650
mov eax, dword [rbx]
cmp dword [0x1400056c8], eax
jle 0x1400010c1
lea rcx, [0x1400056c8]
call fcn.1400016bc
cmp dword [0x1400056c8], 0xffffffff
jne 0x1400010c1
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400056c8]
mov qword [0x1400056b8], rax
call fcn.140001650
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], 0xffffffffffffd8f0
xor ecx, ecx
call qword [0x1400056b8]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov esi, 0x2a
lea r14d, [rsi + 0xf]
lea r15d, [rsi - 0xd]
nop dword [rax + rax]
mov eax, dword [rbx]
cmp dword [0x1400056c0], eax
jle 0x140001132
lea rcx, [0x1400056c0]
call fcn.1400016bc
cmp dword [0x1400056c0], 0xffffffff
jne 0x140001132
lea rcx, [0x1400056c0]
mov byte [0x1400056c4], 0
call fcn.140001650
mov eax, dword [rbx]
cmp dword [0x1400056c8], eax
jle 0x140001181
lea rcx, [0x1400056c8]
call fcn.1400016bc
cmp dword [0x1400056c8], 0xffffffff
jne 0x140001181
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400056c8]
mov qword [0x1400056b8], rax
call fcn.140001650
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], 0xffffffffffffd8f0
xor ecx, ecx
call qword [0x1400056b8]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400015e7
test dil, dil
jne 0x1400015e7
mov r8d, 0x28
mov dword [rbp - 0x58], 1
lea rdx, [rbp - 0x58]
mov word [rbp - 0x4e], si
mov dword [rbp - 0x4c], 8
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov eax, dword [rbx]
cmp dword [0x1400056c0], eax
jle 0x140001220
lea rcx, [0x1400056c0]
call fcn.1400016bc
cmp dword [0x1400056c0], 0xffffffff
jne 0x140001220
lea rcx, [0x1400056c0]
mov byte [0x1400056c4], dil
call fcn.140001650
mov eax, dword [rbx]
cmp dword [0x1400056c8], eax
jle 0x14000126f
lea rcx, [0x1400056c8]
call fcn.1400016bc
cmp dword [0x1400056c8], 0xffffffff
jne 0x14000126f
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400056c8]
mov qword [0x1400056b8], rax
call fcn.140001650
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x30], 0xffffffffffffd8f0
xor ecx, ecx
call qword [0x1400056b8]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8d, 0x28
mov dword [rbp - 0x4c], 0xa
lea rdx, [rbp - 0x58]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov eax, dword [rbx]
cmp dword [0x1400056c0], eax
jle 0x1400012e6
lea rcx, [0x1400056c0]
call fcn.1400016bc
cmp dword [0x1400056c0], 0xffffffff
jne 0x1400012e6
lea rcx, [0x1400056c0]
mov byte [0x1400056c4], 0
call fcn.140001650
mov eax, dword [rbx]
cmp dword [0x1400056c8], eax
jle 0x140001335
lea rcx, [0x1400056c8]
call fcn.1400016bc
cmp dword [0x1400056c8], 0xffffffff
jne 0x140001335
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400056c8]
mov qword [0x1400056b8], rax
call fcn.140001650
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x28], 0xffffffffffffd8f0
xor ecx, ecx
call qword [0x1400056b8]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8d, 0x28
mov dword [rbp - 0x58], 1
lea rdx, [rbp - 0x58]
mov word [rbp - 0x4e], r14w
mov dword [rbp - 0x4c], 8
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov eax, dword [rbx]
cmp dword [0x1400056c0], eax
jle 0x1400013b8
lea rcx, [0x1400056c0]
call fcn.1400016bc
cmp dword [0x1400056c0], 0xffffffff
jne 0x1400013b8
lea rcx, [0x1400056c0]
mov byte [0x1400056c4], 0
call fcn.140001650
mov eax, dword [rbx]
cmp dword [0x1400056c8], eax
jle 0x140001407
lea rcx, [0x1400056c8]
call fcn.1400016bc
cmp dword [0x1400056c8], 0xffffffff
jne 0x140001407
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400056c8]
mov qword [0x1400056b8], rax
call fcn.140001650
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], 0xffffffffffffd8f0
xor ecx, ecx
call qword [0x1400056b8]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8d, 0x28
mov dword [rbp - 0x4c], 0xa
lea rdx, [rbp - 0x58]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov eax, dword [rbx]
cmp dword [0x1400056c0], eax
jle 0x14000147e
lea rcx, [0x1400056c0]
call fcn.1400016bc
cmp dword [0x1400056c0], 0xffffffff
jne 0x14000147e
lea rcx, [0x1400056c0]
mov byte [0x1400056c4], 0
call fcn.140001650
mov eax, dword [rbx]
cmp dword [0x1400056c8], eax
jle 0x1400014cd
lea rcx, [0x1400056c8]
call fcn.1400016bc
cmp dword [0x1400056c8], 0xffffffff
jne 0x1400014cd
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400056c8]
mov qword [0x1400056b8], rax
call fcn.140001650
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea rdx, [rbp - 0x18]
mov qword [rbp - 0x18], 0xffffffffffffd8f0
xor ecx, ecx
call qword [0x1400056b8]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8d, 0x28
mov dword [rbp - 0x58], 1
lea rdx, [rbp - 0x58]
mov word [rbp - 0x4e], r15w
mov dword [rbp - 0x4c], 8
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov eax, dword [rbx]
cmp dword [0x1400056c0], eax
jle 0x140001550
lea rcx, [0x1400056c0]
call fcn.1400016bc
cmp dword [0x1400056c0], 0xffffffff
jne 0x140001550
lea rcx, [0x1400056c0]
mov byte [0x1400056c4], 0
call fcn.140001650
mov eax, dword [rbx]
cmp dword [0x1400056c8], eax
jle 0x14000159f
lea rcx, [0x1400056c8]
call fcn.1400016bc
cmp dword [0x1400056c8], 0xffffffff
jne 0x14000159f
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400056c8]
mov qword [0x1400056b8], rax
call fcn.140001650
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], 0xffffffffffffd8f0
xor ecx, ecx
call qword [0x1400056b8]
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov r8d, 0x28
mov dword [rbp - 0x4c], 0xa
lea rdx, [rbp - 0x58]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov dil, 1
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edx, edx
movzx ecx, dil
test ax, ax
cmovs edx, ecx
movzx edi, dl
jmp 0x140001100