Function at 0x1400010e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14004e040]
xor rax, rsp
mov qword [rbp - 0x18], rax
cmp byte [0x14004e0c0], 0
mov rbx, rcx
je 0x140001404
mov qword [rsp + 0x78], rsi
xor esi, esi
movaps xmmword [rsp + 0x50], xmm6
xorps xmm6, xmm6
mov qword [rsp + 0x80], rdi
cmp byte [0x14004e979], sil
jne 0x140001138
mov qword [rbp - 0x28], 0x14
jmp 0x1400013dc
mov ecx, dword [0x14004e0bc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x14004e97c]
shr eax, 0xf
and al, 1
test ecx, ecx
jne 0x140001164
test al, al
jne 0x1400011a2
mov qword [rbp - 0x28], 0xa
jmp 0x1400013dc
cmp ecx, 1
jne 0x1400011a2
test al, al
je 0x14000118c
cmp byte [0x14004e980], sil
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x28], 0xc8
sete byte [0x14004e980]
call fcn.140001420
cmp byte [0x14004e980], sil
jne 0x1400011a2
mov qword [rbp - 0x28], 0xa
jmp 0x1400013dc
mov rdx, qword [0x14004e970]
lea r8, [rbp - 0x20]
mov rcx, qword [rbx + 8]
add rdx, 0x17c37f0
mov r9d, 8
mov qword [rbp - 0x20], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp - 0x20]
lea r8, [rbp - 0x2b]
mov rcx, qword [rbx + 8]
mov r9d, 1
mov byte [rbp - 0x2b], sil
mov qword [rsp + 0x20], rsi
lea rdx, [rdi + 0x3c3]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x14004e97a], sil
jne 0x140001238
mov rcx, qword [rbx + 8]
lea rdx, [rdi + 0x135c]
mov r9d, 4
mov dword [rbp - 0x30], esi
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x30]
comiss xmm0, xmm6
jbe 0x140001238
mov qword [rbp - 0x28], 0xa
jmp 0x1400013dc
mov rcx, qword [rbx + 8]
lea rdx, [rdi + 0x13a8]
mov r9d, 4
mov dword [rbp - 0x30], esi
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [rbp - 0x30]
test edi, edi
je 0x1400013e5
mov rdx, qword [0x14004e970]
lea r8, [rbp - 0x20]
mov rcx, qword [rbx + 8]
add rdx, 0x1956a68
mov r9d, 8
mov qword [rbp - 0x20], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x20]
lea r8, [rbp - 0x28]
mov eax, edi
mov qword [rbp - 0x28], rsi
sar eax, 9
add rdx, 0x10
shl eax, 3
mov r9d, 8
movsxd rcx, eax
add rdx, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbx + 8]
lea r8, [rbp - 0x20]
and edi, 0x1ff
mov qword [rbp - 0x20], rsi
imul edx, edi, 0x78
mov r9d, 8
mov qword [rsp + 0x20], rsi
add rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x1400013e5
cmp byte [0x14004e0c1], sil
je 0x140001335
mov rcx, qword [rbx + 8]
lea rdx, [rdi + 0x3c3]
mov r9d, 1
mov byte [rbp - 0x2c], sil
lea r8, [rbp - 0x2c]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp - 0x2c]
cmp byte [rbp - 0x2b], al
je 0x1400013e5
mov rcx, qword [rbx + 8]
lea rdx, [rdi + 0x324]
mov r9d, 4
mov dword [rbp - 0x30], esi
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [rbp - 0x30], esi
jle 0x1400013e5
mov rdx, qword [0x14004e970]
lea r8, [rbp - 0x30]
mov rcx, qword [rbx + 8]
add rdx, 0x17bc020
mov r9d, 4
mov dword [rbp - 0x30], 0x10001
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsxd rax, dword [0x14004e0b8]
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x28], rax
call fcn.140001420
mov rdx, qword [0x14004e970]
lea r8, [rbp - 0x30]
mov rcx, qword [rbx + 8]
add rdx, 0x17bc020
mov r9d, 4
mov dword [rbp - 0x30], 0x100
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsxd rax, dword [0x14004e0b8]
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.140001420
cmp byte [0x14004e0c0], sil
jne 0x140001122
movaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140040810
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret