Function at 0x1400e64f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x130
mov rax, qword [0x1404e6228]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0xd0]
call fcn.1400880a0
nop
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x68]
call fcn.1400e9960
nop
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
je 0x1400e6546
mov byte [rsp + 0x22], 1
jmp 0x1400e654b
mov byte [rsp + 0x22], 0
movzx eax, byte [rsp + 0x22]
mov byte [rsp + 0x20], al
mov ecx, shutdown
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
je 0x1400e656b
mov byte [rsp + 0x23], 1
jmp 0x1400e6570
mov byte [rsp + 0x23], 0
movzx eax, byte [rsp + 0x23]
mov byte [rsp + 0x21], al
xor edx, edx
lea rcx, [0x1404f6350]
call fcn.1400e9f50
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400e659a
mov ecx, 0x45
call fcn.1400e63d0
movzx eax, byte [rsp + 0x21]
test eax, eax
jne 0x1400e65ad
mov ecx, 0x3a
call fcn.1400e63d0
mov dword [rsp + 0x34], 0
jmp 0x1400e65c1
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 4
jge 0x1400e65d4
mov ecx, 0x46
call fcn.1400e63d0
jmp 0x1400e65b7
lea rcx, [0x1404f62d8]
call fcn.1400ea370
cmp eax, dword [rsp + 0x140]
jne 0x1400e664e
lea rcx, [0x1404f6350]
call fcn.1400ea370
test eax, eax
jne 0x1400e664e
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov dword [rsp + 0x5c], 0xc8
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x78]
call fcn.1400e6f30
movzx r9d, byte [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [0x1404f6358]
call fcn.1400e9770
movzx eax, al
test eax, eax
jne 0x1400e664e
mov ecx, 0x46
call fcn.1400e63d0
jmp 0x1400e65d4
xor edx, edx
lea rcx, [0x1404f6350]
call fcn.1400ea420
mov byte [rsp + 0x20], 1
mov byte [rsp + 0x21], 1
mov qword [rsp + 0x38], 0
jmp 0x1400e667e
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
lea rcx, [0x1404f6338]
call fcn.1400eb1d0
cmp qword [rsp + 0x38], rax
jae 0x1400e6901
lea rcx, [0x1404f62d8]
call fcn.1400ea370
cmp eax, dword [rsp + 0x140]
jne 0x1400e6901
mov rdx, qword [rsp + 0x38]
lea rcx, [0x1404f6338]
call fcn.1400ea340
movzx eax, word [rax]
mov word [rsp + 0x24], ax
lea rcx, [rsp + 0x60]
call fcn.1400eafe0
movzx eax, byte [rsp + 0x24]
movzx ecx, byte [rsp + 0x20]
cmp eax, ecx
je 0x1400e66f2
mov ecx, 0x45
call fcn.1400e63d0
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x25]
movzx ecx, byte [rsp + 0x21]
cmp eax, ecx
je 0x1400e6713
mov ecx, 0x3a
call fcn.1400e63d0
movzx eax, byte [rsp + 0x25]
mov byte [rsp + 0x21], al
mov ecx, 0x46
call fcn.1400e63d0
mov dword [rsp + 0x40], 0x190
lea rcx, [rsp + 0x80]
call fcn.1400eafe0
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140085e90
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400e9190
mov rcx, rax
call fcn.140086a80
mov dword [rsp + 0x44], eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x44]
call fcn.1400e9670
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
lea rcx, [0x1404f6350]
call fcn.1400ea370
test eax, eax
jg 0x1400e67dd
lea rax, [rsp + 0x29]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov eax, 0x190
sub eax, dword [rsp + 0x30]
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x98]
call fcn.1400e6fa0
movzx r9d, byte [rsp + 0x29]
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [0x1404f6358]
call fcn.1400e97c0
movzx eax, al
test eax, eax
je 0x1400e68b3
lea rcx, [0x1404f6350]
call fcn.1400ea460
test eax, eax
je 0x1400e68b1
lea rcx, [0x1404f6338]
call fcn.1400eb1d0
dec rax
cmp qword [rsp + 0x38], rax
jae 0x1400e68b1
mov dword [rsp + 0x4c], 0x190
lea rcx, [rsp + 0xa0]
call fcn.1400eafe0
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.140085e90
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400e9190
mov rcx, rax
call fcn.140086a80
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x50]
call fcn.1400e9670
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov eax, 0x1a4
sub eax, dword [rsp + 0x30]
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0xb8]
call fcn.1400e6fa0
mov rcx, rax
call fcn.1400e96c0
mov byte [rsp + 0x2a], 0
lea rcx, [rsp + 0x68]
call fcn.140088340
nop
lea rcx, [rsp + 0xd0]
call fcn.1400885f0
movzx eax, byte [rsp + 0x2a]
jmp 0x1400e6923
jmp 0x1400e68fc
mov eax, dword [rsp + 0x30]
add eax, 0x14
mov dword [rsp + 0x58], eax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xc0]
call fcn.1400e6fa0
mov rcx, rax
call fcn.1400e96c0
mov byte [rsp + 0x2b], 0
lea rcx, [rsp + 0x68]
call fcn.140088340
nop
lea rcx, [rsp + 0xd0]
call fcn.1400885f0
movzx eax, byte [rsp + 0x2b]
jmp 0x1400e6923
jmp 0x1400e6671
mov byte [rsp + 0x2c], 1
lea rcx, [rsp + 0x68]
call fcn.140088340
nop
lea rcx, [rsp + 0xd0]
call fcn.1400885f0
movzx eax, byte [rsp + 0x2c]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1401a6870
add rsp, 0x130
pop rdi
ret