Function at 0x140070f40
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14009e040]
xor rax, rsp
mov qword [rbp + 0x17], rax
movss xmm6, dword [0x14008e488]
xor sil, sil
mov rdi, qword [rbp - 0x29]
xor r14d, r14d
movabs r12, 0x7ffffffffffffffe
movabs r15, 0x7fffffffffffffff
movabs r13, 0x7ffffffffff0bdbf
mov ecx, dword [0x14009e274]
test ecx, ecx
je 0x140070fd9
sub ecx, 1
je 0x140070fc1
cmp ecx, 1
jne 0x140070ff7
mov byte [0x14009e280], cl
jmp 0x140070ff7
mov ecx, dword [0x14009e270]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne byte [0x14009e280]
jmp 0x140070ff7
mov ecx, dword [0x14009e270]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140070ff7
cmp byte [0x14009e280], r14b
sete byte [0x14009e280]
lea rdx, [rbp - 0x48]
mov dword [rbp - 0x49], 0x626f5205
xor ecx, ecx
mov dword [rbp - 0x45], 0x786f6c
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x1400711dd
cmp byte [0x14009e280], r14b
je 0x140071191
cmp byte [0x14009f8b4], r14b
je 0x140071191
mov rax, qword [0x14009f8f8]
add rax, 0x100
mov dword [rbp + 0x10], r14d
mov qword [rbp - 9], rax
lea rax, [rbp - 0x19]
mov qword [rbp - 1], rax
mov eax, dword [0x14009fa80]
mov word [rbp + 0x14], r14w
mov byte [rbp + 0x16], r14b
mov dword [rbp - 0x11], 0x12b2d92
mov qword [rbp + 7], 8
mov dword [rbp - 0xd], eax
mov byte [rbp + 0xf], r14b
test eax, eax
je 0x1400710bf
mov rcx, qword [0x14009fa78]
test rcx, rcx
je 0x1400710bf
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x11]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x11]
mov dword [rsp + 0x28], 0x28
mov r9d, 0x28
mov edx, 0x224a14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp byte [0x14009e122], r14b
je 0x1400710d7
test sil, sil
je 0x1400710d7
test rdi, rdi
je 0x1400710d7
mov rbx, rdi
jmp 0x1400710e8
call fcn.14006f7c0
mov rbx, rax
test rax, rax
je 0x140071191
lea rdx, [rbx + 0x158]
call fcn.14005d200
add rax, 0x140
mov qword [rbp - 0x39], r14
mov qword [rbp - 9], rax
lea rax, [rbp - 0x39]
mov qword [rbp - 1], rax
mov eax, dword [0x14009fa80]
mov dword [rbp - 0x31], r14d
mov dword [rbp + 0x10], r14d
mov word [rbp + 0x14], r14w
mov byte [rbp + 0x16], r14b
mov dword [rbp - 0x11], 0x12b2d92
mov qword [rbp + 7], 0xc
mov dword [rbp - 0xd], eax
mov byte [rbp + 0xf], r14b
test eax, eax
je 0x140071191
mov rcx, qword [0x14009fa78]
test rcx, rcx
je 0x140071191
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x11]
mov qword [rsp + 0x30], r14
lea r8, [rbp - 0x11]
mov dword [rsp + 0x28], 0x28
mov r9d, 0x28
mov edx, 0x224a14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movss xmm0, dword [rbp - 0x35]
comiss xmm0, xmm6
jbe 0x140071191
mov rcx, rbx
call fcn.14006ffc0
mov rdi, rbx
mov sil, 1
jmp 0x140071194
xor sil, sil
cmp dword [0x14009f8cc], 1
je 0x140070fa5
lea rcx, [rbp - 0x21]
call fcn.14006f400
mov rax, qword [rbp - 0x21]
mov qword [rbp - 0x41], rax
cmp rax, r12
je 0x14007121c
mov ecx, 1
mov edx, 0xff
cmovl ecx, edx
test cl, cl
jns 0x14007121c
inc rax
lea rcx, [rbp - 0x41]
mov qword [rbp - 0x41], rax
call fcn.140071240
jmp 0x140070fa5
lea rcx, [rbp - 0x29]
call fcn.14006f400
mov rax, qword [rbp - 0x29]
mov qword [rbp - 0x41], rax
cmp rax, r13
je 0x14007121c
mov ecx, 1
mov edx, 0xff
cmovl ecx, edx
test cl, cl
jns 0x14007121c
add rax, 0xf4240
lea rcx, [rbp - 0x41]
mov qword [rbp - 0x41], rax
call fcn.140071240
jmp 0x140070fa5
lea rcx, [rbp - 0x41]
mov qword [rbp - 0x41], r15
call fcn.140071240
jmp 0x140070fa5