Function at 0x1400198a0
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rsi, rcx
lea r12, [rcx + 0x1948]
lea rax, [rcx + 0x1930]
mov qword [rsp + 0x80], rax
lea r13, [rcx + 0x1924]
lea rdi, [rcx + 0x1920]
lea rax, [rcx + 0x1908]
mov qword [rsp + 0x50], rax
lea rbp, [rcx + 0x1961]
mov eax, 0x1b16656a
mov r14, qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea rbx, [0x140059619]
jmp 0x140019910
mov eax, 0xb9473323
nop word [rax + rax]
cmp eax, 0x1b166569
jle 0x140019960
cmp eax, 0x567abca0
jg 0x1400199d0
cmp eax, 0x4dc10fe0
jle 0x140019ac9
cmp eax, 0x4dc10fe1
je 0x140019c1e
cmp eax, 0x4ede2a1a
jne 0x140019ce5
mov qword [rsp + 0xc0], rbp
mov eax, 0x4dc10fe1
jmp 0x140019910
cmp eax, 0xc5a92dfa
jle 0x140019a10
cmp eax, 0x7b3db65
jle 0x140019b36
cmp eax, 0x7b3db66
je 0x140019902
cmp eax, 0x19ece69f
jne 0x140019cf5
mov eax, dword [0x140128e24]
lea ecx, [rax + 1]
mov dword [0x140128e24], ecx
add eax, eax
mov dword [0x140155098], eax
mov rcx, rbx
call fcn.14003720c
mov qword [rsp + 0x58], rsi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xc8], rax
mov eax, 0x645f3bc4
jmp 0x140019910
cmp eax, 0x645f3bc3
jle 0x140019b56
cmp eax, 0x645f3bc4
je 0x140019c3d
cmp eax, 0x67c6b2b3
jne 0x140019d05
cmp dword [rsp + 0x64], 0
mov eax, 0x4ede2a1a
mov ecx, 0x87c8e34e
cmove eax, ecx
jmp 0x140019910
cmp eax, 0xb9473322
jg 0x140019bba
cmp eax, 0x87c8e34e
je 0x140019c7f
cmp eax, 0xaf1a07b9
jne 0x140019910
mov eax, dword [0x140128e24]
lea ecx, [rax + 1]
mov dword [0x140128e24], ecx
lea eax, [rax + rax*2]
mov dword [0x140155098], eax
mov rcx, rbx
call fcn.14003720c
mov qword [rsp + 0x48], rsi
mov r9d, dword [rsi + 0x1910]
mov edx, dword [rsi + 0x1908]
mov r8d, dword [rsi + 0x190c]
mov rcx, qword [rsp + 0x48]
call fcn.140005480
mov edx, dword [rsi + 0x190c]
mov r8d, dword [rsi + 0x1910]
xor r9d, r9d
call fcn.14001b610
mov qword [rsp + 0x90], r13
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x98], rdi
mov rax, qword [rsp + 0x98]
mov eax, dword [rax]
mov dword [rsp + 0x70], eax
mov eax, dword [rsi + 0x191c]
mov dword [rsp + 0x74], eax
mov eax, 0x34e10532
jmp 0x140019910
cmp eax, 0x1b16656a
je 0x140019c96
cmp eax, 0x34e10532
jne 0x140019910
mov rcx, qword [rsp + 0x48]
mov r9d, dword [rsp + 0x6c]
mov r8d, dword [rsp + 0x70]
mov edx, dword [rsp + 0x74]
call fcn.140005480
mov rax, qword [rsp + 0x90]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x98]
mov edx, dword [rax]
xor r9d, r9d
call fcn.14001b610
mov rcx, r12
call fcn.14001d2d0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xd0], rax
mov eax, 0x5545f4b7
jmp 0x140019910
cmp eax, 0xc5a92dfb
je 0x140019ca0
cmp eax, 0xe6d86367
jne 0x140019910
mov eax, 0xb9473323
jmp 0x140019910
cmp eax, 0x567abca1
je 0x140019cb7
cmp eax, 0x5ef4168e
jne 0x140019910
mov eax, dword [rsp + 0x60]
mov ecx, eax
not ecx
and ecx, 0x23d5c6b8
and eax, 0xdc2a3947
or eax, ecx
mov ecx, eax
xor ecx, 0xdc2a3947
and ecx, 0xffff7fff
xor eax, 0x23d546b8
or eax, ecx
mov ecx, eax
not ecx
and ecx, 0xd0ef503c
and eax, 0x2f10afc3
or eax, ecx
xor eax, 0x2f10afc3
mov dword [rsp + 0x64], eax
mov eax, 0x67c6b2b3
jmp 0x140019910
cmp eax, 0xb9473323
je 0x140019cce
cmp eax, 0xbfa26398
jne 0x140019910
mov eax, dword [rsp + 0x78]
mov ecx, eax
not ecx
and ecx, 0x5d5bcf6b
and eax, 0xa2a43094
or eax, ecx
mov ecx, eax
xor ecx, 0xa2a43094
and ecx, 0xffff7fff
xor eax, 0x5d5b4f6b
or eax, ecx
mov ecx, eax
not ecx
and ecx, 0xb1cb28ed
and eax, 0x4e34d712
or eax, ecx
xor eax, 0x4e34d712
mov dword [rsp + 0x7c], eax
mov eax, 0x567abca1
jmp 0x140019910
mov rax, qword [rsp + 0xc0]
cmp byte [rax], 0
setne byte [rsp + 0x3f]
movzx eax, byte [rsp + 0x3f]
mov eax, 0xc5a92dfb
jmp 0x140019910
mov r15, qword [rsp + 0xc8]
mov r9d, dword [r15 + 8]
lea rax, [r15 + 4]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov r8d, dword [rax]
mov edx, dword [r15]
mov rcx, qword [rsp + 0x58]
call fcn.140005480
mov eax, dword [r15 + 8]
mov dword [rsp + 0x68], eax
mov eax, 0x700174ac
jmp 0x140019910
mov ecx, 0x30
call r14
cwde
mov dword [rsp + 0x78], eax
mov eax, 0xbfa26398
jmp 0x140019910
mov eax, 0xe6d86367
jmp 0x140019910
cmp byte [rsp + 0x3f], 0
mov eax, 0xaf1a07b9
mov ecx, 0x19ece69f
cmovne eax, ecx
jmp 0x140019910
cmp dword [rsp + 0x7c], 0
mov eax, 0x187007fe
mov ecx, 0x7b3db66
cmove eax, ecx
jmp 0x140019910
mov ecx, 0x31
call r14
cwde
mov dword [rsp + 0x60], eax
mov eax, 0x5ef4168e
jmp 0x140019910
cmp eax, 0x5545f4b7
jne 0x140019910
jmp 0x140019e09
cmp eax, 0x187007fe
jne 0x140019910
jmp 0x140019f53
cmp eax, 0x700174ac
jne 0x140019910
mov rax, qword [rsp + 0x88]
mov edx, dword [rax]
mov r8d, dword [rsp + 0x68]
xor r9d, r9d
call fcn.14001b610
mov rcx, r12
call fcn.14001d2d0
mov rcx, qword [rsp + 0x80]
call fcn.14001d4c0
mov rcx, qword [rsp + 0x58]
call fcn.1400020f0
mov rcx, qword [rsp + 0x58]
mov edx, 2
call fcn.140004690
mov ecx, 0x85fb6e54
lea rax, [rsp + 0xa0]
jmp 0x140019d80
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
mov ecx, 0x4f0cf929
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x85fb6e54
je 0x140019d64
cmp ecx, 0x4f0cf929
jne 0x140019d80
mov rax, qword [rsp + 0x40]
mov ecx, dword [0x14004ea40]
mov dword [rax + 0x10], ecx
movups xmm0, xmmword [0x14004ea30]
movups xmmword [rax], xmm0
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
call fcn.140022220
mov rax, qword [0x140128d78]
mov qword [rsp + 0x28], rax
lea rax, [0x1400595be]
mov qword [rsp + 0x20], rax
mov word [rsp + 0x30], 6
mov rcx, rsi
xor edx, edx
mov r8d, 0xd
mov r9d, 0x25
call fcn.1400050d0
mov rax, qword [rsp + 0x40]
mov rcx, rsi
mov edx, 4
call fcn.140018ed0
mov rcx, rsi
call fcn.140019340
mov rcx, qword [rsp + 0xd0]
call fcn.14001d4c0
mov rcx, qword [rsp + 0x48]
call fcn.1400020f0
mov rcx, qword [rsp + 0x48]
mov edx, 3
call fcn.140004690
mov ecx, 0x85fb6e54
lea rax, [rsp + 0xa0]
jmp 0x140019e50
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
mov ecx, 0x4f0cf929
nop dword [rax]
cmp ecx, 0x85fb6e54
je 0x140019e3e
cmp ecx, 0x4f0cf929
jne 0x140019e50
mov rax, qword [rsp + 0x40]
mov ecx, dword [0x14004ea40]
mov dword [rax + 0x10], ecx
movups xmm0, xmmword [0x14004ea30]
movups xmmword [rax], xmm0
lea rdi, [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call fcn.140022220
mov rax, qword [0x140128d78]
mov qword [rsp + 0x28], rax
lea rbp, [0x1400595be]
mov qword [rsp + 0x20], rbp
mov word [rsp + 0x30], 6
mov rcx, rsi
xor edx, edx
mov r8d, 0xd
mov r9d, 0x25
call fcn.1400050d0
mov rax, qword [rsp + 0x40]
lea rbx, [rsi + 0x191c]
mov eax, 0x7e05f65e
jmp 0x140019f30
mov eax, dword [0x14004ea54]
mov dword [rsp + 0xb0], eax
movups xmm0, xmmword [0x14004ea44]
movaps xmmword [rsp + 0xa0], xmm0
mov rcx, rbx
mov rdx, rdi
call fcn.140022220
mov rax, qword [0x140128d78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov word [rsp + 0x30], 6
mov rcx, rsi
xor edx, edx
mov r8d, 0x1b
mov r9d, 0x25
call fcn.1400050d0
mov eax, 0x288d614b
nop
cmp eax, 0x7e05f65e
je 0x140019ed5
cmp eax, 0x288d614b
jne 0x140019f30
mov rcx, rsi
mov edx, 4
call fcn.140018ed0
mov rcx, rsi
call fcn.14001aef0
xor ecx, ecx
call fcn.14002fbe4
int3