Function at 0x14003f060
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140054010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
cmp byte [0x1400547f5], bl
je 0x14003f306
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f306
movss xmm5, dword [0x14005408c]
lea ecx, [rbx + 0x26]
movss xmm3, dword [0x14005487c]
movaps xmm0, xmm5
movss xmm4, dword [0x140054890]
addss xmm0, xmm3
movss xmm2, dword [0x1400548d8]
subss xmm3, xmm5
movaps xmm1, xmm2
subss xmm2, xmm5
addss xmm1, xmm5
movss dword [rsp + 0x30], xmm0
movaps xmm0, xmm4
addss xmm0, xmm5
movss dword [rsp + 0x34], xmm3
subss xmm4, xmm5
movss dword [rsp + 0x44], xmm2
movss dword [rsp + 0x40], xmm1
movss dword [rsp + 0x38], xmm0
movss dword [rsp + 0x3c], xmm4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f14e
mov rdx, qword [0x140054928]
lea r9d, [rbx + 4]
mov rcx, qword [0x1400547d0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400548c0]
lea r9d, [rbx + 4]
mov rcx, qword [0x1400547d0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f1a6
mov rdx, qword [0x140054928]
lea r8, [rsp + 0x34]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400548c0]
lea r8, [rsp + 0x34]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f1fe
mov rdx, qword [0x1400548e0]
lea r8, [rsp + 0x38]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400548c8]
lea r8, [rsp + 0x38]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f256
mov rdx, qword [0x1400548e0]
lea r8, [rsp + 0x3c]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400548c8]
lea r8, [rsp + 0x3c]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f2ae
mov rdx, qword [0x1400548b0]
lea r8, [rsp + 0x40]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140054880]
lea r8, [rsp + 0x40]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f306
mov rdx, qword [0x1400548b0]
lea r8, [rsp + 0x44]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140054880]
lea r8, [rsp + 0x44]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400547f7], bl
je 0x14003f334
mov rdx, qword [0x1400548a8]
lea r8, [0x140054058]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400547a9], bl
mov r9d, 1
mov rdx, qword [0x140054998]
mov rcx, qword [0x1400547d0]
mov qword [rsp + 0x20], rbx
je 0x14003f384
lea r8, [0x140054095]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400548e8]
lea r8, [0x14005407c]
mov rcx, qword [0x1400547d0]
mov r9d, 4
mov qword [rsp + 0x20], rbx
jmp 0x14003f38b
lea r8, [0x1400547aa]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140043a40
add rsp, 0x50
pop rbx
ret