Function at 0x140005760
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x100
mov rax, qword [0x140086040]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor r14d, r14d
movzx ebx, dl
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r9d, eax
lea eax, [rbx - 0x21]
cmp eax, 0x84
ja case.0x1400057c2.41
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x5a08]
mov ecx, dword [rdx + rax*4 + 0x5a00]
add rcx, rdx
jmp rcx
bts r9d, 8
shl r9d, 0x10
mov r8d, 0x80
lea rdx, [rsp + 0x70]
mov ecx, r9d
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x1400058da
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140005ce0
nop
mov r9d, 9
lea r8, str.key_code
lea rcx, [rsp + 0x50]
call fcn.140005ec0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x30]
movq r8, xmm0
psrldq xmm1, 8
movq r9, xmm1
cmp r9, 0xf
cmova rcx, r8
lea rdx, [rsp + 0x70]
sub rdx, rcx
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140005851
cmp r9, 0xf
jbe 0x14000589a
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140005891
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005891
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.14005015c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400058da
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400058d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400058d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005015c
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400058f4
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x1400059f2
cmp rbx, 0xf
ja 0x14000593b
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x1400059cb
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x140005970
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14004fee0
test rax, rax
je 0x140005997
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400059ab
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14000599e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400059f8
jmp 0x140005955
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400059ab
call fcn.14004fee0
mov r14, rax
mov qword [rdi], r14
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rsi
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14004fda0
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop r14
pop rdi
pop rsi
ret
call fcn.140001230
int3
call fcn.140001190
int3