Function at 0x140011a23
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140028000
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x488]
mov rax, qword [0x140040040]
xor rax, rbp
mov qword [rbp + 0x420], rax
lea rcx, [0x14004b26f]
call fcn.140011e6a
mov eax, dword [rbp + 0x460]
mov dword [rbp + 4], eax
mov edx, 0x20
lea rcx, [rbp + 0x28]
call fcn.140011122
lea rax, [rbp + 0x328]
mov qword [rbp + 0x368], rax
mov rdx, qword [rbp + 0x458]
mov rcx, qword [rbp + 0x368]
call fcn.1400111e5
mov qword [rbp + 0x418], rax
mov r8b, 0x20
mov rdx, qword [rbp + 0x418]
lea rcx, [rbp + 0x28]
call fcn.1400110fa
nop
mov edx, 0x20
lea rcx, [rbp + 0x68]
call fcn.140011861
lea rcx, [rbp + 0x68]
call fcn.140011172
nop
mov dword [rbp + 0xa4], 0
jmp 0x1400280d8
mov eax, dword [rbp + 0xa4]
inc eax
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
mov qword [rbp + 0x418], rax
lea rcx, [rbp + 0x28]
call fcn.14001150f
mov rcx, qword [rbp + 0x418]
cmp rcx, rax
jae 0x1400281ab
mov eax, dword [rbp + 0xa4]
mov edx, eax
lea rcx, [rbp + 0x28]
call fcn.140011406
mov rdx, rax
lea rcx, [rbp + 0xc8]
call fcn.1400111e5
nop
lea rdx, [0x140039074]
lea rcx, [rbp + 0xc8]
call fcn.1400115be
movzx eax, al
test eax, eax
jne 0x140028153
lea rdx, [0x140039078]
lea rcx, [rbp + 0xc8]
call fcn.1400115be
movzx eax, al
test eax, eax
je 0x14002816f
mov dword [rbp + 0x384], 0xffffffff
lea rdx, [rbp + 0x384]
lea rcx, [rbp + 0x68]
call fcn.1400115fa
jmp 0x14002819a
mov r8d, 0x10
xor edx, edx
lea rcx, [rbp + 0xc8]
call fcn.14001125d
mov dword [rbp + 0x3a4], eax
lea rdx, [rbp + 0x3a4]
lea rcx, [rbp + 0x68]
call fcn.1400115fa
nop
lea rcx, [rbp + 0xc8]
call fcn.140011299
jmp 0x1400280ca
lea rcx, [rbp + 0x68]
call fcn.140011ee2
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x68]
call fcn.140011ee2
mov rcx, qword [rbp + 0x450]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x450]
mov rax, qword [rax]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x418], rax
mov rax, qword [rbp + 0x168]
inc rax
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x418], 0
je 0x140028395
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14002826c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0x3c8], 0
lea rcx, [rbp + 0x68]
call fcn.14001186b
nop
lea rcx, [rbp + 0x28]
call fcn.140011dde
nop
mov rcx, qword [rbp + 0x458]
call fcn.140011299
mov rax, qword [rbp + 0x3c8]
jmp 0x1400283c7
mov qword [rbp + 0x148], 0
jmp 0x14002828a
mov rax, qword [rbp + 0x148]
inc rax
mov qword [rbp + 0x148], rax
lea rcx, [rbp + 0x68]
call fcn.140011ee2
cmp qword [rbp + 0x148], rax
jae 0x140028328
mov rdx, qword [rbp + 0x148]
lea rcx, [rbp + 0x68]
call fcn.140011c0d
cmp dword [rax], 0xffffffff
je 0x140028323
mov byte [rbp + 0x184], 0
mov rax, qword [rbp + 0x148]
mov rcx, qword [rbp + 0x168]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [rbp + 0x184]
mov rdx, rax
mov rax, qword [rbp + 0x450]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp + 0x184]
mov dword [rbp + 0x414], eax
mov rdx, qword [rbp + 0x148]
lea rcx, [rbp + 0x68]
call fcn.140011c0d
mov ecx, dword [rbp + 0x414]
cmp ecx, dword [rax]
je 0x140028323
jmp 0x140028328
jmp 0x140028279
lea rcx, [rbp + 0x68]
call fcn.140011ee2
dec rax
cmp qword [rbp + 0x148], rax
jb 0x140028390
cmp dword [rbp + 4], 0
jne 0x14002837a
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x3e8], rax
lea rcx, [rbp + 0x68]
call fcn.14001186b
nop
lea rcx, [rbp + 0x28]
call fcn.140011dde
nop
mov rcx, qword [rbp + 0x458]
call fcn.140011299
mov rax, qword [rbp + 0x3e8]
jmp 0x1400283c7
mov eax, dword [rbp + 0x460]
dec eax
mov dword [rbp + 0x460], eax
mov eax, dword [rbp + 4]
dec eax
mov dword [rbp + 4], eax
jmp 0x1400281ed
mov qword [rbp + 0x408], 0
lea rcx, [rbp + 0x68]
call fcn.14001186b
nop
lea rcx, [rbp + 0x28]
call fcn.140011dde
nop
mov rcx, qword [rbp + 0x458]
call fcn.140011299
mov rax, qword [rbp + 0x408]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400385a0]
call fcn.140011bfe
mov rax, rdi
mov rcx, qword [rbp + 0x420]
xor rcx, rbp
call fcn.140011708
lea rsp, [rbp + 0x438]
pop rdi
pop rbp
ret