Function at 0x140008a60
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x14012c040]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r14, rdx
mov qword [rsp + 0x38], rdx
mov rsi, rcx
xor edi, edi
mov rbx, qword [0x14012dd70]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], edi
mov r13, rbx
cmp byte [rax + 0x19], dil
jne 0x140008ae9
nop word [rax + rax]
mov qword [rsp + 0x40], rax
cmp qword [rax + 0x20], rsi
jae 0x140008ad5
mov dword [rsp + 0x48], edi
mov rax, qword [rax + 0x10]
jmp 0x140008ae3
mov dword [rsp + 0x48], 1
mov r13, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], dil
je 0x140008ac0
cmp byte [r13 + 0x19], dil
jne 0x140008af5
cmp rsi, qword [r13 + 0x20]
jae 0x140008b5d
movabs rax, 0x555555555555555
cmp qword [0x14012dd78], rax
je 0x140009115
lea r15, [0x14012dd70]
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rdi
mov ecx, 0x30
call fcn.140088f30
nop
mov qword [rax + 0x20], rsi
xor edx, edx
mov qword [rax + 0x28], rdx
mov dword [rax + 0x2c], edi
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov word [rax + 0x18], dx
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rbp - 0x10], xmm0
mov r8, rax
lea rdx, [rbp - 0x10]
mov rcx, r15
call fcn.140024520
mov r13, rax
mov ecx, dword [r14]
test ecx, ecx
jne 0x140008bf5
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140008b92
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140007b40
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, [rsp + 0x30]
call fcn.140069ea0
movzx ebx, al
lea rcx, [rsp + 0x40]
call fcn.140004140
nop dword [rax]
test bl, bl
je 0x1400090a9
mov dword [r14], edi
mov byte [r13 + 0x28], 1
jmp 0x1400090b0
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
mov r8d, 0x100
lea rdx, [rbp + 0x10]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140008c33
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x38]
call fcn.1400239c0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x28]
lea r12, [rdx + rax*2]
lea r15, [rbp - 0x38]
cmova r15, qword [rbp - 0x38]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], 0xf
cmp r15, r12
jne 0x140008c8e
mov byte [rbp - 0x58], 0
jmp 0x140008d94
sub r12, r15
sar r12, 1
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x140009109
mov r14d, 0xf
cmp r12, r14
jbe 0x140008d53
mov r14, r12
or r14, 0xf
cmp r14, rax
jbe 0x140008cfc
mov r14, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140088f30
mov rcx, rax
test rax, rax
je 0x140008d2b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x40], r14
jmp 0x140008d57
mov eax, 0x16
cmp r14, rax
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140008d32
lea rax, ds:[rcx + 0x27]
cmp rax, rcx
jbe 0x14000910f
jmp 0x140008cd6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140008d46
call fcn.140088f30
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x40], r14
jmp 0x140008d57
mov rax, rdi
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x40], r14
jmp 0x140008d57
mov rax, qword [rbp - 0x58]
lea r8, [rbp - 0x58]
cmp r14, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, r12
test r12, r12
je 0x140008d86
nop
movzx eax, byte ds:[r15]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea r15, [r15 + 2]
sub rdx, 1
jne 0x140008d70
mov qword [rbp - 0x48], r12
mov byte [r8 + r12], 0
mov r14, qword [rsp + 0x38]
cmp dword [rsp + 0x30], 0
jne 0x140008ef7
mov r8d, dword [r14]
lea eax, [r8 - 1]
cmp r8d, 3
cmovge r8d, eax
lea r9, [rbp + 5]
test r8d, r8d
jns 0x140008e00
neg r8d
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140008dc0
dec r9
mov byte [r9], 0x2d
jmp 0x140008e2a
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140008e00
lea r8, [rbp + 5]
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.140024c80
nop
mov dword [rsp + 0x30], 0x756f4d3f
mov word [rsp + 0x34], 0x6573
mov byte [rsp + 0x36], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x31]
lea rcx, [rbp - 0x80]
call fcn.140022060
mov r14, rax
lea rax, [rbp - 0x58]
cmp rax, r14
je 0x140008ee3
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140008eb2
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ead
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ead
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008927c
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
lea rcx, [rbp - 0x80]
call fcn.140004140
nop
lea rcx, [rsp + 0x40]
call fcn.140004140
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
nop dword [rax + rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140008f10
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140007b40
nop
mov r8, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
sub rax, r8
mov r15d, 3
lea r14, [0x14010e0ac]
cmp rax, r15
jb 0x140008fd0
lea rax, [r8 + 3]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x60]
lea rax, [0x14010e0af]
cmp rax, rbx
jbe 0x140008f92
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140008f92
nop dword [rax]
cmp rbx, r14
ja 0x140008f8a
mov rsi, rdi
jmp 0x140008f95
mov rsi, rbx
sub rsi, r14
jmp 0x140008f95
mov rsi, r15
inc r8
lea rcx, [rbx + 3]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 3]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x60]
jmp 0x140008fe7
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.140026b00
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp - 0x58]
call fcn.140021d00
nop
lea rcx, [rsp + 0x40]
call fcn.140004140
nop
lea rcx, [rsp + 0x60]
call fcn.140004140
mov qword ds:[rsp + 0x30], 0
mov qword [rbp - 0x10], 0
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rcx, qword [rbp - 0x58]
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbp - 0x10]
call fcn.140069ea0
mov r14, qword [rsp + 0x38]
test al, al
je 0x140009096
mov dword [r14], edi
mov byte [r13 + 0x28], 1
lea rcx, [rbp - 0x58]
call fcn.140004140
nop
lea rcx, [rbp - 0x38]
call fcn.1400040c0
cmp byte [r13 + 0x28], 0
je 0x1400090df
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400090df
nop dword [rax]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400090d5
mov dword [r14], edi
mov byte [r13 + 0x28], 0
inc edi
cmp edi, 0x100
jl 0x1400090c0
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140088df0
mov rbx, qword [rsp + 0x370]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140004c40
nop
call fcn.140003920
nop
call fcn.140007ac0
int3