Function at 0x1401de020
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r13d, r9b
mov esi, r8d
mov r12, rdx
mov rbp, rcx
mov rax, qword [rcx + 0x20]
cmp byte [rax + 0x130], 0
je 0x1401de0c4
test byte [0x14036fc74], 0x70
jne 0x1401de0c0
call fcn.1401f1e50
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
movzx ebx, al
shl ebx, 4
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 0x20
and al, 1
cmove edi, ebx
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov ecx, edi
or ecx, 0x40
and al, 1
cmove ecx, edi
mov eax, dword [0x14036fcb8]
and eax, 0xffffff8f
or ecx, eax
mov dword [0x14036fcb8], ecx
test cl, 0x70
je 0x1401de0c4
mov al, 1
jmp 0x1401de0c6
xor al, al
mov byte [rbp + 0x48], al
mov r15, qword [rbp + 0x20]
call fcn.1401f6bf0
movzx r14d, al
test al, al
je 0x1401de297
cmp qword [0x14036ed80], 0
jne 0x1401de192
cmp byte [r15 + 0x135], 0
sete r14b
mov rax, qword [0x14036ed68]
test rax, rax
jne 0x1401de122
mov ecx, 0x168
call fcn.14022d994
mov qword [rsp + 0x60], rax
mov rcx, rax
call fcn.1401a8d50
mov qword [0x14036ed68], rax
mov ebx, dword [rax + 0x98]
sub ebx, 1
movsxd rdi, ebx
js 0x1401de192
test rax, rax
jne 0x1401de153
mov ecx, 0x168
call fcn.14022d994
mov qword [rsp + 0x60], rax
mov rcx, rax
call fcn.1401a8d50
mov qword [0x14036ed68], rax
cmp ebx, dword [rax + 0x98]
jae 0x1401de168
mov rcx, qword [rax + 0x88]
mov rcx, qword [rcx + rdi*8]
jmp 0x1401de16a
xor ecx, ecx
mov rax, qword [rcx]
call qword [rax + 0xc0]
test al, al
jne 0x1401de188
dec ebx
sub rdi, 1
js 0x1401de192
mov rax, qword [0x14036ed68]
jmp 0x1401de130
mov byte [r15 + 0x135], 1
jmp 0x1401de19b
test r14b, r14b
je 0x1401de297
test r13b, r13b
je 0x1401de28b
mov rdi, qword [rbp + 0x20]
mov eax, dword [rdi + 0x170]
add eax, 0xfa
cmp esi, eax
jbe 0x1401de28b
cmp byte [rbp + 0x48], 0
jne 0x1401de28b
cmp byte [rsp + 0x80], 0
jne 0x1401de28b
mov eax, dword [r12]
mov dword [rsp + 0x60], eax
mov eax, dword [r12 + 4]
mov dword [rsp + 0x64], eax
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1401a2d30
test al, al
je 0x1401de25e
mov rsi, rdi
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x1401de21c
nop dword [rax + rax]
mov rsi, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1401de210
mov qword [rsp + 0x60], rbx
lea r9, [rsp + 0x60]
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1401fb8d0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1401a2e90
cmp rax, rdi
je 0x1401de280
test rax, rax
je 0x1401de25e
nop dword [rax]
mov rax, qword [rax + 0x18]
cmp rax, rdi
je 0x1401de280
test rax, rax
jne 0x1401de250
mov rcx, qword [rbp + 0x20]
cmp byte [rcx + 0x130], 0
jne 0x1401de274
cmp byte [rcx + 0x132], 0
jne 0x1401de2cf
cmp byte [rsp + 0x88], 0
jne 0x1401de2cf
jmp 0x1401de2af
mov rcx, qword [rbp + 0x20]
call fcn.1401dd960
jmp 0x1401de2cf
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x174], esi
jmp 0x1401de2cf
mov rcx, qword [rbp + 0x20]
mov eax, dword [rcx + 0x174]
add eax, 0xa
cmp esi, eax
jbe 0x1401de2cf
mov byte [0x140370121], 1
mov rax, qword [rcx + 0xc8]
xor edx, edx
test rax, rax
je 0x1401de2c7
mov rcx, rax
call fcn.1401dbd70
jmp 0x1401de2cf
xor r8d, r8d
call fcn.1401dbc50
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret