Function at 0x140002250
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r12
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
mov rax, qword [0x1400df080]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rax, [r8 + 0x1823a08]
mov qword [rbp + 0xf], 8
mov qword [rbp - 1], rax
xor r12d, r12d
mov rdi, rdx
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x30], r12
mov qword [rbp + 7], rax
mov rsi, r8
lea rax, [rbp - 9]
mov dword [rsp + 0x28], 0x28
mov r9d, 0x28
mov qword [rsp + 0x20], rax
lea r8, [rbp - 9]
mov qword [rbp + 0x1f], r12
mov edx, 0x221a5c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp + 0x1f]
test rax, rax
je 0x1400024e4
add rax, 0x3cc
mov qword [rsp + 0x38], r12
mov qword [rbp - 1], rax
lea r8, [rbp - 9]
lea rax, [rbp + 0x1f]
mov qword [rsp + 0xb0], rbx
mov qword [rbp + 7], rax
mov r9d, 0x28
lea rax, [rbp - 9]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0xc8], r14
mov edx, 0x221a5c
mov dword [rsp + 0x28], 0x28
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x80], r15
mov dword [rbp + 0x1f], r12d
mov qword [rbp + 0xf], 4
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx r14d, byte [rbp + 0x1f]
mov ecx, 0x20
and r14b, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x38], r12
lea r15, [rsi + 0x181c670]
movzx ebx, ax
mov qword [rsp + 0x30], r12
lea rax, [rbp + 0x1f]
mov dword [rsp + 0x28], 0x28
mov qword [rbp + 7], rax
lea r8, [rbp - 9]
lea rax, [rbp - 9]
mov dword [rbp + 0x1f], r12d
mov r9d, 0x28
mov qword [rsp + 0x20], rax
mov edx, 0x221a5c
mov qword [rbp - 1], r15
mov rcx, rdi
mov qword [rbp + 0xf], 4
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test bx, bx
mov rbx, qword [rsp + 0xb0]
je 0x140002424
test r14b, r14b
je 0x140002431
lea rcx, [rbp + 0x1f]
mov qword [rbp + 0x1f], 5
call fcn.140004b20
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x1f]
mov qword [rbp + 7], rax
lea r8, [rbp - 9]
lea rax, [rbp - 9]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x28
mov r9d, 0x28
mov edx, 0x221a60
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov dword [rbp + 0x1f], 0x10001
mov qword [rbp - 1], r15
mov qword [rbp + 0xf], 4
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rbp + 0x1f], 0x10001
jmp 0x140002486
cmp dword [rbp + 0x1f], 0x10001
jne 0x1400024d4
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x1f]
mov qword [rbp + 7], rax
lea r8, [rbp - 9]
lea rax, [rbp - 9]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x28
mov r9d, 0x28
mov edx, 0x221a60
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov dword [rbp + 0x1f], 0x100
mov qword [rbp - 1], r15
mov qword [rbp + 0xf], 4
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rbp + 0x1f], 0x100
mov qword [rsp + 0x38], r12
lea rax, [rsi + 0x181c700]
mov qword [rbp - 1], rax
lea r8, [rbp - 9]
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x30], r12
mov qword [rbp + 7], rax
mov r9d, 0x28
lea rax, [rbp - 9]
mov dword [rsp + 0x28], 0x28
mov edx, 0x221a60
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov qword [rbp + 0xf], 4
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r14, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x80]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14004fca0
add rsp, 0x88
pop r12
pop rdi
pop rsi
pop rbp
ret