Function at 0x14003f430
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140055010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
cmp byte [0x140055809], bl
je 0x14003f6e2
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f6e2
cmp dword [0x1400557d8], ebx
jne 0x14003f6e2
movss xmm5, dword [0x14005508c]
lea ecx, [rbx + 0x26]
movss xmm3, dword [0x140055898]
movaps xmm0, xmm5
movss xmm4, dword [0x1400558a4]
addss xmm0, xmm3
movss xmm2, dword [0x1400558b4]
subss xmm3, xmm5
movaps xmm1, xmm2
subss xmm2, xmm5
addss xmm1, xmm5
movss dword [rsp + 0x30], xmm0
movaps xmm0, xmm4
addss xmm0, xmm5
movss dword [rsp + 0x34], xmm3
subss xmm4, xmm5
movss dword [rsp + 0x44], xmm2
movss dword [rsp + 0x40], xmm1
movss dword [rsp + 0x38], xmm0
movss dword [rsp + 0x3c], xmm4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f52a
mov rdx, qword [0x140055968]
lea r9d, [rbx + 4]
mov rcx, qword [0x1400557e8]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400558e8]
lea r9d, [rbx + 4]
mov rcx, qword [0x1400557e8]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f582
mov rdx, qword [0x140055968]
lea r8, [rsp + 0x34]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400558e8]
lea r8, [rsp + 0x34]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f5da
mov rdx, qword [0x140055910]
lea r8, [rsp + 0x38]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400558f0]
lea r8, [rsp + 0x38]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f632
mov rdx, qword [0x140055910]
lea r8, [rsp + 0x3c]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x1400558f0]
lea r8, [rsp + 0x3c]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f68a
mov rdx, qword [0x1400558d8]
lea r8, [rsp + 0x40]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140055890]
lea r8, [rsp + 0x40]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003f6e2
mov rdx, qword [0x1400558d8]
lea r8, [rsp + 0x44]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140055890]
lea r8, [rsp + 0x44]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14005580b], bl
je 0x14003f710
mov rdx, qword [0x1400558d0]
lea r8, [0x140055058]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x1400557b9], bl
mov r9d, 1
mov rdx, qword [0x1400559d0]
mov rcx, qword [0x1400557e8]
mov qword [rsp + 0x20], rbx
je 0x14003f760
lea r8, [0x140055099]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140055918]
lea r8, [0x14005507c]
mov rcx, qword [0x1400557e8]
mov r9d, 4
mov qword [rsp + 0x20], rbx
jmp 0x14003f767
lea r8, [0x1400557ba]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400444e0
add rsp, 0x50
pop rbx
ret