Function at 0x140023ae0
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x30
cmp byte [0x1400c20d9], 0
mov rbx, rcx
jne 0x140023d54
mov ecx, dword [0x1400c2124]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edi, edi
test al, 1
je 0x140023b40
cmp dword [0x1400c20c8], edi
jne 0x140023b40
cmp byte [0x1400c2120], dil
mov rcx, qword [rbx]
je 0x140023b27
call fcn.140028b70
xor al, al
jmp 0x140023b2e
call fcn.140028b30
mov al, 1
mov byte [0x1400c2120], al
mov dword [0x1400c20c8], 1
jmp 0x140023b57
mov ecx, dword [0x1400c2124]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140023b57
mov dword [0x1400c20c8], edi
test dword [0x1400c20a0], 0xfffffffd
jne 0x140023bf2
mov ecx, dword [0x1400c2094]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140023bf2
mov eax, dword [0x1400c2084]
cmp dword [0x1400c2094], eax
jne 0x140023baf
cmp byte [0x1400c2080], dil
mov rcx, qword [0x1400c1ef0]
je 0x140023b9c
call fcn.140020740
jmp 0x140023ba1
call fcn.1400205a0
cmp byte [0x1400c2080], dil
sete byte [0x1400c2080]
cmp byte [0x1400c20ad], dil
je 0x140023bc8
mov edx, 0x64
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Beep]
cmp byte [0x1400c1f10], dil
mov rcx, qword [0x1400c1ee8]
je 0x140023bdf
call fcn.140020740
jmp 0x140023be4
call fcn.1400203e0
cmp byte [0x1400c1f10], dil
sete byte [0x1400c1f10]
test dword [0x1400c2088], 0xfffffffd
jne 0x140023c51
mov ecx, dword [0x1400c2084]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140023c51
cmp byte [0x1400c20ad], dil
je 0x140023c27
mov edx, 0x64
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Beep]
cmp byte [0x1400c2080], dil
mov rcx, qword [0x1400c1ef0]
je 0x140023c3e
call fcn.140020740
jmp 0x140023c43
call fcn.1400205a0
cmp byte [0x1400c2080], dil
sete byte [0x1400c2080]
mov ecx, dword [0x1400c21a0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140023cca
cmp byte [0x1400c1f98], dil
je 0x140023ca4
cmp byte [0x1400c219d], dil
je 0x140023c92
mov r8d, 4
mov dword [0x1400c21a0], edi
lea rdx, [0x140097ce0]
lea rcx, [0x1400bf0f0]
call fcn.1400169b0
mov dword [0x1400c204c], edi
mov dword [0x1400bf130], 2
jmp 0x140023cbc
mov rcx, qword [0x1400c1f00]
mov dword [0x1400c2038], edi
mov dword [0x1400bf130], edi
call fcn.1400083a0
cmp byte [0x1400c1f98], dil
sete byte [0x1400c1f98]
mov ecx, dword [0x1400c21a4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140023d0d
mov rax, qword [0x1400c1fa8]
cmp qword [0x1400c1fa0], rax
je 0x140023d0d
cmp byte [0x1400c2058], dil
jne 0x140023cff
mov rcx, qword [0x1400c1f00]
call fcn.140007160
cmp byte [0x1400c2034], dil
sete byte [0x1400c2034]
mov ecx, dword [0x1400c20a8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140024264
cmp byte [0x1400c20a4], dil
mov rcx, qword [0x1400c1f08]
sete al
mov byte [0x1400c20a4], al
test al, al
je 0x140023d48
add rsp, 0x30
pop rdi
pop rbp
pop rbx
jmp fcn.140020480
add rsp, 0x30
pop rdi
pop rbp
pop rbx
jmp fcn.1400206b0
mov qword [rsp + 0x50], rsi
lea rbp, [0x1400bf0f0]
mov qword [rsp + 0x58], r12
mov ebx, 3
mov qword [rsp + 0x60], r13
lea r12, [0x1400bf020]
mov qword [rsp + 0x28], r14
lea r13, [0x1400bf0b0]
mov qword [rsp + 0x20], r15
lea r14, [0x1400bf1a0]
lea r15, [0x1400bf040]
mov esi, ebx
xor edi, edi
nop dword [rax]
cmp qword [0x1400bf058], 0x10
mov rcx, r15
mov r8, qword [0x1400bf050]
cmovae rcx, qword [0x1400bf040]
cmp r8, 2
jne 0x140023e5a
lea rdx, [0x14009b074]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140023e5a
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140023e3b
cmp ebx, 0x1b
jne 0x140023e0c
lea r8d, [rbx - 0x17]
mov rcx, r15
lea rdx, [0x140097ce0]
call fcn.1400169b0
mov byte [0x1400c20d9], dil
mov dword [0x1400c2094], edi
jmp 0x140023e3b
mov rdx, rsi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp r15, rdx
je 0x140023e35
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x140023e2d
mov rdx, qword [rdx]
mov rcx, r15
call fcn.1400169b0
mov dword [0x1400c2094], ebx
cmp qword [0x1400bf058], 0x10
mov rcx, r15
mov r8, qword [0x1400bf050]
cmovae rcx, qword [0x1400bf040]
jmp 0x14002421d
cmp qword [0x1400bf038], 0x10
mov rcx, r12
mov r8, qword [0x1400bf030]
cmovae rcx, qword [0x1400bf020]
cmp r8, 2
jne 0x140023f14
lea rdx, [0x14009b074]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140023f14
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140023ef5
cmp ebx, 0x1b
jne 0x140023ec6
lea r8d, [rbx - 0x17]
mov rcx, r12
lea rdx, [0x140097ce0]
call fcn.1400169b0
mov byte [0x1400c20d9], dil
mov dword [0x1400c2084], edi
jmp 0x140023ef5
mov rdx, rsi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp r12, rdx
je 0x140023eef
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x140023ee7
mov rdx, qword [rdx]
mov rcx, r12
call fcn.1400169b0
mov dword [0x1400c2084], ebx
cmp qword [0x1400bf038], 0x10
mov rcx, r12
mov r8, qword [0x1400bf030]
cmovae rcx, qword [0x1400bf020]
jmp 0x14002421d
cmp qword [0x1400bf0c8], 0x10
mov rcx, r13
mov r8, qword [0x1400bf0c0]
cmovae rcx, qword [0x1400bf0b0]
cmp r8, 2
jne 0x140023fce
lea rdx, [0x14009b074]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140023fce
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140023faf
cmp ebx, 0x1b
jne 0x140023f80
lea r8d, [rbx - 0x17]
mov rcx, r13
lea rdx, [0x140097ce0]
call fcn.1400169b0
mov byte [0x1400c20d9], dil
mov dword [0x1400c2124], edi
jmp 0x140023faf
mov rdx, rsi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp r13, rdx
je 0x140023fa9
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x140023fa1
mov rdx, qword [rdx]
mov rcx, r13
call fcn.1400169b0
mov dword [0x1400c2124], ebx
cmp qword [0x1400bf0c8], 0x10
mov rcx, r13
mov r8, qword [0x1400bf0c0]
cmovae rcx, qword [0x1400bf0b0]
jmp 0x14002421d
cmp qword [0x1400bf108], 0x10
mov rcx, rbp
mov r8, qword [0x1400bf100]
cmovae rcx, qword [0x1400bf0f0]
cmp r8, 2
jne 0x140024088
lea rdx, [0x14009b074]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140024088
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140024069
cmp ebx, 0x1b
jne 0x14002403a
lea r8d, [rbx - 0x17]
mov rcx, rbp
lea rdx, [0x140097ce0]
call fcn.1400169b0
mov byte [0x1400c20d9], dil
mov dword [0x1400c21a0], edi
jmp 0x140024069
mov rdx, rsi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp rbp, rdx
je 0x140024063
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x14002405b
mov rdx, qword [rdx]
mov rcx, rbp
call fcn.1400169b0
mov dword [0x1400c21a0], ebx
cmp qword [0x1400bf108], 0x10
mov rcx, rbp
mov r8, qword [0x1400bf100]
cmovae rcx, qword [0x1400bf0f0]
jmp 0x14002421d
cmp qword [0x1400bf128], 0x10
lea rcx, str.none
mov r8, qword [0x1400bf120]
cmovae rcx, qword [str.none]
cmp r8, 2
jne 0x140024155
lea rdx, [0x14009b074]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140024155
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140024132
cmp ebx, 0x1b
jne 0x1400240fc
lea r8d, [rbx - 0x17]
lea rdx, [0x140097ce0]
lea rcx, str.none
call fcn.1400169b0
mov byte [0x1400c20d9], dil
mov dword [0x1400c21a4], edi
jmp 0x140024132
mov rdx, rsi
lea rax, str.none
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp rax, rdx
je 0x14002412c
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x140024124
mov rdx, qword [rdx]
mov rcx, rax
call fcn.1400169b0
mov dword [0x1400c21a4], ebx
cmp qword [0x1400bf128], 0x10
lea rcx, str.none
mov r8, qword [0x1400bf120]
cmovae rcx, qword [str.none]
jmp 0x14002421d
cmp qword [0x1400bf078], 0x10
lea rcx, [0x1400bf060]
mov r8, qword [0x1400bf070]
cmovae rcx, qword [0x1400bf060]
cmp r8, 2
jne 0x14002423a
lea rdx, [0x14009b074]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14002423a
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400241ff
cmp ebx, 0x1b
jne 0x1400241c9
lea r8d, [rbx - 0x17]
lea rdx, [0x140097ce0]
lea rcx, [0x1400bf060]
call fcn.1400169b0
mov byte [0x1400c20d9], dil
mov dword [0x1400c20a8], edi
jmp 0x1400241ff
mov rdx, rsi
lea rax, [0x1400bf060]
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp rax, rdx
je 0x1400241f9
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x1400241f1
mov rdx, qword [rdx]
mov rcx, rax
call fcn.1400169b0
mov dword [0x1400c20a8], ebx
cmp qword [0x1400bf078], 0x10
lea rcx, [0x1400bf060]
mov r8, qword [0x1400bf070]
cmovae rcx, qword [0x1400bf060]
cmp r8, 2
jne 0x140024233
lea rdx, [0x14009b074]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14002423a
mov byte [0x1400c20d9], dil
inc ebx
inc rsi
cmp ebx, 0xfb
jl 0x140023da0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rbp
pop rbx
ret