Function at 0x1400ce032
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1400f9d20
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x9a8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402f1100]
call fcn.1400d39a6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d03fa
nop
xor eax, eax
cmp eax, 1
je 0x1400faacb
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400f9dad
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1e30
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x324], 0xc8
lea rdx, [rbp + 0x324]
lea rcx, [rbp + 0x308]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400f9eb0
movzx eax, byte [0x1402d69e4]
test eax, eax
je 0x1400f9eb0
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x77], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1e30
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
call fcn.1400d19b7
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d03fa
nop
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x28], 2
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x2c], 1
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x30], 1
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x34], 1
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x38], 0
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x3c], 0
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x40], 0
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov dword [rbp + 0x364], 0xc8
lea rdx, [rbp + 0x364]
lea rcx, [rbp + 0x348]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x1400f9ee1
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x72]
test eax, eax
je 0x1400f9f32
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x38], 0
jle 0x1400f9f32
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x76]
test eax, eax
jne 0x1400f9f08
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1435
nop
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x76], 1
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x2c], 1
jne 0x1400f9f2d
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x72], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1aa7
nop
jmp 0x1400fa054
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x1400f9f63
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x72]
test eax, eax
je 0x1400f9fb4
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x38], 0
jle 0x1400f9fb4
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x76]
test eax, eax
jne 0x1400f9f8a
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1435
nop
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x76], 1
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x2c], 2
jne 0x1400f9faf
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x72], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1aa7
nop
jmp 0x1400fa054
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400f9fd8
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce77b
nop
jmp 0x1400fa054
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x28], 1
jne 0x1400fa01e
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x1400fa003
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x73]
test eax, eax
je 0x1400fa01e
mov rax, qword [rbp + 0x9a0]
mov edx, dword [rax + 0x14]
mov rax, qword [rbp + 0x9a0]
mov ecx, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_SetCursorPos]
nop
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x72], 0
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x73], 0
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x71], 0
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x76], 0
mov dword [0x1402d69e0], 0
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa07b
mov rcx, qword [rbp + 0x9a0]
call fcn.1400cf4c8
nop
jmp 0x1400fa22b
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa0e2
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x2c], 1
jne 0x1400fa0dd
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d2ab0
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x3a4], 0xc8
lea rdx, [rbp + 0x3a4]
lea rcx, [rbp + 0x388]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa22b
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa13c
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d39c4
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x3e4], 0xc8
lea rdx, [rbp + 0x3e4]
lea rcx, [rbp + 0x3c8]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa22b
mov ecx, 9
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa172
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x75]
test eax, eax
jne 0x1400fa172
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1895
nop
jmp 0x1400fa22b
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa199
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d3c94
nop
jmp 0x1400fa22b
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa1e3
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d05df
nop
mov dword [rbp + 0x424], 0xc8
lea rdx, [rbp + 0x424]
lea rcx, [rbp + 0x408]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa22b
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa22b
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d0800
nop
mov dword [rbp + 0x464], 0x64
lea rdx, [rbp + 0x464]
lea rcx, [rbp + 0x448]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x74]
test eax, eax
je 0x1400fa633
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa29a
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d220e
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x4a4], 0x64
lea rdx, [rbp + 0x4a4]
lea rcx, [rbp + 0x488]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa633
mov ecx, 0x32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa2f6
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d220e
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x4e4], 0x64
lea rdx, [rbp + 0x4e4]
lea rcx, [rbp + 0x4c8]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa633
mov ecx, 0x33
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa37a
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d022e
nop
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x34], 1
jne 0x1400fa342
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x3c], 0
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x524], 0x32
lea rdx, [rbp + 0x524]
lea rcx, [rbp + 0x508]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa633
mov ecx, 0x34
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa3f9
mov rax, qword [rbp + 0x9a0]
mov rcx, qword [rbp + 0x9a0]
mov ecx, dword [rcx + 0x38]
cmp dword [rax + 0x34], ecx
jl 0x1400fa3b2
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x38], 0
jne 0x1400fa3f4
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d022e
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x564], 0x32
lea rdx, [rbp + 0x564]
lea rcx, [rbp + 0x548]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa633
mov ecx, 0x35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa455
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce325
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x5a4], 0xc8
lea rdx, [rbp + 0x5a4]
lea rcx, [rbp + 0x588]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa633
mov ecx, 0x36
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa4be
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x34], 1
jle 0x1400fa4b9
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce325
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x5e4], 0xc8
lea rdx, [rbp + 0x5e4]
lea rcx, [rbp + 0x5c8]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa633
mov ecx, 0x37
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa51a
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d3a1e
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x624], 0x32
lea rdx, [rbp + 0x624]
lea rcx, [rbp + 0x608]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa633
mov ecx, 0x38
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa583
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x2c], 1
jne 0x1400fa558
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d3a1e
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x664], 0x32
lea rdx, [rbp + 0x664]
lea rcx, [rbp + 0x648]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa633
mov ecx, 0x39
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa5dc
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400cffcc
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x6a4], 0xc8
lea rdx, [rbp + 0x6a4]
lea rcx, [rbp + 0x688]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400fa633
mov ecx, 0x30
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa633
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400cffcc
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x6e4], 0xc8
lea rdx, [rbp + 0x6e4]
lea rcx, [rbp + 0x6c8]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x75]
test eax, eax
je 0x1400faa4e
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa6ae
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x724], 0x32
lea rdx, [rbp + 0x724]
lea rcx, [rbp + 0x708]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400faa4e
mov ecx, 0x32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa716
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 2
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x764], 0x32
lea rdx, [rbp + 0x764]
lea rcx, [rbp + 0x748]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400faa4e
mov ecx, 0x33
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa77e
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 3
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x7a4], 0x32
lea rdx, [rbp + 0x7a4]
lea rcx, [rbp + 0x788]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400faa4e
mov ecx, 0x34
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa7e6
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 4
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x7e4], 0x32
lea rdx, [rbp + 0x7e4]
lea rcx, [rbp + 0x7c8]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400faa4e
mov ecx, 0x35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa84e
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 5
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x824], 0x32
lea rdx, [rbp + 0x824]
lea rcx, [rbp + 0x808]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400faa4e
mov ecx, 0x36
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa8b6
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 6
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x864], 0x32
lea rdx, [rbp + 0x864]
lea rcx, [rbp + 0x848]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400faa4e
mov ecx, 0x37
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa91e
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 7
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x8a4], 0x32
lea rdx, [rbp + 0x8a4]
lea rcx, [rbp + 0x888]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400faa4e
mov ecx, 0x38
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa986
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 8
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x8e4], 0x32
lea rdx, [rbp + 0x8e4]
lea rcx, [rbp + 0x8c8]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400faa4e
mov ecx, 0x39
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa9eb
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 9
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x924], 0x32
lea rdx, [rbp + 0x924]
lea rcx, [rbp + 0x908]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
jmp 0x1400faa4e
mov ecx, 0x30
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400faa4e
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 0xa
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37e9
nop
mov dword [rbp + 0x964], 0x32
lea rdx, [rbp + 0x964]
lea rcx, [rbp + 0x948]
call fcn.1400d21a5
mov rcx, rax
call fcn.1400d2975
nop
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400faa6f
mov dword [rbp + 0x974], 1
jmp 0x1400faa79
mov dword [rbp + 0x974], 0
mov rax, qword [rbp + 0x9a0]
movzx ecx, byte [rbp + 0x974]
mov byte [rax + 0x74], cl
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400faaab
mov dword [rbp + 0x974], 1
jmp 0x1400faab5
mov dword [rbp + 0x974], 0
mov rax, qword [rbp + 0x9a0]
movzx ecx, byte [rbp + 0x974]
mov byte [rax + 0x75], cl
jmp 0x1400f9d4d
lea rsp, [rbp + 0x988]
pop rdi
pop rbp
ret