Function at 0x1400171a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x140103040]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xor ebx, ebx
movaps xmmword [r11 - 0x38], xmm8
cmp byte [0x14012d55e], bl
xorps xmm8, xmm8
je 0x140017344
mov rcx, qword [0x14012c390]
xorps xmm0, xmm0
movaps xmmword [r11 - 0x28], xmm7
movss xmm7, dword [0x14012c468]
test rcx, rcx
js 0x1400171fb
cvtsi2ss xmm0, rcx
jmp 0x140017210
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
movss xmm1, dword [0x1400f3638]
addss xmm0, xmm7
xor eax, eax
addss xmm0, dword [0x1400f3570]
comiss xmm0, xmm1
jb 0x140017241
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140017241
movabs rcx, 0x8000000000000000
mov rax, rcx
mov rcx, qword [0x14012d3d0]
lea r8, [rbp - 0x45]
cvttss2si rdx, xmm0
mov r9d, 4
mov dword [rbp - 0x45], ebx
add rdx, rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [0x14012c454], 1
jbe 0x140017327
movss xmm3, dword [0x14012c440]
lea rdx, [rbp - 0x19]
cvtps2pd xmm3, xmm3
mov r8d, 0x28
mov qword [rbp - 0x19], rbx
mov dword [rbp - 9], ebx
mov qword [rbp - 1], rbx
mov dword [rbp - 5], 1
lea ecx, [r8 - 0x27]
mov qword [rbp + 7], rbx
movaps xmmword [rsp + 0xc0], xmm6
movss xmm6, dword [rbp - 0x45]
movaps xmm0, xmm6
subss xmm0, dword [0x14012d3d8]
cvtps2pd xmm1, xmm0
movaps xmm0, xmm7
mulsd xmm1, qword [0x1400f3678]
subss xmm0, dword [0x14012d3dc]
addsd xmm1, xmm1
divsd xmm1, xmm3
divsd xmm1, qword [0x1400f3668]
cvttsd2si eax, xmm1
cvtps2pd xmm1, xmm0
mov dword [rbp - 0x11], eax
mulsd xmm1, qword [0x1400f3678]
addsd xmm1, xmm1
divsd xmm1, xmm3
divsd xmm1, qword [0x1400f3528]
cvttsd2si eax, xmm1
mov dword [rbp - 0xd], eax
call qword [sym.imp.USER32.dll_SendInput]
movss dword [0x14012d3d8], xmm6
movaps xmm6, xmmword [rsp + 0xc0]
jmp 0x140017334
movss xmm0, dword [rbp - 0x45]
movss dword [0x14012d3d8], xmm0
movss dword [0x14012d3dc], xmm7
movaps xmm7, xmmword [rsp + 0xb0]
cmp byte [0x14012d55b], bl
je 0x14001738b
movss xmm0, dword [0x14012c330]
comiss xmm0, xmm8
jbe 0x14001738b
movsxd rdx, dword [0x14012c1fc]
lea rax, [rbp + 0x17]
add rdx, qword [0x14012c390]
lea r8, [rbp - 0x31]
mov rcx, qword [0x14012d3d0]
mov r9d, 4
mov dword [rbp - 0x31], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14012d55f], bl
movaps xmm8, xmmword [rsp + 0xa0]
je 0x140017425
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140017425
movsxd rdx, dword [0x14012c214]
lea rax, [rbp - 0x39]
add rdx, qword [0x140130390]
lea r8, [rbp - 0x49]
mov rcx, qword [0x14012d3d0]
mov r9d, 4
mov dword [rbp - 0x49], 0x10001
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
movsxd rdx, dword [0x14012c214]
lea rax, [rbp - 0x29]
add rdx, qword [0x140130390]
lea r8, [rbp - 0x39]
mov rcx, qword [0x14012d3d0]
mov r9d, 4
mov dword [rbp - 0x39], pe_nt_image_headers64
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14012c268], bl
je 0x140017432
call fcn.140014df0
cmp byte [0x14012c26c], bl
je 0x14001743f
call fcn.140015ad0
cmp byte [0x14012d55d], bl
je 0x14001744c
call fcn.140016360
cmp byte [0x14012d55c], bl
je 0x1400174cc
mov eax, dword [0x14012c260]
lea r8, [rbp - 0x41]
mov rdx, qword [0x14012c298]
mov r9d, 4
mov rcx, qword [0x14012d3d0]
add rdx, 0x210
mov dword [rbp - 0x49], eax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x41], ebx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x14012c450], bl
jne 0x1400174cc
mov eax, dword [rbp - 0x49]
cmp dword [rbp - 0x41], eax
je 0x1400174cc
mov rdx, qword [0x14012c298]
lea rax, [rbp - 0x29]
mov rcx, qword [0x14012d3d0]
lea r8, [rbp - 0x49]
add rdx, 0x210
mov qword [rsp + 0x20], rax
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x14012d560], bl
je 0x1400174f2
cmp byte [0x14012c264], bl
je 0x1400174ed
mov ecx, dword [0x14012bf5c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400174f2
call fcn.140013640
cmp byte [0x14012d55a], bl
je 0x14001755f
call fcn.140004a10
movsxd rdx, dword [0x14012c1f8]
lea rax, [rbp - 0x21]
add rdx, qword [0x140130390]
lea r8, [rbp - 0x31]
mov rcx, qword [0x14012d3d0]
mov r9d, 8
mov qword [rbp - 0x31], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsxd rdx, dword [0x14012c1c0]
lea rax, [rbp - 0x29]
add rdx, qword [rbp - 0x31]
lea r8, [0x14012d408]
mov rcx, qword [0x14012d3d0]
mov r9d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14008acd0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rbp
ret