Function at 0x1400bef70
Capabilities:
Access peb ldr_data
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x14030d6e8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ecx, dword [0x14030f358]
movabs r13, 0x7fffffffffb3b4bf
mov rax, qword gs:[0x58]
movabs r15, 0x311cdad160000
movsd xmm6, qword [0x14011a1c8]
movabs r12, 0x112e0be826d694b3
mov ebp, 4
xor r14d, r14d
mov rsi, qword [rax + rcx*8]
movabs rdi, 0x7fffffffffffffff
nop
mov eax, dword [0x14030eb34]
cmp eax, dword [rsi + rbp]
jg 0x1400bf48a
cmp byte [0x14030d320], r14b
jne 0x1400bf3a0
cmp eax, dword [rsi + rbp]
jg 0x1400bf4c8
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x1400bf031
imul rax, rax, 0x64
jmp 0x1400bf04c
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r13
jge 0x1400bf058
lea rdi, [rax + 0x4c4b40]
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x1400bf074
imul rbx, rax, 0x64
jmp 0x1400bf090
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
cmp rdi, rbx
je 0x1400bf0f0
jl 0x1400bf0f0
call sub.MSVCP140.dll__Xtime_get_ticks
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x1400bf0b9
add rcx, r15
jmp 0x1400bf0bc
add rcx, rax
mov rax, r12
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x50], rdx
sub ecx, eax
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_sleep
jmp 0x1400bf058
mov ecx, dword [0x1403090ec]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf10e
cmp byte [0x1403090d0], r14b
sete byte [0x1403090d0]
mov ecx, dword [0x140309098]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf12c
cmp byte [0x140309090], r14b
sete byte [0x140309090]
mov ecx, dword [0x1403090ac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf14a
cmp byte [0x1403090a0], r14b
sete byte [0x1403090a0]
mov ecx, dword [0x14030912c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf168
cmp byte [0x140309118], r14b
sete byte [0x140309118]
mov ecx, dword [0x14030910c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf186
cmp byte [0x1403090fc], r14b
sete byte [0x1403090fc]
mov ecx, dword [0x140309154]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf1a4
cmp byte [0x14030913c], r14b
sete byte [0x14030913c]
mov ecx, dword [0x140309168]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf1c2
cmp byte [0x140309158], r14b
sete byte [0x140309158]
mov ecx, dword [0x1403091e0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf1e0
cmp byte [0x1403091cc], r14b
sete byte [0x1403091cc]
mov ecx, dword [0x1403091ac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf1fe
cmp byte [0x1403091a4], r14b
sete byte [0x1403091a4]
mov ecx, dword [0x1403091e8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf21c
cmp byte [0x1403091e4], r14b
sete byte [0x1403091e4]
mov ecx, dword [0x140309204]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf23a
cmp byte [0x140309200], r14b
sete byte [0x140309200]
mov ecx, dword [0x140309258]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf258
cmp byte [0x14030924c], r14b
sete byte [0x14030924c]
mov ecx, dword [0x14030922c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf276
cmp byte [0x140309224], r14b
sete byte [0x140309224]
mov ecx, dword [0x140309248]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf294
cmp byte [0x140309240], r14b
sete byte [0x140309240]
mov ecx, dword [0x1403092a8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf2b2
cmp byte [0x1403092a0], r14b
sete byte [0x1403092a0]
mov ecx, dword [0x14030923c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf2d0
cmp byte [0x140309234], r14b
sete byte [0x140309234]
mov ecx, dword [0x1403092f0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf2ee
cmp byte [0x1403092e8], r14b
sete byte [0x1403092e8]
mov ecx, dword [0x140309300]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf30c
cmp byte [0x1403092f4], r14b
sete byte [0x1403092f4]
mov ecx, dword [0x1403092e4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf32a
cmp byte [0x1403092dc], r14b
sete byte [0x1403092dc]
mov ecx, dword [0x140309310]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400bf348
cmp byte [0x14030930c], r14b
sete byte [0x14030930c]
mov eax, dword [rsi + rbp]
cmp dword [0x14030ea78], eax
jg 0x1400bf4fe
mov ecx, dword [0x14030ea70]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movabs rdi, 0x7fffffffffffffff
test al, 1
je 0x1400beff0
mov eax, dword [0x14030ea78]
cmp eax, dword [rsi + rbp]
jg 0x1400bf5b2
cmp byte [0x14030ea74], r14b
sete dil
cmp eax, dword [rsi + rbp]
jg 0x1400bf3d3
mov byte [0x14030ea74], dil
jmp 0x1400befe4
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140110ce0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [rsp + 0x70]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x14030ea78]
call fcn.140110f60
cmp dword [0x14030ea78], 0xffffffff
jne 0x1400bf394
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xorps xmm0, xmm0
mov qword [0x14030ea68], r14
mov ecx, Ordinal_27
mov qword [rsp + 0x30], rax
movdqu xmmword [0x14030ea58], xmm0
call fcn.140110938
mov r8d, Ordinal_27
mov qword [0x14030ea58], rax
lea rdx, [rsp + 0x20]
mov qword [0x14030ea60], rax
mov rcx, rax
lea rbx, [rax + 0x18]
mov qword [0x14030ea68], rbx
call sub.VCRUNTIME140.dll_memmove
lea rcx, [0x140115c60]
mov qword [0x14030ea60], rbx
mov dword [0x14030ea70], r14d
mov byte [0x14030ea74], r14b
call fcn.140110bb4
lea rcx, [0x14030ea78]
call fcn.140110f00
mov byte [0x14030ea74], dil
jmp 0x1400befe4
lea rcx, [0x14030eb34]
call fcn.140110f60
mov eax, dword [0x14030eb34]
cmp eax, 0xffffffff
jne 0x1400befff
lea rcx, [0x140115ce0]
call fcn.140110bb4
lea rcx, [0x14030eb34]
call fcn.140110f00
mov eax, dword [0x14030eb34]
jmp 0x1400befff
lea rcx, [0x14030eb34]
call fcn.140110f60
cmp dword [0x14030eb34], 0xffffffff
jne 0x1400bf015
lea rcx, [0x140115ce0]
call fcn.140110bb4
lea rcx, [0x14030eb34]
call fcn.140110f00
jmp 0x1400bf015
lea rcx, [0x14030ea78]
call fcn.140110f60
cmp dword [0x14030ea78], 0xffffffff
jne 0x1400bf357
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xorps xmm0, xmm0
mov qword [0x14030ea68], r14
mov ecx, Ordinal_27
mov qword [rsp + 0x48], rax
movdqu xmmword [0x14030ea58], xmm0
call fcn.140110938
mov r8d, Ordinal_27
mov qword [0x14030ea58], rax
lea rdx, [rsp + 0x38]
mov qword [0x14030ea60], rax
mov rcx, rax
lea rbx, [rax + 0x18]
mov qword [0x14030ea68], rbx
call sub.VCRUNTIME140.dll_memmove
lea rcx, [0x140115c60]
mov qword [0x14030ea60], rbx
mov dword [0x14030ea70], r14d
mov byte [0x14030ea74], r14b
call fcn.140110bb4
lea rcx, [0x14030ea78]
call fcn.140110f00
jmp 0x1400bf357
lea rcx, [0x14030ea78]
call fcn.140110f60
mov eax, dword [0x14030ea78]
cmp eax, 0xffffffff
jne 0x1400bf384
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xorps xmm0, xmm0
mov qword [0x14030ea68], r14
mov ecx, Ordinal_27
mov qword [rsp + 0x30], rax
movdqu xmmword [0x14030ea58], xmm0
call fcn.140110938
mov r8d, Ordinal_27
mov qword [0x14030ea58], rax
lea rdx, [rsp + 0x20]
mov qword [0x14030ea60], rax
mov rcx, rax
lea rbx, [rax + 0x18]
mov qword [0x14030ea68], rbx
call sub.VCRUNTIME140.dll_memmove
lea rcx, [0x140115c60]
mov qword [0x14030ea60], rbx
mov dword [0x14030ea70], r14d
mov byte [0x14030ea74], r14b
call fcn.140110bb4
lea rcx, [0x14030ea78]
call fcn.140110f00
mov eax, dword [0x14030ea78]
jmp 0x1400bf384