Function at 0x14004f080
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x160
mov rax, qword [0x140063010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov ebx, edx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov esi, eax
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea eax, [rbx - 1]
cmp eax, 5
ja 0x14004f2bb
mov rcx, qword [rdi + 0x18]
sub ebx, 1
je 0x14004f27b
sub ebx, 1
je 0x14004f23b
sub ebx, 2
je 0x14004f1fb
sub ebx, 1
je 0x14004f1b2
cmp ebx, 1
je 0x14004f169
cmp rcx, 0x14
jb 0x14004f158
mov rbx, qword [rdi]
mov qword [rdi + 0x10], 0x14
lea r8d, [rbp + 0x14]
lea rdx, str.Unknown_Mouse_Button
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x14], bpl
jmp 0x14004f4d0
lea r9, str.Unknown_Mouse_Button
mov edx, 0x14
jmp 0x14004f4c8
cmp rcx, 0xf
jb 0x14004f1a1
mov rbx, rdi
cmp rcx, 0x10
jb 0x14004f17b
mov rbx, qword [rdi]
mov qword [rdi + 0x10], 0xf
mov r8d, 0xf
lea rdx, str.X2_Mouse_Button
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xf], 0
jmp 0x14004f4d0
lea r9, str.X2_Mouse_Button
mov edx, 0xf
jmp 0x14004f4c8
cmp rcx, 0xf
jb 0x14004f1ea
mov rbx, rdi
cmp rcx, 0x10
jb 0x14004f1c4
mov rbx, qword [rdi]
mov qword [rdi + 0x10], 0xf
mov r8d, 0xf
lea rdx, str.X1_Mouse_Button
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xf], 0
jmp 0x14004f4d0
lea r9, str.X1_Mouse_Button
mov edx, 0xf
jmp 0x14004f4c8
cmp rcx, 0x13
jb 0x14004f22a
mov rbx, qword [rdi]
mov qword [rdi + 0x10], 0x13
mov r8d, 0x13
lea rdx, str.Middle_Mouse_Button
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x13], 0
jmp 0x14004f4d0
lea r9, str.Middle_Mouse_Button
mov edx, 0x13
jmp 0x14004f4c8
cmp rcx, 0x12
jb 0x14004f26a
mov rbx, qword [rdi]
mov qword [rdi + 0x10], 0x12
mov r8d, 0x12
lea rdx, str.Right_Mouse_Button
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x12], 0
jmp 0x14004f4d0
lea r9, str.Right_Mouse_Button
mov edx, 0x12
jmp 0x14004f4c8
cmp rcx, 0x11
jb 0x14004f2aa
mov rbx, qword [rdi]
mov qword [rdi + 0x10], 0x11
mov r8d, 0x11
lea rdx, str.Left_Mouse_Button
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x14004f4d0
lea r9, str.Left_Mouse_Button
mov edx, 0x11
jmp 0x14004f4c8
shl esi, 0x10
mov r8d, 0x100
lea rdx, [rsp + 0x50]
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
je 0x14004f483
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004f2f0
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14004f4fb
cmp rbx, 0x10
jae 0x14004f341
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 0xf
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x28], 0
mov rsi, qword [rsp + 0x40]
jmp 0x14004f3db
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14004f37a
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140052dd4
test rax, rax
je 0x14004f475
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004f3b7
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004f3a5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004f501
jmp 0x14004f35b
test rcx, rcx
je 0x14004f3b4
call fcn.140052dd4
mov r14, rax
jmp 0x14004f3b7
mov r14, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
lea rax, [rsp + 0x28]
cmp rdi, rax
je 0x14004f441
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14004f41b
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004f416
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004f475
mov rcx, r8
call fcn.140052b7c
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rdi + 0x10], xmm1
mov esi, 0xf
mov byte [rsp + 0x28], 0
cmp rsi, 0x10
jb 0x14004f4d0
lea rdx, [rsi + 1]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f47c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f47c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052b7c
jmp 0x14004f4d0
mov rax, qword [rdi + 0x18]
cmp rax, 7
jb 0x14004f4bc
mov rbx, rdi
cmp rax, 0x10
jb 0x14004f499
mov rbx, qword [rdi]
mov qword [rdi + 0x10], 7
mov r8d, 7
lea rdx, str.Unknown
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x14004f4d0
lea r9, str.Unknown
mov edx, 7
mov rcx, rdi
call fcn.140052890
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400529e0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14004e520
int3
call fcn.14004e480
int3