Function at 0x14003d920
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140126040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov eax, dword [0x14012ae6c]
cmp eax, 1
jbe 0x14003d96e
cmp eax, 2
jne 0x14003d95d
mov ebx, 0x55ffff
jmp 0x14003d973
cmp eax, 3
jne 0x14003d969
mov ebx, 0x6a63fe
jmp 0x14003d973
mov ebx, dword [rbp - 9]
jmp 0x14003d973
mov ebx, 0xfe69eb
mov ecx, dword [0x140126104]
mov eax, dword [0x1401285d0]
cdq
sub eax, edx
sar eax, 1
mov esi, eax
sub esi, ecx
lea r15d, [rax + rcx]
mov ecx, dword [0x140126138]
mov eax, dword [0x1401285c4]
cdq
sub eax, edx
sar eax, 1
mov r14d, eax
sub r14d, ecx
lea edi, [rax + rcx]
mov ecx, dword [0x1401260f8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003dc78
cmp byte [0x14012ae70], 0
je 0x14003dc78
mov qword [rsp + 0xd0], r12
xor ecx, ecx
mov qword [rsp + 0xd8], r13
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ecx, ecx
mov dword [rbp + 7], 0x28
mov r12, rax
mov dword [rsp + 0x28], ecx
xorps xmm0, xmm0
mov dword [rbp + 0x2b], ecx
mov qword [rbp - 0x11], rcx
lea r9, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 7]
sub edi, r14d
mov qword [rbp + 0x13], 0x200001
mov eax, edi
sub r15d, esi
neg eax
mov dword [rbp + 0xb], r15d
xor r8d, r8d
mov dword [rbp + 0xf], eax
mov rcx, r13
movdqu xmmword [rbp + 0x1b], xmm0
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x14003dc54
mov rdx, rax
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, r15d
mov dword [rsp + 0x38], r14d
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
mov qword [rsp + 0x28], r13
mov rcx, r12
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
imul edi, r15d
movsxd r10, edi
test edi, edi
jle 0x14003dc4a
mov r8, qword [rbp - 0x11]
xor edi, edi
mov r9d, edi
movzx r11d, bl
inc r8
movzx ecx, byte [r8 + 1]
sub ecx, r11d
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x5a
jge 0x14003dae7
movzx ecx, byte [r8]
movzx eax, bx
shr eax, 8
sub ecx, eax
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x5a
jge 0x14003dae7
movzx edx, byte [r8 - 1]
mov eax, ebx
shr eax, 0x10
movzx ecx, al
sub edx, ecx
mov eax, edx
neg eax
cmovs eax, edx
cmp eax, 0x5a
jl 0x14003daf8
inc r9
add r8, 4
cmp r9, r10
jl 0x14003daa0
jmp 0x14003dc4a
mov ebx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14003dc4a
mov rcx, qword [0x140126c00]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003db4e
mov edx, dword [0x140126bf8]
lea r9d, [rbx + 0xb]
mov qword [rsp + 0x38], rdi
lea r8, [rbp - 9]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov qword [rbp - 9], rdi
mov word [rbp - 1], bx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbp - 9]
call fcn.14003ca50
mov rbx, qword [rbp - 9]
movabs rax, 0x7ffffffffff0bdbf
cmp rbx, rax
jge 0x14003db73
add rbx, 0xf4240
jmp 0x14003db7d
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp - 9]
call fcn.14003ca50
mov rax, qword [rbp - 9]
cmp rax, rbx
jge 0x14003dbf1
movabs rsi, 0x4e94914f0000
movabs r14, 0x431bde82d7b634db
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jl 0x14003dbb5
mov ecx, 0x5265c00
jmp 0x14003dbda
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003dbd8
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp - 9]
call fcn.14003ca50
mov rax, qword [rbp - 9]
cmp rax, rbx
jl 0x14003dba3
mov rcx, qword [0x140126c00]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003dc36
mov edx, dword [0x140126bf8]
lea r8, [rbp - 9]
mov eax, 2
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rbp - 9], rdi
lea r9d, [rax + 0xa]
mov word [rbp - 1], ax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movsxd rax, dword [0x140126144]
lea rcx, [rbp - 9]
mov qword [rbp - 9], rax
call fcn.14003f900
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r13, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140051fd0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret