Function at 0x140011474
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140015030
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x1400290f2]
call fcn.1400115b4
nop
lea rdx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
lea rcx, [rbp + 8]
call fcn.140011262
nop
lea rcx, [rbp + 8]
call fcn.14001142e
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x64], 0
jmp 0x14001509c
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0xa
jge 0x1400152a1
lea rcx, [rbp + 0x88]
call fcn.1400115a5
nop
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x14
idiv ecx
mov eax, edx
inc eax
mov dword [rbp + 0xc4], eax
mov dword [rbp + 0xe4], 0
jmp 0x1400150e5
mov eax, dword [rbp + 0xe4]
inc eax
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xc4]
cmp dword [rbp + 0xe4], eax
jge 0x14001511f
call qword [sym.imp.ucrtbased.dll_rand]
cdq
idiv dword [rbp + 0x44]
mov eax, edx
cdqe
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14001101e
movzx edx, byte [rax]
lea rcx, [rbp + 0x88]
call fcn.1400112f8
nop
jmp 0x1400150d7
lea rax, [rbp + 0x88]
mov qword [rbp + 0x108], rax
mov rcx, qword [rbp + 0x108]
call fcn.140011028
mov qword [rbp + 0x128], rax
mov rcx, qword [rbp + 0x108]
call fcn.140011050
mov qword [rbp + 0x148], rax
jmp 0x140015166
mov rax, qword [rbp + 0x128]
inc rax
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x148]
cmp qword [rbp + 0x128], rax
je 0x14001525e
mov rax, qword [rbp + 0x128]
movzx eax, byte [rax]
mov byte [rbp + 0x164], al
movsx ax, byte [rbp + 0x164]
movzx ecx, ax
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov word [rbp + 0x184], ax
movsx eax, word [rbp + 0x184]
cmp eax, 0xffffffff
jne 0x1400151b0
jmp 0x140015155
movsx eax, word [rbp + 0x184]
and eax, 0x100
test eax, eax
je 0x1400151cc
mov dword [rbp + 0x274], 1
jmp 0x1400151d6
mov dword [rbp + 0x274], 0
movzx eax, byte [rbp + 0x274]
mov byte [rbp + 0x1a4], al
movzx eax, byte [rbp + 0x1a4]
test eax, eax
je 0x1400151ff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x10
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movzx ecx, byte [rbp + 0x184]
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor r9d, r9d
mov r8d, 2
xor edx, edx
movzx ecx, byte [rbp + 0x184]
call qword [sym.imp.USER32.dll_keybd_event]
nop
movzx eax, byte [rbp + 0x1a4]
test eax, eax
je 0x14001524d
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov cl, 0x10
call qword [sym.imp.USER32.dll_keybd_event]
nop
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x140015155
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov cl, 0xd
call qword [sym.imp.USER32.dll_keybd_event]
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 0x88]
call fcn.140011113
nop
jmp 0x140015094
lea rcx, [rbp + 8]
call fcn.140011113
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ee50]
call fcn.1400114c9
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.1400112b2
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret