Function at 0x1400091e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x14013c040]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r13, rdx
mov qword [rbp - 0x40], rcx
xor edi, edi
mov rbx, qword [0x14013dda0]
mov rax, qword [rbx + 8]
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], edi
mov r15, rbx
cmp byte [rax + 0x19], dil
jne 0x14000925a
mov qword [rbp + 0x20], rax
cmp qword [rax + 0x20], rcx
jae 0x140009247
mov dword [rbp + 0x28], edi
mov rax, qword [rax + 0x10]
jmp 0x140009254
mov dword [rbp + 0x28], 1
mov r15, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], dil
je 0x140009234
nop word [rax + rax]
cmp byte [r15 + 0x19], dil
jne 0x140009270
cmp rcx, qword [r15 + 0x20]
jae 0x1400092ec
movabs rax, 0x555555555555555
cmp qword [0x14013dda8], rax
je 0x1400098e6
lea rsi, [0x14013dda0]
mov qword ds:[rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov ecx, 0x30
call fcn.140096ed0
mov r8, rax
mov rax, qword [rbp - 0x40]
mov qword [r8 + 0x20], rax
xor eax, eax
mov qword [r8 + 0x28], rax
mov dword [r8 + 0x2c], edi
mov qword [r8], rbx
mov qword [r8 + 8], rbx
mov qword [r8 + 0x10], rbx
mov word [r8 + 0x18], ax
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rbp + 0x20]
movaps xmmword [rbp + 0x10], xmm0
lea rdx, [rbp + 0x10]
mov rcx, rsi
call fcn.1400292a0
mov r15, rax
mov rcx, qword [rbp - 0x40]
mov eax, dword [r13]
test eax, eax
jne 0x14000937b
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140009320
mov r8, rbx
mov rdx, rcx
lea rcx, [rbp + 0x20]
call fcn.1400082c0
nop
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.140077e20
movzx ebx, al
lea rcx, [rbp + 0x20]
call fcn.140004ca0
test bl, bl
je 0x140009877
mov dword [r13], edi
mov byte [r15 + 0x28], 1
jmp 0x14000987e
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
mov r8d, 0x100
lea rdx, [rbp + 0x40]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
lea rax, [rbp + 0x40]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400093c0
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x18]
call fcn.140028740
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
lea r12, [rdx + rax*2]
lea r14, [rbp - 0x18]
cmova r14, qword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 0xf
cmp r14, r12
jne 0x140009419
mov byte [rbp - 0x38], 0
jmp 0x14000951d
sub r12, r14
sar r12, 1
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x1400098da
mov esi, 0xf
cmp r12, rsi
jbe 0x1400094e2
mov rsi, r12
or rsi, 0xf
cmp rsi, rax
jbe 0x14000948c
mov rsi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140096ed0
mov rcx, rax
test rax, rax
je 0x1400094b8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x20], rsi
jmp 0x1400094e6
mov eax, 0x16
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400094bf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400098e0
jmp 0x140009466
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
nop
test rcx, rcx
je 0x1400094d4
call fcn.140096ed0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x20], rsi
jmp 0x1400094e6
mov rax, rdi
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x20], rsi
jmp 0x1400094e6
mov rax, qword [rbp - 0x38]
lea r8, [rbp - 0x38]
cmp rsi, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, r12
test r12, r12
je 0x140009514
nop dword [rax]
movzx eax, byte [r14]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea r14, [r14 + 2]
sub rdx, 1
jne 0x140009500
mov qword [rbp - 0x28], r12
mov byte [r8 + r12], 0
cmp dword [rsp + 0x30], 0
jne 0x1400096d3
mov r8d, dword ds:[r13]
lea eax, [r8 - 1]
cmp r8d, 3
cmovge r8d, eax
lea r9, [rbp + 0x35]
test r8d, r8d
jns 0x140009590
neg r8d
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140009550
dec r9
mov byte [r9], 0x2d
jmp 0x1400095ba
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140009590
lea r8, [rbp + 0x35]
mov rdx, r9
lea rcx, [rbp - 0x80]
call fcn.140029a00
nop
movabs rax, 0xe24dda4f558728d6
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
movabs rcx, 0xbb222bd7ebea1cd4
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
movabs rax, 0xe24dda2a26f2479b
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x38]
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
call fcn.140026d00
mov rsi, rax
lea rax, [rbp - 0x38]
cmp rax, rsi
je 0x1400096c0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140009692
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000968d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000968d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009721c
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
lea rcx, [rbp - 0x60]
call fcn.140004ca0
nop
lea rcx, [rbp - 0x80]
call fcn.140004ca0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov rdx, qword [rbp - 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400096f0
mov r8, rbx
lea rcx, [rsp + 0x60]
call fcn.1400082c0
nop
mov r8, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
sub rax, r8
mov r12d, 3
lea r14, [0x14011e0cc]
cmp rax, r12
jb 0x1400097ac
lea rax, [r8 + 3]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x60]
lea rax, [0x14011e0cf]
cmp rax, rbx
jbe 0x14000976c
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14000976c
cmp rbx, r14
ja 0x140009764
mov rsi, rdi
jmp 0x14000976f
mov rsi, rbx
sub rsi, r14
jmp 0x14000976f
mov rsi, r12
inc r8
lea rcx, [rbx + 3]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r12, rsi
lea rdx, [r14 + 3]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x60]
jmp 0x1400097c5
mov qword ss:[rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14002b820
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x20]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp - 0x38]
call fcn.1400269a0
nop
lea rcx, [rbp + 0x20]
call fcn.140004ca0
nop
lea rcx, [rsp + 0x60]
call fcn.140004ca0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rcx, qword [rbp - 0x38]
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x30]
call fcn.140077e20
test al, al
je 0x140009864
mov dword [r13], edi
mov byte [r15 + 0x28], 1
lea rcx, [rbp - 0x38]
call fcn.140004ca0
nop
lea rcx, [rbp - 0x18]
call fcn.140004c20
cmp byte [r15 + 0x28], 0
je 0x1400098b0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400098b0
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400098a6
mov dword [r13], edi
mov byte [r15 + 0x28], 0
inc edi
cmp edi, 0x100
jl 0x140009890
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140096d90
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400057e0
nop
call fcn.1400044a0
nop
call fcn.140008240
int3