Function at 0x1400324e0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14003250a
cmp byte [0x14004bac2], 0
sete al
mov byte [0x14004bac2], al
jmp 0x140032511
movzx eax, byte [0x14004bac2]
test al, al
je 0x1400329e8
cmp byte [0x14005f0d0], 0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
jne 0x1400325b7
mov rcx, qword [0x14005ebb0]
mov eax, dword [0x14005ec4c]
cdq
mov byte [0x14005f0d0], 1
and edx, 3
add eax, edx
mov dword [rcx + 0x1af4], 0x43fa0000
sar eax, 2
mov dword [rcx + 0x1af8], 0x43960000
mov dword [rcx + 0x1acc], 1
mov dword [rcx + 0x1ac8], 1
movd xmm1, eax
mov eax, dword [0x14005ec48]
cdq
sub eax, edx
sar eax, 1
cvtdq2ps xmm1, xmm1
movd xmm0, eax
xor eax, eax
subss xmm1, dword [0x1400424fc]
cvtdq2ps xmm0, xmm0
mov qword [rcx + 0x1aec], rax
movss dword [rcx + 0x1ae4], xmm1
subss xmm0, dword [0x1400424f8]
movss dword [rcx + 0x1ae8], xmm0
movabs rax, 0x6e06a0c2ac1cf53b
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x10], rax
movabs rdi, 0x164380a7c56f946d
mov rax, qword [rbp + 0x10]
movabs rbx, 0x6f522d26a626e146
mov qword [rbp - 0x20], rax
xor edx, edx
movabs rax, 0x6f524147c8548432
mov r8d, 0x2b
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.140013840
movabs rax, 0x1643f2c6870df539
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.14002eed0
test al, al
je 0x1400329d9
movabs rax, 0x1630ecc6b01cfd3b
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.14002ff60
test al, al
je 0x140032849
movabs rax, 0x5463f2c2ab1dfb2e
lea rdx, [0x14004bac1]
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x20]
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x20], rax
movabs rax, 0x6f522d26a6269929
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.14002e430
movabs rax, 0x732de9cbb50efa3e
lea rdx, [0x14004bac0]
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x20]
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x20], rax
movabs rax, 0x6f522d26a626e135
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.14002e430
movabs rax, 0x7f22c8d4b600e62e
lea rdx, [0x14004bac4]
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x20]
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x20], rax
movabs rax, 0x6f522d26a626e134
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.14002e430
mov rax, qword [0x14005ebb0]
mov r8, qword [rax + 0x19f8]
cmp byte [r8 + 0x7f], 0
jne 0x140032849
movsxd rcx, dword [rax + 0x1e30]
mov rax, qword [rax + 0x1e38]
mov rdx, qword [rax + rcx*8 - 8]
movsx rax, word [rdx + 0x5a]
imul rcx, rax, 0x1c
mov rax, qword [rdx + 8]
test byte [rcx + rax + 4], 8
jne 0x140032849
dec dword [r8 + 0x1e0]
movabs rax, 0x164380a7a61cfd20
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.14002ff60
test al, al
je 0x1400329d4
movabs rax, 0x6413edc6a01de03e
lea rdx, [0x14004bac3]
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x20]
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x20], rax
movabs rax, 0x6f522d26a6408e29
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.14002e430
test al, al
je 0x140032927
cmp byte [0x14004bac3], 0
mov rcx, qword [0x14005ebf0]
je 0x14003291f
mov edx, 0x11
jmp 0x140032921
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov qword [rbp + 0x10], 0
lea rdx, [rbp + 0x10]
movabs rax, 0x1643e4c6aa03fa38
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x18], rbx
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x18], rdi
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x18], rbx
mov rax, qword [rbp + 0x18]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 8], rax
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.14002d160
test al, al
je 0x140032991
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [0x14005ebb0]
mov r8, qword [rax + 0x19f8]
cmp byte [r8 + 0x7f], 0
jne 0x1400329d4
movsxd rcx, dword [rax + 0x1e30]
mov rax, qword [rax + 0x1e38]
mov rdx, qword [rax + rcx*8 - 8]
movsx rax, word [rdx + 0x5a]
imul rcx, rax, 0x1c
mov rax, qword [rdx + 8]
test byte [rcx + rax + 4], 8
jne 0x1400329d4
dec dword [r8 + 0x1e0]
call fcn.14002f260
call fcn.1400166c0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret