Function at 0x140001570
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r12d, ax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r13d, ax
test ax, ax
setne byte [rsp + 0x48]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xffff8001
mov r15d, 0x41
movabs r14, 0x8000000000000000
nop dword [rax + rax]
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, di
jne 0x1400017c5
xor bl, bl
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000161c
test r12w, r12w
je 0x140001622
jmp 0x140001624
test r12w, r12w
je 0x140001624
mov bl, 1
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov edi, 1
mov qword [rbp + 0x10], rdi
mov edx, 0xf
mov qword [rbp + 0x18], rdx
movsx eax, r15b
movzx eax, al
mov byte [rbp], al
mov byte [rbp + 1], 0
mov rcx, qword [rbp]
test bl, bl
jne 0x14000169a
lea rsi, [rbp]
lea r14, [rbp]
add r14, rdi
lea rbx, [rbp]
cmp rbx, r14
je 0x140001690
sub rsi, rbx
nop word [rax + rax]
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx + rsi], al
inc rbx
cmp rbx, r14
jne 0x140001670
mov rdx, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x10]
mov rcx, qword [rbp]
movabs r14, 0x8000000000000000
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r8d, r8d
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r8
lea rsi, [rbp]
cmp rdx, 0xf
cmova rsi, rcx
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x1400020bb
cmp rdi, 0xf
ja 0x1400016ef
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x50], xmm0
jmp 0x14000177a
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140001704
mov rbx, rax
lea rax, [r14 + 0x27]
jmp 0x14000172b
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000174d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400020c1
mov rcx, rax
call fcn.1400039e0
mov rcx, rax
test rax, rax
je 0x140001841
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000175c
test rcx, rcx
je 0x140001759
call fcn.1400039e0
jmp 0x14000175c
mov rax, r8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x50]
call fcn.140001290
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400017c0
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001848
call fcn.140003a1c
mov edi, 0xffff8001
inc r15d
cmp r15d, 0x5a
jle 0x1400015f0
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, di
jne 0x1400017fa
test r13w, r13w
sete r14b
mov byte [rsp + 0x48], r14b
mov ebx, 0x30
lea r15, [0x140000000]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, di
jne case.default.0x14000183f
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ecx, [rbx - 0x30]
cmp ecx, 9
ja case.default.0x14000183f
lea ecx, [rbx - 0x30]
movsxd rdx, ecx
mov ecx, dword [r15 + rdx*4 + 0x20c8]
add rcx, r15
jmp rcx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
test ax, ax
je 0x140001883
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], 0xf
mov word [rsp + 0x50], 0x29
lea rcx, [rsp + 0x50]
call fcn.140001290
inc ebx
jmp 0x140001806
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x30
lea rcx, [rsp + 0x28]
call fcn.140001290
inc ebx
jmp 0x140001806
test ax, ax
je 0x1400018ec
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x21
lea rax, [rsp + 0x28]
mov rcx, rax
call fcn.140001290
inc ebx
jmp 0x140001806
lea rdx, str.123456789:____________.
lea rcx, [rsp + 0x50]
call fcn.1400030f0
mov rcx, rax
call fcn.140001290
inc ebx
jmp 0x140001806
test ax, ax
je 0x140001946
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x40
lea rax, [rsp + 0x28]
mov rcx, rax
call fcn.140001290
inc ebx
jmp 0x140001806
lea rdx, [0x14000550c]
jmp 0x1400018f3
test ax, ax
je 0x140001989
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x23
lea rax, [rsp + 0x28]
mov rcx, rax
call fcn.140001290
inc ebx
jmp 0x140001806
lea rdx, [0x140005510]
jmp 0x1400018f3
test ax, ax
je 0x1400019cf
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x24
lea rax, [rsp + 0x28]
mov rcx, rax
call fcn.140001290
inc ebx
jmp 0x140001806
lea rdx, [0x140005514]
jmp 0x1400018f3
test ax, ax
je 0x140001a15
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x25
lea rax, [rsp + 0x28]
mov rcx, rax
call fcn.140001290
inc ebx
jmp 0x140001806
lea rdx, [0x140005518]
jmp 0x1400018f3
test ax, ax
je 0x140001a5b
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x5e
lea rax, [rsp + 0x28]
mov rcx, rax
call fcn.140001290
inc ebx
jmp 0x140001806
lea rdx, [0x14000551c]
jmp 0x1400018f3
test ax, ax
je 0x140001aa1
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x26
lea rax, [rsp + 0x28]
mov rcx, rax
call fcn.140001290
inc ebx
jmp 0x140001806
lea rdx, [0x140005520]
jmp 0x1400018f3
test ax, ax
je 0x140001ae7
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x2a
lea rax, [rsp + 0x28]
mov rcx, rax
call fcn.140001290
inc ebx
jmp 0x140001806
lea rdx, [0x140005524]
jmp 0x1400018f3
inc ebx
cmp ebx, 0x39
jle 0x140001806
jmp 0x140001b46
test ax, ax
je 0x140001b2d
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xf
mov word [rsp + 0x28], 0x28
lea rcx, [rsp + 0x28]
jmp 0x140001b41
lea rdx, [0x140005528]
lea rcx, [rsp + 0x50]
call fcn.1400030f0
mov rcx, rax
call fcn.140001290
movdqa xmm0, xmmword [0x1400056e0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400056d0]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0xbc
mov dword [rbp - 0x6c], 0xbd
mov dword [rbp - 0x68], 0xbe
xor esi, esi
lea rdi, [rsp + 0x70]
lea r12, [0x14000552c]
lea r13, [0x140005534]
lea r14, [0x14000553c]
mov ebx, dword [rdi]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0xffff8001
cmp ax, cx
jne case.0x140001bdb.197
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
add ebx, 0xffffff46
cmp ebx, 0x24
ja case.0x140001bdb.197
movsxd rcx, ebx
movzx ecx, byte [r15 + rcx + 0x2120]
mov edx, dword [r15 + rcx*4 + 0x20f0]
add rdx, r15
jmp rdx
lea rdx, [0x140005530]
test ax, ax
cmovne rdx, r12
jmp 0x140001cb3
lea rdx, [0x140005538]
test ax, ax
cmovne rdx, r13
jmp 0x140001cb3
lea rdx, [0x140005540]
test ax, ax
cmovne rdx, r14
jmp 0x140001cb3
lea rdx, [0x140005548]
test ax, ax
lea rax, [0x140005544]
jmp 0x140001caf
lea rdx, [0x140005550]
test ax, ax
lea rax, [0x14000554c]
jmp 0x140001caf
lea rdx, [0x140005558]
test ax, ax
lea rax, [0x140005554]
jmp 0x140001caf
lea rdx, [0x140005560]
test ax, ax
lea rax, [0x14000555c]
jmp 0x140001caf
lea rdx, [0x140005568]
test ax, ax
lea rax, [0x140005564]
jmp 0x140001caf
lea rdx, [0x140005570]
test ax, ax
lea rax, [0x14000556c]
jmp 0x140001caf
lea rdx, [0x140005578]
test ax, ax
lea rax, [0x140005574]
jmp 0x140001caf
lea rdx, [0x140005580]
test ax, ax
lea rax, [0x14000557c]
cmovne rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400030f0
mov rcx, rax
call fcn.140001290
inc esi
add rdi, 4
cmp esi, 0xb
jb 0x140001b92
movdqa xmm0, xmmword [0x140005690]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400056a0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [str.hi__b___abcdefg_r_tnlkmjo]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x140005680]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x1400056b0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1400056c0]
movdqa xmmword [rbp - 0x10], xmm1
xor r13d, r13d
mov edi, r13d
lea rsi, [rbp - 0x60]
movabs r12, 0x3e2f54484749523c
movzx r14d, byte [rsp + 0x48]
nop dword [rax]
mov ebx, dword [rsi]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0xffff8001
cmp ax, cx
jne case.0x140001d7a.32
lea eax, [rbx - 8]
cmp eax, 0x67
ja case.0x140001d7a.32
cdqe
movzx eax, byte [r15 + rax + 0x21ac]
mov ecx, dword [r15 + rax*4 + 0x2148]
add rcx, r15
jmp rcx
test r14b, r14b
je case.0x140001d7a.15
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x32
jmp 0x140002063
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x68], 0xf
mov rax, qword [str._DOWN__]
mov dword [rsp + 0x50], eax
movzx eax, word [0x14000558c]
mov word [rsp + 0x54], ax
movzx eax, byte [0x14000558e]
mov byte [rsp + 0x56], al
mov byte [rsp + 0x57], r13b
lea rcx, [rsp + 0x50]
jmp 0x14000207a
test r14b, r14b
je case.0x140001d7a.12
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x34
jmp 0x140002063
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x68], 0xf
mov rax, qword [str._LEFT__]
mov dword [rsp + 0x50], eax
movzx eax, word [0x140005594]
mov word [rsp + 0x54], ax
movzx eax, byte [0x140005596]
mov byte [rsp + 0x56], al
mov byte [rsp + 0x57], r13b
lea rcx, [rsp + 0x50]
jmp 0x14000207a
xorps xmm0, xmm0
test r14b, r14b
je 0x140001e57
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x36
jmp 0x140002063
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 8
mov qword [rsp + 0x68], 0xf
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x58], r13b
lea rcx, [rsp + 0x50]
jmp 0x14000207a
xorps xmm0, xmm0
test r14b, r14b
je 0x140001fee
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x38
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x30
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x31
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x33
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x35
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x37
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x39
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x2e
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x2c
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x2b
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x2d
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x2a
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x2f
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0x20
jmp 0x140002063
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x68], 0xf
mov rax, qword [str._BACK__]
mov dword [rsp + 0x50], eax
movzx eax, word [0x1400055a4]
mov word [rsp + 0x54], ax
movzx eax, byte [0x1400055a6]
mov byte [rsp + 0x56], al
mov byte [rsp + 0x57], r13b
lea rcx, [rsp + 0x50]
jmp 0x14000207a
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 5
mov qword [rsp + 0x68], 0xf
mov eax, dword [str._UP__]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14000559c]
mov byte [rsp + 0x54], al
mov byte [rsp + 0x55], r13b
lea rcx, [rsp + 0x50]
jmp 0x14000207a
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 8
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x30], r13b
jmp 0x14000206c
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 0xa
jmp 0x140002063
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], 9
mov qword [rsp + 0x38], 1
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x40], 0xf
call fcn.140001290
inc edi
add rsi, 4
cmp edi, 0x18
jb 0x140001d40
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400039c0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3