Function at 0x140070440
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
movzx r12d, r9b
mov r15d, r8d
mov rbx, rdx
mov rbp, rcx
mov rax, qword [rcx + 0x18]
cmp byte [rax + 0x128], 0
je 0x1400704f9
mov eax, dword [0x14047d2c0]
test al, 0x70
jne 0x1400704f5
cmp qword [0x14047d358], 0
je 0x1400704f1
call fcn.140081e90
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edi, ax
shr edi, 0xf
and edi, 1
shl edi, 4
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov esi, edi
or esi, 0x20
and al, 1
cmove esi, edi
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov ecx, esi
or ecx, 0x40
and al, 1
cmove ecx, esi
mov eax, dword [0x14047d2c0]
and eax, 0xffffff8f
or eax, ecx
mov dword [0x14047d2c0], eax
test al, 0x70
je 0x1400704f9
mov al, 1
jmp 0x1400704fb
xor al, al
mov byte [rbp + 0x40], al
mov r13, qword [rbp + 0x18]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14007053c
mov dword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x60], eax
sete r14b
test r14b, r14b
je 0x140070642
jmp 0x14007053f
mov r14b, 1
cmp qword [0x14047d0f8], 0
jne 0x14007063d
cmp byte [r13 + 0x12d], 0
sete r14b
mov rax, qword [0x14047d100]
test rax, rax
jne 0x140070584
mov ecx, 0x128
call fcn.14010a334
mov qword [rsp + 0x28], rax
mov rcx, rax
call fcn.14023c250
nop
mov qword [0x14047d100], rax
mov edi, dword [rax + 0x74]
sub edi, 1
movsxd rsi, edi
js 0x14007063d
test rax, rax
jne 0x1400705b7
mov ecx, 0x128
call fcn.14010a334
mov qword [rsp + 0x28], rax
mov rcx, rax
call fcn.14023c250
nop
mov qword [0x14047d100], rax
cmp edi, dword [rax + 0x74]
jae 0x1400705c6
mov rax, qword [rax + 0x68]
mov rcx, qword [rax + rsi*8]
jmp 0x1400705c8
xor ecx, ecx
mov rax, qword [rcx]
call qword [rax + 0xc0]
test al, al
jne 0x1400705e6
dec edi
sub rsi, 1
js 0x14007063d
mov rax, qword [0x14047d100]
jmp 0x140070593
mov byte [r13 + 0x12d], 1
test r12b, r12b
je 0x14007069b
mov rcx, qword [rbp + 0x18]
mov eax, dword [rcx + 0x160]
add eax, 0xfa
cmp r15d, eax
jbe 0x14007069b
cmp byte [rbp + 0x40], 0
jne 0x14007069b
cmp byte [rsp + 0x80], 0
jne 0x14007069b
mov r8b, 1
mov rdx, rbx
call fcn.1402446a0
mov rcx, qword [rbp + 0x18]
test al, al
je 0x140070673
call fcn.14006fbc0
jmp 0x1400706a6
test r14b, r14b
jne 0x1400705ee
mov rcx, qword [rbp + 0x18]
mov eax, dword [rcx + 0x164]
add eax, 0xa
cmp r15d, eax
jbe 0x1400706a6
mov byte [0x14047d7af], 1
mov rax, qword [rcx + 0xb0]
xor edx, edx
test rax, rax
je 0x140070691
mov rcx, rax
call fcn.14006d980
jmp 0x1400706a6
cmp byte [rcx + 0x128], 0
jne 0x140070685
cmp byte [rcx + 0x12a], 0
jne 0x1400706a6
cmp byte [rsp + 0x88], 0
jne 0x1400706a6
jmp 0x14007065b
xor r8d, r8d
call fcn.14006d840
jmp 0x1400706a6
mov rax, qword [rbp + 0x18]
mov dword [rax + 0x164], r15d
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret