Function at 0x140004ba0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x160
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov ebp, edx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
shr ebx, 0xf
and bl, 1
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r14d, ax
and r14b, 1
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140004c29
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140004c29
mov dl, 1
jmp 0x140004c2b
xor dl, dl
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14000a540]
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x30], sil
lea eax, [rbp - 0x41]
cmp eax, 0x19
ja 0x140004cb5
test r14b, r14b
je 0x140004cab
test bl, bl
jne 0x140004caf
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14000a550]
movsx eax, bpl
movzx eax, al
mov byte [rsp + 0x30], al
mov byte [rsp + 0x31], 0
movups xmm2, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm2
movups xmmword [rdi + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140008c60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
test bl, bl
jne 0x140004c57
add bpl, 0x20
jmp 0x140004c57
cmp ebp, 0x30
jb 0x140004cbf
cmp ebp, 0x39
jbe 0x140004c57
add ebp, 0xfffffff8
cmp ebp, 0xd6
ja case.0x140004ce5.10
lea r8, [0x140000000]
movzx eax, byte [r8 + rbp + 0x52dc]
mov ecx, dword [r8 + rax*4 + 0x527c]
add rcx, r8
jmp rcx
lea rax, [0x14000a450]
lea r14, [0x14000a454]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140004d10
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x14000526d
cmp rbx, 0xf
jbe 0x140005138
mov rcx, rbx
or rcx, 0xf
cmp rcx, rbp
jbe 0x140004d53
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140004d89
mov rbp, rcx
mov eax, 0x16
cmp rcx, rax
cmovb rbp, rax
lea rcx, [rbp + 1]
test rcx, rcx
je 0x1400051bc
cmp rcx, 0x1000
jb 0x1400051b4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005273
mov rcx, rax
call fcn.140008c80
test rax, rax
je 0x1400051ad
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400051bc
test dl, dl
je 0x140004db8
lea r14, str.__23______.__
jmp 0x140004dcc
lea rax, [0x14000a45c]
lea r14, [0x14000a460]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140004de0
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x14000526d
cmp rbx, 0xf
ja 0x140004d37
jmp 0x140005138
test dl, dl
je 0x140004e19
lea r14, [0x14000a464]
jmp 0x140004e2d
lea rax, [0x14000a468]
lea r14, [0x14000a46c]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140004e40
jmp 0x140004dea
lea rax, [0x14000a470]
lea r14, [0x14000a474]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140004e72
jmp 0x140004dea
lea rax, [0x14000a478]
lea r14, [0x14000a47c]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140004eb0
jmp 0x140004dea
lea rax, [0x14000a480]
lea r14, [0x14000a484]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140004ee5
jmp 0x140004dea
lea rax, [0x14000a45c]
lea r14, [0x14000a488]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140004f20
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x14000526d
cmp rbx, 0xf
ja 0x140004d37
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x140004c80
lea rax, [0x14000a48c]
lea r14, [0x14000a490]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140004f90
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x14000526d
cmp rbx, 0xf
jbe 0x140004f47
mov rcx, rbx
or rcx, 0xf
cmp rcx, rbp
jbe 0x140004fcf
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140004ffd
mov rbp, rcx
mov eax, 0x16
cmp rcx, rax
cmovb rbp, rax
lea rcx, [rbp + 1]
test rcx, rcx
je 0x140005024
cmp rcx, 0x1000
jb 0x14000501c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005273
mov rcx, rax
call fcn.140008c80
test rax, rax
je 0x1400051ad
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140005024
call fcn.140008c80
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbp
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
jmp 0x140004c80
lea rax, [0x14000a494]
lea r14, [0x14000a498]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140005070
jmp 0x140004dea
lea rax, [0x14000a49c]
lea r14, [0x14000a4a0]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x1400050a5
jmp 0x140004dea
lea rax, [0x14000a4a4]
lea r14, [0x14000a4a8]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x1400050e0
jmp 0x140004dea
lea rax, [0x14000a4ac]
lea r14, [0x14000a4b0]
test bl, bl
cmovne r14, rax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140005115
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x14000526d
cmp rbx, 0xf
ja 0x14000515b
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x140004c80
mov rcx, rbx
or rcx, 0xf
cmp rcx, rbp
jbe 0x14000517a
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140004d89
mov rbp, rcx
mov eax, 0x16
cmp rcx, rax
cmovb rbp, rax
lea rcx, [rbp + 1]
test rcx, rcx
je 0x1400051bc
cmp rcx, 0x1000
jb 0x1400051b4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005273
jmp 0x140004d89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008c80
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbp
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
jmp 0x140004c80
mov rcx, rdi
call fcn.1400053c0
jmp 0x140004c80
mov rcx, rdi
call fcn.140005650
jmp 0x140004c80
mov rcx, rdi
call fcn.140005ab0
jmp 0x140004c80
mov rcx, rdi
call fcn.140005820
jmp 0x140004c80
mov rcx, rdi
call fcn.140005d30
jmp 0x140004c80
mov rcx, rdi
call fcn.140005f80
jmp 0x140004c80
mov rcx, rdi
call fcn.1400061d0
jmp 0x140004c80
mov rcx, rdi
call fcn.140006460
jmp 0x140004c80
mov rcx, rdi
call fcn.140006600
jmp 0x140004c80
mov rcx, rdi
call fcn.1400067c0
jmp 0x140004c80
mov rcx, rdi
call fcn.140006980
jmp 0x140004c80
call fcn.140001200
int3
call fcn.140001160
int3