Function at 0x14001126c
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
jmp 0x1400117c0
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001d008]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x14002209f]
call fcn.140011370
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
lea rcx, str.consoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbp + 8], rax
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp + 0x24], 1
mov dword [rbp + 0x48], 1
xor eax, eax
mov word [rbp + 0x52], ax
mov dword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov dword [rbp + 0x54], 0
mov r8d, 0x50
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.1400112c1
mov eax, 0x28
imul rax, rax, 0
mov dword [rbp + rax + 0x90], 1
mov eax, 0x28
imul rax, rax, 1
mov dword [rbp + rax + 0x90], 1
xor eax, eax
cmp eax, 1
je 0x140011d65
cmp dword [rbp + 0x24], 0
je 0x1400118cc
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400118cc
mov eax, 0x31
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011905
mov ecx, 0x32
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011905
mov eax, 0x32
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x14001193e
mov ecx, 0x33
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14001193e
mov eax, 0x33
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011977
mov ecx, 0x34
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011977
mov eax, 0x34
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x1400119b0
mov ecx, 0x35
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400119b0
mov eax, 0x35
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x1400119e9
mov ecx, 0x51
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400119e9
mov eax, 0x51
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011a22
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011a22
mov eax, 0x45
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011a5b
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011a5b
mov eax, 0x46
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011a94
mov ecx, 0x54
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011a94
mov eax, 0x54
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011acd
mov ecx, 0x47
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011acd
mov eax, 0x47
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011b5a
mov ecx, 0x48
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011b5a
mov ecx, 0x48
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011b5a
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011b5a
mov eax, 0x28
imul rax, rax, 0
mov ecx, 0xa0
mov word [rbp + rax + 0x98], cx
mov eax, 0x28
imul rax, rax, 1
mov ecx, 0x48
mov word [rbp + rax + 0x98], cx
mov r8d, 0x28
lea rdx, [rbp + 0x90]
mov ecx, 2
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011b93
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011b93
mov eax, 0x43
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011bcc
mov ecx, 0x56
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011bcc
mov eax, 0x56
mov word [rbp + 0x50], ax
mov r8d, 0x28
lea rdx, [rbp + 0x48]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011c59
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011c59
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011c59
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011c59
mov eax, 0x28
imul rax, rax, 0
mov ecx, 0xa0
mov word [rbp + rax + 0x98], cx
mov eax, 0x28
imul rax, rax, 1
mov ecx, 0x58
mov word [rbp + rax + 0x98], cx
mov r8d, 0x28
lea rdx, [rbp + 0x90]
mov ecx, 2
call qword [sym.imp.USER32.dll_SendInput]
cmp dword [rbp + 0x24], 0
je 0x140011ce6
mov ecx, 0x52
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011ce6
mov ecx, 0x52
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011ce6
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011ce6
mov eax, 0x28
imul rax, rax, 0
mov ecx, 0xa0
mov word [rbp + rax + 0x98], cx
mov eax, 0x28
imul rax, rax, 1
mov ecx, 0x52
mov word [rbp + rax + 0x98], cx
mov r8d, 0x28
lea rdx, [rbp + 0x90]
mov ecx, 2
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011d55
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011d55
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140011d55
cmp dword [rbp + 0x24], 0
jne 0x140011d37
mov dword [rbp + 0x1a4], 1
jmp 0x140011d41
mov dword [rbp + 0x1a4], 0
mov eax, dword [rbp + 0x1a4]
mov dword [rbp + 0x24], eax
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140011888
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac40]
call fcn.14001130c
mov eax, edi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.1400111ae
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret