Function at 0x1400c2790
Capabilities:
Access peb ldr_data
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x140287748]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ecx, dword [0x140289fe0]
movabs rdi, 0x7fffffffffffffff
mov rax, qword gs:[0x58]
movabs r13, 0x7ffffffffd050f7f
movsd xmm6, qword [0x140186410]
movabs r15, 0x311cdad160000
mov ebp, 4
movabs r12, 0x112e0be826d694b3
xor r14d, r14d
mov rsi, qword [rax + rcx*8]
nop
mov eax, dword [0x140288d24]
cmp eax, dword [rsi + rbp]
jg 0x1400c2cc1
cmp byte [0x1401ec380], r14b
jne 0x1400c2bde
cmp eax, dword [rsi + rbp]
jg 0x1400c2cff
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x1400c2851
imul rax, rax, 0x64
jmp 0x1400c286c
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r13
jge 0x1400c2878
lea rdi, [rax + 0x2faf080]
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x1400c2894
imul rbx, rax, 0x64
jmp 0x1400c28b0
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
cmp rdi, rbx
je 0x1400c2910
jl 0x1400c2910
call sub.MSVCP140.dll__Xtime_get_ticks
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x1400c28d9
add rcx, r15
jmp 0x1400c28dc
add rcx, rax
mov rax, r12
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x50], rdx
sub ecx, eax
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_sleep
jmp 0x1400c2878
mov ecx, dword [0x1401ea0ec]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c292e
cmp byte [0x1401ea0d0], r14b
sete byte [0x1401ea0d0]
mov ecx, dword [0x1401ea098]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c294c
cmp byte [0x1401ea090], r14b
sete byte [0x1401ea090]
mov ecx, dword [0x1401ea0ac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c296a
cmp byte [0x1401ea0a0], r14b
sete byte [0x1401ea0a0]
mov ecx, dword [0x1401ea12c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2988
cmp byte [0x1401ea118], r14b
sete byte [0x1401ea118]
mov ecx, dword [0x1401ea10c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c29a6
cmp byte [0x1401ea0fc], r14b
sete byte [0x1401ea0fc]
mov ecx, dword [0x1401ea154]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c29c4
cmp byte [0x1401ea13c], r14b
sete byte [0x1401ea13c]
mov ecx, dword [0x1401ea164]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c29e2
cmp byte [0x1401ea158], r14b
sete byte [0x1401ea158]
mov ecx, dword [0x1401ea204]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2a00
cmp byte [0x1401ea1f0], r14b
sete byte [0x1401ea1f0]
mov ecx, dword [0x1401ea1c8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2a1e
cmp byte [0x1401ea1c0], r14b
sete byte [0x1401ea1c0]
mov ecx, dword [0x1401ea20c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2a3c
cmp byte [0x1401ea208], r14b
sete byte [0x1401ea208]
mov ecx, dword [0x1401ea22c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2a5a
cmp byte [0x1401ea228], r14b
sete byte [0x1401ea228]
mov ecx, dword [0x1401ea284]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2a78
cmp byte [0x1401ea278], r14b
sete byte [0x1401ea278]
mov ecx, dword [0x1401ea258]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2a96
cmp byte [0x1401ea250], r14b
sete byte [0x1401ea250]
mov ecx, dword [0x1401ea274]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2ab4
cmp byte [0x1401ea26c], r14b
sete byte [0x1401ea26c]
mov ecx, dword [0x1401ea2dc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2ad2
cmp byte [0x1401ea2d4], r14b
sete byte [0x1401ea2d4]
mov ecx, dword [0x1401ea268]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2af0
cmp byte [0x1401ea260], r14b
sete byte [0x1401ea260]
mov ecx, dword [0x1401ea32c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2b0e
cmp byte [0x1401ea324], r14b
sete byte [0x1401ea324]
mov ecx, dword [0x1401ea33c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2b2c
cmp byte [0x1401ea330], r14b
sete byte [0x1401ea330]
mov ecx, dword [0x1401ea320]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2b4a
cmp byte [0x1401ea318], r14b
sete byte [0x1401ea318]
mov ecx, dword [0x1401ea34c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2b68
cmp byte [0x1401ea348], r14b
sete byte [0x1401ea348]
mov eax, dword [rsi + rbp]
cmp dword [0x140289c50], eax
jg 0x1400c2d35
mov ecx, dword [0x140289c48]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400c2bad
mov eax, dword [0x140289c50]
cmp eax, dword [rsi + rbp]
jg 0x1400c2de9
cmp byte [0x140289c4c], r14b
sete dil
cmp eax, dword [rsi + rbp]
jg 0x1400c2c11
mov byte [0x140289c4c], dil
mov ecx, dword [0x1401ec37c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movabs rdi, 0x7fffffffffffffff
test al, 1
je 0x1400c2810
cmp byte [0x1401ec378], r14b
sete byte [0x1401ec378]
jmp 0x1400c2810
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401140d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [rsp + 0x70]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x140289c50]
call fcn.140114270
cmp dword [0x140289c50], 0xffffffff
jne 0x1400c2ba6
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xorps xmm0, xmm0
mov qword [0x140289c40], r14
mov ecx, Ordinal_26
mov qword [rsp + 0x30], rax
movdqu xmmword [0x140289c30], xmm0
call fcn.140113d28
mov r8d, Ordinal_26
mov qword [0x140289c30], rax
lea rdx, [rsp + 0x20]
mov qword [0x140289c38], rax
mov rcx, rax
lea rbx, [rax + 0x18]
mov qword [0x140289c40], rbx
call sub.VCRUNTIME140.dll_memmove
lea rcx, [0x140182750]
mov qword [0x140289c38], rbx
mov dword [0x140289c48], r14d
mov byte [0x140289c4c], r14b
call fcn.140113fa4
lea rcx, [0x140289c50]
call fcn.140114204
jmp 0x1400c2ba6
lea rcx, [0x140288d24]
call fcn.140114270
mov eax, dword [0x140288d24]
cmp eax, 0xffffffff
jne 0x1400c281f
lea rcx, [0x1401821e0]
call fcn.140113fa4
lea rcx, [0x140288d24]
call fcn.140114204
mov eax, dword [0x140288d24]
jmp 0x1400c281f
lea rcx, [0x140288d24]
call fcn.140114270
cmp dword [0x140288d24], 0xffffffff
jne 0x1400c2835
lea rcx, [0x1401821e0]
call fcn.140113fa4
lea rcx, [0x140288d24]
call fcn.140114204
jmp 0x1400c2835
lea rcx, [0x140289c50]
call fcn.140114270
cmp dword [0x140289c50], 0xffffffff
jne 0x1400c2b77
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xorps xmm0, xmm0
mov qword [0x140289c40], r14
mov ecx, Ordinal_26
mov qword [rsp + 0x48], rax
movdqu xmmword [0x140289c30], xmm0
call fcn.140113d28
mov r8d, Ordinal_26
mov qword [0x140289c30], rax
lea rdx, [rsp + 0x38]
mov qword [0x140289c38], rax
mov rcx, rax
lea rbx, [rax + 0x18]
mov qword [0x140289c40], rbx
call sub.VCRUNTIME140.dll_memmove
lea rcx, [0x140182750]
mov qword [0x140289c38], rbx
mov dword [0x140289c48], r14d
mov byte [0x140289c4c], r14b
call fcn.140113fa4
lea rcx, [0x140289c50]
call fcn.140114204
jmp 0x1400c2b77
lea rcx, [0x140289c50]
call fcn.140114270
mov eax, dword [0x140289c50]
cmp eax, 0xffffffff
jne 0x1400c2b96
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xorps xmm0, xmm0
mov qword [0x140289c40], r14
mov ecx, Ordinal_26
mov qword [rsp + 0x30], rax
movdqu xmmword [0x140289c30], xmm0
call fcn.140113d28
mov r8d, Ordinal_26
mov qword [0x140289c30], rax
lea rdx, [rsp + 0x20]
mov qword [0x140289c38], rax
mov rcx, rax
lea rbx, [rax + 0x18]
mov qword [0x140289c40], rbx
call sub.VCRUNTIME140.dll_memmove
lea rcx, [0x140182750]
mov qword [0x140289c38], rbx
mov dword [0x140289c48], r14d
mov byte [0x140289c4c], r14b
call fcn.140113fa4
lea rcx, [0x140289c50]
call fcn.140114204
mov eax, dword [0x140289c50]
jmp 0x1400c2b96