Function at 0x14001d180
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x80
xor r12d, r12d
mov qword [rax + 8], rbp
movzx esi, cx
cmp dword [0x14012b780], r12d
movzx ebp, dl
je 0x14001d1ba
movzx ebx, byte [0x14012990f]
jmp 0x14001d301
cmp qword [0x14012ac08], r12
je 0x14001d1cf
movzx ebx, byte [0x14012aab1]
jmp 0x14001d301
mov ecx, 0xa0
xor bl, bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0x8000
movzx ebx, bl
test di, ax
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
mov ecx, 0xa1
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
je 0x14001d202
or bl, 0x20
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
je 0x14001d215
or bl, 1
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
je 0x14001d228
or bl, 2
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
je 0x14001d23b
or bl, 4
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
je 0x14001d24e
or bl, 8
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
je 0x14001d261
or bl, 0x40
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
je 0x14001d274
or bl, 0x80
cmp qword [0x14012ac08], r12
je 0x14001d301
movzx edi, bl
not dil
and dil, byte [0x14012aab1]
cmp byte [0x14012aab6], r12b
je 0x14001d2b4
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x14012976c]
cmp eax, 0x14
jae 0x14001d2b4
movzx eax, byte [0x14012aab6]
not al
and dil, al
test dil, dil
je 0x14001d301
movzx edx, byte [0x14012aab3]
movzx eax, dil
lea rcx, [0x14012ab00]
not al
and byte [0x14012aab1], al
and byte [0x14012aab2], al
and dl, al
mov byte [0x14012aab3], dl
call fcn.140022460
mov rcx, qword [0x140129900]
test rcx, rcx
je 0x14001d301
test byte [rcx + 0xc], dil
cmovne rcx, r12
mov qword [0x140129900], rcx
xor r9d, r9d
xor r8d, r8d
movzx edx, bl
movzx ecx, bpl
mov dword [rsp + 0x28], 0xffc3d44f
mov byte [rsp + 0x20], 1
call fcn.140021a90
cmp dword [0x14012b780], 1
mov rbp, qword [rsp + 0x90]
mov ebx, 0xffc3d44d
jne 0x14001d4eb
mov rax, qword [0x1401255c8]
mov r8d, dword [0x140129920]
mov edi, ebx
movzx ecx, byte [rax + 0x136]
sub edi, ecx
cmp r8d, dword [0x14012991c]
jne 0x14001d37d
call fcn.140021380
test eax, eax
je 0x14001d4a6
cmp dword [0x14012b780], 1
jne 0x14001d444
mov r8d, dword [0x140129920]
mov rcx, qword [0x140129928]
or byte [0x14012990e], 1
mov eax, r8d
lea rdx, [rax + rax*4]
movzx eax, si
mov word [rcx + rdx*8 + 0xa], ax
mov eax, edi
mov dword [rcx + rdx*8], 1
mov word [rcx + rdx*8 + 8], r12w
mov qword [rcx + rdx*8 + 0xc], 4
mov qword [rcx + rdx*8 + 0x18], rax
inc r8d
mov dword [0x140129920], r8d
mov rax, qword [0x1401255c8]
movzx ecx, byte [rax + 0x136]
sub ebx, ecx
cmp r8d, dword [0x14012991c]
jne 0x14001d3ee
call fcn.140021380
test eax, eax
je 0x14001d55f
mov r8d, dword [0x140129920]
cmp dword [0x14012b780], 1
mov rcx, qword [0x140129928]
mov eax, r8d
jne 0x14001d4b2
or byte [0x14012990e], 1
lea rdx, [rax + rax*4]
movzx eax, si
mov word [rcx + rdx*8 + 0xa], ax
mov eax, ebx
inc r8d
mov dword [rcx + rdx*8], 1
mov word [rcx + rdx*8 + 8], r12w
mov qword [rcx + rdx*8 + 0xc], 6
mov qword [rcx + rdx*8 + 0x18], rax
mov dword [0x140129920], r8d
jmp 0x14001d55f
mov r8d, dword [0x140129920]
mov rcx, qword [0x140129928]
test si, si
jne 0x14001d465
mov dword [rcx + r8*8], r12d
mov dword [rcx + r8*8 + 4], edi
jmp 0x14001d3b7
movzx edx, byte [0x14012990f]
test dl, 3
jne 0x14001d48e
test dl, 0xc
je 0x14001d48e
mov dword [rcx + r8*8], 0x104
mov byte [rcx + r8*8 + 6], r12b
mov word [rcx + r8*8 + 4], si
jmp 0x14001d3b7
mov dword [rcx + r8*8], 0x100
mov byte [rcx + r8*8 + 6], r12b
mov word [rcx + r8*8 + 4], si
jmp 0x14001d3b7
mov r8d, dword [0x140129920]
jmp 0x14001d3c1
test si, si
jne 0x14001d4ce
inc r8d
mov dword [rcx + rax*8], r12d
mov dword [rcx + rax*8 + 4], ebx
mov dword [0x140129920], r8d
jmp 0x14001d55f
inc r8d
mov dword [rcx + rax*8], 0x101
mov byte [rcx + rax*8 + 6], r12b
mov dword [0x140129920], r8d
mov word [rcx + rax*8 + 4], si
jmp 0x14001d55f
mov rdx, qword [0x1401255c8]
mov eax, ebx
mov dword [rsp + 0x30], 1
mov word [rsp + 0x38], r12w
mov word [rsp + 0x3a], si
mov qword [rsp + 0x3c], 4
movzx ecx, byte [rdx + 0x136]
mov dword [rsp + 0x58], 1
mov word [rsp + 0x60], r12w
sub eax, ecx
mov word [rsp + 0x62], si
mov qword [rsp + 0x64], 6
mov qword [rsp + 0x48], rax
movzx eax, byte [rdx + 0x136]
mov r8d, 0x28
sub ebx, eax
lea rdx, [rsp + 0x30]
lea ecx, [r8 - 0x26]
mov eax, ebx
mov qword [rsp + 0x70], rax
call qword [sym.imp.USER32.dll_SendInput]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret