Function at 0x1400ce032
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1400f9d30
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x9a8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402f1100]
call fcn.1400d39ab
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d03fa
nop
xor eax, eax
cmp eax, 1
je 0x1400faadb
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400f9dbd
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1e35
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x324], 0xc8
lea rdx, [rbp + 0x324]
lea rcx, [rbp + 0x308]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400f9ec0
movzx eax, byte [0x1402d69e4]
test eax, eax
je 0x1400f9ec0
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x77], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1e35
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
call fcn.1400d19bc
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d03fa
nop
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x28], 2
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x2c], 1
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x30], 1
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x34], 1
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x38], 0
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x3c], 0
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x40], 0
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov dword [rbp + 0x364], 0xc8
lea rdx, [rbp + 0x364]
lea rcx, [rbp + 0x348]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x1400f9ef1
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x72]
test eax, eax
je 0x1400f9f42
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x38], 0
jle 0x1400f9f42
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x76]
test eax, eax
jne 0x1400f9f18
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1435
nop
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x76], 1
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x2c], 1
jne 0x1400f9f3d
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x72], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1aac
nop
jmp 0x1400fa064
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x1400f9f73
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x72]
test eax, eax
je 0x1400f9fc4
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x38], 0
jle 0x1400f9fc4
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x76]
test eax, eax
jne 0x1400f9f9a
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1435
nop
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x76], 1
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x2c], 2
jne 0x1400f9fbf
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x72], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1aac
nop
jmp 0x1400fa064
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400f9fe8
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce77b
nop
jmp 0x1400fa064
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x28], 1
jne 0x1400fa02e
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x1400fa013
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x73]
test eax, eax
je 0x1400fa02e
mov rax, qword [rbp + 0x9a0]
mov edx, dword [rax + 0x14]
mov rax, qword [rbp + 0x9a0]
mov ecx, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_SetCursorPos]
nop
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x72], 0
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x73], 0
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x71], 0
mov rax, qword [rbp + 0x9a0]
mov byte [rax + 0x76], 0
mov dword [0x1402d69e0], 0
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa08b
mov rcx, qword [rbp + 0x9a0]
call fcn.1400cf4c8
nop
jmp 0x1400fa23b
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa0f2
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x2c], 1
jne 0x1400fa0ed
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d2ab5
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x3a4], 0xc8
lea rdx, [rbp + 0x3a4]
lea rcx, [rbp + 0x388]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa23b
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa14c
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d39c9
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x3e4], 0xc8
lea rdx, [rbp + 0x3e4]
lea rcx, [rbp + 0x3c8]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa23b
mov ecx, 9
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa182
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x75]
test eax, eax
jne 0x1400fa182
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d1895
nop
jmp 0x1400fa23b
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa1a9
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d3c99
nop
jmp 0x1400fa23b
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa1f3
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d05df
nop
mov dword [rbp + 0x424], 0xc8
lea rdx, [rbp + 0x424]
lea rcx, [rbp + 0x408]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa23b
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa23b
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d0800
nop
mov dword [rbp + 0x464], 0x64
lea rdx, [rbp + 0x464]
lea rcx, [rbp + 0x448]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x74]
test eax, eax
je 0x1400fa643
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa2aa
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d2213
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x4a4], 0x64
lea rdx, [rbp + 0x4a4]
lea rcx, [rbp + 0x488]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa643
mov ecx, 0x32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa306
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d2213
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x4e4], 0x64
lea rdx, [rbp + 0x4e4]
lea rcx, [rbp + 0x4c8]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa643
mov ecx, 0x33
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa38a
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d022e
nop
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x34], 1
jne 0x1400fa352
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x3c], 0
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x524], 0x32
lea rdx, [rbp + 0x524]
lea rcx, [rbp + 0x508]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa643
mov ecx, 0x34
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa409
mov rax, qword [rbp + 0x9a0]
mov rcx, qword [rbp + 0x9a0]
mov ecx, dword [rcx + 0x38]
cmp dword [rax + 0x34], ecx
jl 0x1400fa3c2
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x38], 0
jne 0x1400fa404
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d022e
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x564], 0x32
lea rdx, [rbp + 0x564]
lea rcx, [rbp + 0x548]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa643
mov ecx, 0x35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa465
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce325
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x5a4], 0xc8
lea rdx, [rbp + 0x5a4]
lea rcx, [rbp + 0x588]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa643
mov ecx, 0x36
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa4ce
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x34], 1
jle 0x1400fa4c9
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce325
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x5e4], 0xc8
lea rdx, [rbp + 0x5e4]
lea rcx, [rbp + 0x5c8]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa643
mov ecx, 0x37
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa52a
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d3a23
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x624], 0x32
lea rdx, [rbp + 0x624]
lea rcx, [rbp + 0x608]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa643
mov ecx, 0x38
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa593
mov rax, qword [rbp + 0x9a0]
cmp dword [rax + 0x2c], 1
jne 0x1400fa568
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d3a23
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x664], 0x32
lea rdx, [rbp + 0x664]
lea rcx, [rbp + 0x648]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa643
mov ecx, 0x39
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa5ec
xor edx, edx
mov rcx, qword [rbp + 0x9a0]
call fcn.1400cffcc
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x6a4], 0xc8
lea rdx, [rbp + 0x6a4]
lea rcx, [rbp + 0x688]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400fa643
mov ecx, 0x30
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa643
mov dl, 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400cffcc
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x6e4], 0xc8
lea rdx, [rbp + 0x6e4]
lea rcx, [rbp + 0x6c8]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
mov rax, qword [rbp + 0x9a0]
movzx eax, byte [rax + 0x75]
test eax, eax
je 0x1400faa5e
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa6be
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 1
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x724], 0x32
lea rdx, [rbp + 0x724]
lea rcx, [rbp + 0x708]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400faa5e
mov ecx, 0x32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa726
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 2
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x764], 0x32
lea rdx, [rbp + 0x764]
lea rcx, [rbp + 0x748]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400faa5e
mov ecx, 0x33
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa78e
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 3
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x7a4], 0x32
lea rdx, [rbp + 0x7a4]
lea rcx, [rbp + 0x788]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400faa5e
mov ecx, 0x34
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa7f6
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 4
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x7e4], 0x32
lea rdx, [rbp + 0x7e4]
lea rcx, [rbp + 0x7c8]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400faa5e
mov ecx, 0x35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa85e
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 5
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x824], 0x32
lea rdx, [rbp + 0x824]
lea rcx, [rbp + 0x808]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400faa5e
mov ecx, 0x36
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa8c6
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 6
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x864], 0x32
lea rdx, [rbp + 0x864]
lea rcx, [rbp + 0x848]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400faa5e
mov ecx, 0x37
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa92e
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 7
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x8a4], 0x32
lea rdx, [rbp + 0x8a4]
lea rcx, [rbp + 0x888]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400faa5e
mov ecx, 0x38
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa996
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 8
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x8e4], 0x32
lea rdx, [rbp + 0x8e4]
lea rcx, [rbp + 0x8c8]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400faa5e
mov ecx, 0x39
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400fa9fb
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 9
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x924], 0x32
lea rdx, [rbp + 0x924]
lea rcx, [rbp + 0x908]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
jmp 0x1400faa5e
mov ecx, 0x30
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400faa5e
mov rax, qword [rbp + 0x9a0]
mov dword [rax + 0x6c], 0xa
mov rcx, qword [rbp + 0x9a0]
call fcn.1400ce4f6
nop
mov rcx, qword [rbp + 0x9a0]
call fcn.1400d37ee
nop
mov dword [rbp + 0x964], 0x32
lea rdx, [rbp + 0x964]
lea rcx, [rbp + 0x948]
call fcn.1400d21aa
mov rcx, rax
call fcn.1400d297a
nop
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400faa7f
mov dword [rbp + 0x974], 1
jmp 0x1400faa89
mov dword [rbp + 0x974], 0
mov rax, qword [rbp + 0x9a0]
movzx ecx, byte [rbp + 0x974]
mov byte [rax + 0x74], cl
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400faabb
mov dword [rbp + 0x974], 1
jmp 0x1400faac5
mov dword [rbp + 0x974], 0
mov rax, qword [rbp + 0x9a0]
movzx ecx, byte [rbp + 0x974]
mov byte [rax + 0x75], cl
jmp 0x1400f9d5d
lea rsp, [rbp + 0x988]
pop rdi
pop rbp
ret