Function at 0x14004d900
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140103080]
xor rax, rsp
mov qword [rbp + 0xa8], rax
test dl, dl
je 0x14004dfc5
mov ecx, dword [0x140103698]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14004dfc5
mov qword [rsp + 0x1e8], rsi
xor esi, esi
mov qword [rsp + 0x1f0], rdi
movaps xmmword [rsp + 0x1b0], xmm7
movsd xmm7, qword [0x1400ee980]
mov qword [rsp + 0x1e0], rbx
movaps xmmword [rsp + 0x1c0], xmm6
mov rdx, qword [0x140104ae8]
lea r8, [rbp + 0x60]
mov rcx, qword [0x140104b08]
add rdx, 0x90
mov r9d, ntohs
mov byte [0x140103695], 1
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x140104ae8]
lea r8, [rbp + 0x70]
mov rcx, qword [0x140104b08]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp + 0x70]
lea r8, [rsp + 0x30]
mov rcx, qword [0x140104b08]
mov r9d, ntohs
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x38], 0x42c80000
lea rdx, [rdi + 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14004dae9
mov rdx, qword [0x140104ae8]
lea r8, [rsp + 0x40]
mov rcx, qword [0x140104b08]
add rdx, 0x320
mov r9d, ntohs
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140104b10]
lea r8, [rbp + 0x78]
mov rcx, qword [0x140104b08]
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x60]
lea r8, [rbp - 0x60]
movsd xmm2, qword [rbp + 0x60]
mov r9d, ntohs
mov rdx, qword [0x140104ae8]
mov ebx, dword [rbp + 0x68]
add rdx, 0x90
mov rcx, qword [0x140104b08]
cvtps2pd xmm0, xmm0
mov dword [rbp - 0x58], ebx
mov qword [rsp + 0x20], rsi
addsd xmm0, xmm7
cvtpd2ps xmm1, xmm0
movss xmm2, xmm1
movsd qword [rbp + 0x60], xmm2
movaps xmm6, xmm2
movsd qword [rbp - 0x60], xmm2
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140104b08]
lea r8, [rbp - 0x50]
add rdi, 0x50
movsd qword [rbp - 0x50], xmm6
mov rdx, rdi
mov dword [rbp - 0x48], ebx
mov r9d, ntohs
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14004daed
add rdi, 0x50
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14004dbd8
mov rdx, qword [0x140104ae8]
lea r8, [rsp + 0x50]
mov rcx, qword [0x140104b08]
add rdx, 0x320
mov r9d, ntohs
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140104b10]
lea r8, [rbp + 0x80]
mov rcx, qword [0x140104b08]
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x60]
lea r8, [rbp - 0x40]
movsd xmm2, qword [rbp + 0x60]
mov r9d, ntohs
mov rdx, qword [0x140104ae8]
mov ebx, dword [rbp + 0x68]
add rdx, 0x90
mov rcx, qword [0x140104b08]
cvtps2pd xmm0, xmm0
mov dword [rbp - 0x38], ebx
mov qword [rsp + 0x20], rsi
subsd xmm0, xmm7
cvtpd2ps xmm1, xmm0
movss xmm2, xmm1
movsd qword [rbp + 0x60], xmm2
movaps xmm6, xmm2
movsd qword [rbp - 0x40], xmm2
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140104b08]
lea r8, [rbp - 0x30]
mov r9d, ntohs
movsd qword [rbp - 0x30], xmm6
mov rdx, rdi
mov dword [rbp - 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14004dccb
mov rdx, qword [0x140104ae8]
lea r8, [rsp + 0x60]
mov rcx, qword [0x140104b08]
add rdx, 0x320
mov r9d, ntohs
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140104b10]
lea r8, [rbp + 0x88]
mov rcx, qword [0x140104b08]
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsd xmm2, qword [rbp + 0x60]
lea r8, [rbp - 0x20]
movss xmm0, dword [rbp + 0x64]
mov r9d, ntohs
mov rdx, qword [0x140104ae8]
mov ebx, dword [rbp + 0x68]
add rdx, 0x90
mov rcx, qword [0x140104b08]
cvtps2pd xmm0, xmm0
mov dword [rbp - 0x18], ebx
mov qword [rsp + 0x20], rsi
shufps xmm2, xmm2, 0xe1
addsd xmm0, xmm7
cvtpd2ps xmm1, xmm0
movss xmm2, xmm1
shufps xmm2, xmm2, 0xe1
movsd qword [rbp + 0x60], xmm2
movaps xmm6, xmm2
movsd qword [rbp - 0x20], xmm2
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140104b08]
lea r8, [rbp - 0x10]
mov r9d, ntohs
movsd qword [rbp - 0x10], xmm6
mov rdx, rdi
mov dword [rbp - 8], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14004ddbe
mov rdx, qword [0x140104ae8]
lea r8, [rsp + 0x70]
mov rcx, qword [0x140104b08]
add rdx, 0x320
mov r9d, ntohs
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140104b10]
lea r8, [rbp + 0x90]
mov rcx, qword [0x140104b08]
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsd xmm2, qword [rbp + 0x60]
lea r8, [rbp]
movss xmm0, dword [rbp + 0x64]
mov r9d, ntohs
mov rdx, qword [0x140104ae8]
mov ebx, dword [rbp + 0x68]
add rdx, 0x90
mov rcx, qword [0x140104b08]
cvtps2pd xmm0, xmm0
mov dword [rbp + 8], ebx
mov qword [rsp + 0x20], rsi
shufps xmm2, xmm2, 0xe1
subsd xmm0, xmm7
cvtpd2ps xmm1, xmm0
movss xmm2, xmm1
shufps xmm2, xmm2, 0xe1
movsd qword [rbp + 0x60], xmm2
movaps xmm6, xmm2
movsd qword [rbp], xmm2
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140104b08]
lea r8, [rbp + 0x10]
mov r9d, ntohs
movsd qword [rbp + 0x10], xmm6
mov rdx, rdi
mov dword [rbp + 0x18], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14004dea3
mov rdx, qword [0x140104ae8]
lea r8, [rbp - 0x80]
mov rcx, qword [0x140104b08]
add rdx, 0x320
mov r9d, ntohs
mov qword [rbp - 0x80], rsi
mov dword [rbp - 0x78], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140104b10]
lea r8, [rbp + 0x98]
mov rcx, qword [0x140104b08]
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x68]
lea r8, [rbp + 0x20]
movsd xmm2, qword [rbp + 0x60]
mov r9d, ntohs
mov rdx, qword [0x140104ae8]
movaps xmm6, xmm2
mov rcx, qword [0x140104b08]
add rdx, 0x90
cvtps2pd xmm0, xmm0
mov qword [rsp + 0x20], rsi
movsd qword [rbp + 0x20], xmm2
addsd xmm0, xmm7
cvtpd2ps xmm1, xmm0
movd ebx, xmm1
movss dword [rbp + 0x68], xmm1
mov dword [rbp + 0x28], ebx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140104b08]
lea r8, [rbp + 0x30]
mov r9d, ntohs
movsd qword [rbp + 0x30], xmm6
mov rdx, rdi
mov dword [rbp + 0x38], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14004df88
mov rdx, qword [0x140104ae8]
lea r8, [rbp - 0x70]
mov rcx, qword [0x140104b08]
add rdx, 0x320
mov r9d, ntohs
mov qword [rbp - 0x70], rsi
mov dword [rbp - 0x68], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140104b10]
lea r8, [rbp + 0xa0]
mov rcx, qword [0x140104b08]
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0x68]
lea r8, [rbp + 0x40]
movsd xmm2, qword [rbp + 0x60]
mov r9d, ntohs
mov rdx, qword [0x140104ae8]
movaps xmm6, xmm2
mov rcx, qword [0x140104b08]
add rdx, 0x90
cvtps2pd xmm0, xmm0
mov qword [rsp + 0x20], rsi
movsd qword [rbp + 0x40], xmm2
subsd xmm0, xmm7
cvtpd2ps xmm1, xmm0
movd ebx, xmm1
movss dword [rbp + 0x68], xmm1
mov dword [rbp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140104b08]
lea r8, [rbp + 0x50]
mov r9d, ntohs
movsd qword [rbp + 0x50], xmm6
mov rdx, rdi
mov dword [rbp + 0x58], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x140103698]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14004d971
movaps xmm7, xmmword [rsp + 0x1b0]
movaps xmm6, xmmword [rsp + 0x1c0]
mov rdi, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x1e0]
mov byte [0x140103695], 0
mov rcx, qword [rbp + 0xa8]
xor rcx, rsp
call fcn.1400d2300
add rsp, 0x1d0
pop rbp
ret