Function at 0x140050c30
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x140138040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x140175558]
xor esi, esi
mov dword [0x140154550], esi
cmp byte [rax], sil
je 0x140050ec1
cmp byte [0x140175449], sil
je 0x140050ec1
mov rdx, qword [0x140175428]
lea r8, [rsp + 0x30]
mov rcx, qword [0x140175550]
add rdx, 0x140c
mov r9d, 4
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rsp + 0x30]
comiss xmm0, dword [0x1401210d4]
mov rax, qword [0x140175558]
jbe 0x140050cb9
cmp byte [rax + 1], sil
jne 0x140050ec1
movsxd rcx, dword [0x1401754c8]
cmp ecx, 0x28
ja 0x140050ce8
movabs rdx, 0x14000000a00
bt rdx, rcx
jae 0x140050ce8
cmp byte [0x14017544b], sil
jne 0x140050ce8
cmp byte [rax + 8], sil
jne 0x140050ec1
cmp dword [0x1401380c8], esi
jl 0x140050ec1
mov rdx, qword [0x140175428]
lea rax, [rsp + 0x38]
mov rcx, qword [0x140175550]
lea r8, [0x140154550]
add rdx, 0x1458
mov qword [rsp + 0x20], rax
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140050ec1
cmp qword [rsp + 0x38], 4
sete al
test al, al
je 0x140050ec1
mov eax, dword [0x140154550]
cmp eax, 0xffffffff
je 0x140050ec1
mov qword [rsp + 0x60], rbx
mov ecx, eax
mov qword [rsp + 0x68], rdi
call fcn.14008b0f0
mov rcx, qword [0x140175550]
lea r8, [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x30], esi
mov rbx, rax
mov qword [rsp + 0x20], rsi
lea rdx, [rax + 0x344]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140175550]
lea rdx, [rbx + 0x3e3]
mov r9d, 4
mov dword [rsp + 0x38], esi
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [0x140175558]
cmp byte [rax + 0x490], sil
jne 0x140050ddc
mov eax, dword [rsp + 0x38]
cmp dword [0x140175458], eax
je 0x140050dd8
cmp dword [rsp + 0x30], esi
jle 0x140050dd8
mov bl, 1
jmp 0x140050de3
xor bl, bl
jmp 0x140050de3
cmp dword [rsp + 0x30], esi
setg bl
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, qword gs:[0x58]
mov rdi, rax
mov eax, 4
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x140176810], ecx
jle 0x140050e30
lea rcx, [0x140176810]
call fcn.1400f68ac
cmp dword [0x140176810], 0xffffffff
jne 0x140050e30
lea rcx, [0x140176810]
mov qword [0x140176808], rdi
call fcn.1400f6840
test bl, bl
mov rbx, qword [rsp + 0x60]
je 0x140050eb5
mov rax, qword [0x140175558]
cmp byte [rax + 0xb8], sil
je 0x140050eb5
movsxd rcx, dword [0x1401380c8]
lea rdx, [rcx + rcx*8]
cmp byte [rax + rdx*4 + 0xd0], sil
je 0x140050eb5
movsxd rcx, dword [rax + rdx*4 + 0xd4]
mov rax, rdi
sub rax, qword [0x140176808]
cmp rax, rcx
jb 0x140050ebc
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140050eb5
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [0x140176808], rdi
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f62c0
add rsp, 0x50
pop rsi
ret