Function at 0x140083633
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
jmp 0x1400e1950
mov qword [rsp + 8], rcx
push r13
push rbp
push rdi
sub rsp, 0x6e0
lea r13, [rsp + 0x20]
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x20]
mov ecx, 0x120
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x708]
mov rax, qword [0x1401dd080]
xor rax, r13
mov qword [rbp + 0x690], rax
lea rcx, [0x1401fb175]
call fcn.14008551e
mov rax, qword [r13 + 0x6e0]
movzx eax, byte [rax + 0x160]
test eax, eax
je 0x1400e1a22
lea rax, [rbp + 0x4a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x4c4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x4a4]
movzx r8d, byte [rbp + 0x4c4]
movzx edx, byte [rbp + 0x4e4]
lea rcx, [rbp + 0x520]
call fcn.1400df720
mov rcx, rax
call fcn.140084b64
mov rcx, qword [r13 + 0x6e0]
add rcx, 0x138
mov rdx, rax
call fcn.14008154a
jmp 0x1400e1c0c
mov rax, qword [r13 + 0x6e0]
mov rax, qword [rax + 0x130]
cmp dword [rax], 0
jne 0x1400e1ab3
mov rax, qword [r13 + 0x6e0]
movzx eax, byte [rax + 0x160]
test eax, eax
jne 0x1400e1ab3
lea rax, [rbp + 0x554]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x574]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x554]
movzx r8d, byte [rbp + 0x574]
movzx edx, byte [rbp + 0x594]
lea rcx, [rbp + 0x5c0]
call fcn.1400df840
mov rcx, rax
call fcn.140084c27
mov rcx, qword [r13 + 0x6e0]
add rcx, 0x138
mov rdx, rax
call fcn.14008154a
jmp 0x1400e1c0c
mov rax, qword [r13 + 0x6e0]
mov rax, qword [rax + 0x130]
mov eax, dword [rax]
mov dword [rbp + 4], eax
xor edx, edx
mov ecx, dword [rbp + 4]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rbp + 0x24], eax
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
mov rax, qword [r13 + 0x6e0]
add rax, 0x190
mov qword [rbp + 0x688], rax
lea rdx, [rbp + 4]
mov rcx, qword [rbp + 0x688]
call fcn.1400810f4
lea rdx, [0x140197b5c]
mov rcx, rax
call fcn.140081c43
movzx eax, al
test eax, eax
jne 0x1400e1b5d
mov rax, qword [r13 + 0x6e0]
add rax, 0x190
mov qword [rbp + 0x688], rax
lea rdx, [rbp + 4]
mov rcx, qword [rbp + 0x688]
call fcn.1400810f4
mov rcx, qword [r13 + 0x6e0]
add rcx, 0x138
mov rdx, rax
call fcn.140084e2a
jmp 0x1400e1c0c
mov eax, dword [rbp + 0x24]
shl eax, 0x10
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x50]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
jne 0x1400e1bf3
mov rax, qword [r13 + 0x6e0]
cmp qword [rax + 0x130], 0
je 0x1400e1bf3
lea rax, [rbp + 0x5f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x614]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x5f4]
movzx r8d, byte [rbp + 0x614]
movzx edx, byte [rbp + 0x634]
lea rcx, [rbp + 0x660]
call fcn.1400df900
mov rcx, rax
call fcn.14008502d
mov rcx, qword [r13 + 0x6e0]
add rcx, 0x138
mov rdx, rax
call fcn.14008154a
jmp 0x1400e1c0c
mov rax, qword [r13 + 0x6e0]
add rax, 0x138
lea rdx, [rbp + 0x50]
mov rcx, rax
call fcn.14008154a
lea rcx, [rbp - 0x20]
lea rdx, [0x1401a01c0]
call fcn.140084673
mov rcx, qword [rbp + 0x690]
xor rcx, r13
call fcn.14008289b
lea rsp, [r13 + 0x6c0]
pop rdi
pop rbp
pop r13
ret