Function at 0x140051d80
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x14013e040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x14017b580]
xor esi, esi
mov dword [0x14015a550], esi
cmp byte [rax], sil
je 0x140052011
cmp byte [0x14017b469], sil
je 0x140052011
mov rdx, qword [0x14017b440]
lea r8, [rsp + 0x30]
mov rcx, qword [0x14017b578]
add rdx, 0x140c
mov r9d, 4
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rsp + 0x30]
comiss xmm0, dword [0x140126314]
mov rax, qword [0x14017b580]
jbe 0x140051e09
cmp byte [rax + 1], sil
jne 0x140052011
movsxd rcx, dword [0x14017b4e8]
cmp ecx, 0x28
ja 0x140051e38
movabs rdx, 0x14000000a00
bt rdx, rcx
jae 0x140051e38
cmp byte [0x14017b46b], sil
jne 0x140051e38
cmp byte [rax + 8], sil
jne 0x140052011
cmp dword [0x14013e0c8], esi
jl 0x140052011
mov rdx, qword [0x14017b440]
lea rax, [rsp + 0x38]
mov rcx, qword [0x14017b578]
lea r8, [0x14015a550]
add rdx, 0x1458
mov qword [rsp + 0x20], rax
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140052011
cmp qword [rsp + 0x38], 4
sete al
test al, al
je 0x140052011
mov eax, dword [0x14015a550]
cmp eax, 0xffffffff
je 0x140052011
mov qword [rsp + 0x60], rbx
mov ecx, eax
mov qword [rsp + 0x68], rdi
call fcn.14008fb60
mov rcx, qword [0x14017b578]
lea r8, [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x30], esi
mov rbx, rax
mov qword [rsp + 0x20], rsi
lea rdx, [rax + 0x344]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14017b578]
lea rdx, [rbx + 0x3e3]
mov r9d, 4
mov dword [rsp + 0x38], esi
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [0x14017b580]
cmp byte [rax + 0x500], sil
jne 0x140051f2c
mov eax, dword [rsp + 0x38]
cmp dword [0x14017b478], eax
je 0x140051f28
cmp dword [rsp + 0x30], esi
jle 0x140051f28
mov bl, 1
jmp 0x140051f33
xor bl, bl
jmp 0x140051f33
cmp dword [rsp + 0x30], esi
setg bl
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, qword gs:[0x58]
mov rdi, rax
mov eax, 4
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x14017c830], ecx
jle 0x140051f80
lea rcx, [0x14017c830]
call fcn.1400fb6fc
cmp dword [0x14017c830], 0xffffffff
jne 0x140051f80
lea rcx, [0x14017c830]
mov qword [0x14017c828], rdi
call fcn.1400fb690
test bl, bl
mov rbx, qword [rsp + 0x60]
je 0x140052005
mov rax, qword [0x14017b580]
cmp byte [rax + 0xb8], sil
je 0x140052005
movsxd rcx, dword [0x14013e0c8]
lea rdx, [rcx + rcx*8]
cmp byte [rax + rdx*4 + 0xd0], sil
je 0x140052005
movsxd rcx, dword [rax + rdx*4 + 0xd4]
mov rax, rdi
sub rax, qword [0x14017c828]
cmp rax, rcx
jb 0x14005200c
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140052005
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [0x14017c828], rdi
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400fb110
add rsp, 0x50
pop rsi
ret