Function at 0x140064c60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140129080]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x14020b95c], 0
je 0x140064f4f
cmp dword [0x1401da0d0], 2
jl 0x140064f4f
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor esi, esi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
lea r15, str.command
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r15 + rbx], sil
jne 0x140064cc2
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140064f77
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
cmp rbx, 0x10
jae 0x140064d09
mov qword [rbp - 0x20], rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x30], sil
jmp 0x140064d9d
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140064d42
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400d40b0
test rax, rax
je 0x140064f43
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140064d7f
mov rdi, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140064d6d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140064f7d
jmp 0x140064d23
test rcx, rcx
je 0x140064d7c
call fcn.1400d40b0
mov r14, rax
jmp 0x140064d7f
mov r14, rsi
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov r8, rbx
mov rdx, r15
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], sil
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.140073020
lea rdi, [rbp - 0x30]
mov r8, qword [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdi, r8
lea rcx, [rbp - 0x30]
cmovae rcx, r8
mov r14, qword [rbp - 0x20]
add r14, rcx
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rbx, r8
cmp rbx, r14
je 0x140064e14
sub rdi, rbx
nop dword [rax + rax]
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rdi + rbx], al
inc rbx
cmp rbx, r14
jne 0x140064e00
mov ecx, dword [0x14020fee8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140064f11
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov edx, 0x50
mov r9d, 0x409
lea r8d, [rdx - 0x4f]
call qword [sym.imp.USER32.dll_PostMessageA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movzx ecx, byte [0x1401d8db4]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
movzx ecx, byte [0x1401d8db4]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, reloc.WLDAP32.dll_Ordinal_60
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbp - 0x20], 0
jbe 0x140064eef
mov rbx, rsi
nop word [rax + rax]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movzx ecx, byte [rbx + rcx]
call qword [sym.imp.USER32.dll_keybd_event]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
movzx ecx, byte [rbx + rcx]
call qword [sym.imp.USER32.dll_keybd_event]
cvttss2si rcx, dword [0x14020fe50]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
lea rbx, [rbx + 1]
movsxd rax, esi
cmp rax, qword [rbp - 0x20]
jb 0x140064e90
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_keybd_event]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140064f4f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064f4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064f4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d4350
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4090
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
call fcn.14005b360
int3
call fcn.14000a4c0
int3