Function at 0x14001bff0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x280
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
movzx esi, byte [rbp]
xor r14b, r14b
xor r15b, r15b
movabs rdi, 0x7ffffffff70f2e7f
xor r12d, r12d
movabs r13, 0x7fffffffffffffff
movabs rdx, 0x1d1488639c67a2ce
movabs r8, 0xb106b6f549129208
mov qword [rbp + 8], r8
movabs r9, 0x797b601f297aaa9
mov rax, qword [rbp + 8]
movabs r10, 0xce91ccab5921645a
mov qword [rbp + 0xe0], rax
movabs rcx, 0xd775c5902a71e75b
mov qword [rbp + 8], r9
movabs rbx, 0x60f8da218bfbc6dc
mov rax, qword [rbp + 8]
movabs r11, 0xce91a2c27945013d
mov qword [rbp + 0xe8], rax
mov qword [rbp + 8], r10
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x220], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x228], rax
mov qword [rbp + 8], r11
mov rax, qword [rbp + 8]
mov qword [rbp + 0x230], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x238], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vzeroupper
call fcn.140002970
lea rdx, [rbp + 0xe0]
lea rcx, [rax + 0x760]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], r12b
jne 0x14001c130
cmp qword [rcx + 0x18], 0xf
mov r8, qword [rcx + 0x10]
jbe 0x14001c147
mov rcx, qword [rcx]
cmp r8, rax
jne 0x14001c80a
lea rdx, [rbp + 0xe0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001c80a
call fcn.140002970
cmp byte [rax + 0x20], r12b
je 0x14001c78b
movabs rax, 0xd775c5dc6d3bb017
lea rcx, [rbp + 0x70]
mov qword [rbp + 8], rax
xor edx, edx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x70], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x78], rax
movabs rax, 0xd775c5902a71e75b
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x128], rax
movdqa xmm0, xmmword [rbp + 0x120]
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x70], xmm0
call qword [sym.imp.USER32.dll_FindWindowA]
xorps xmm0, xmm0
mov dword [rbp + 0x100], Ordinal_32
mov rbx, rax
lea rcx, [rbp + 0x100]
xor eax, eax
mov dword [rbp + 0x114], eax
movups xmmword [rbp + 0x104], xmm0
call qword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x14001c243
cmp dword [rbp + 0x108], 0x186a0
mov edx, r12d
mov eax, r12d
setl dl
cmp dword [rbp + 0x108], 0xc350
setg al
test eax, edx
je 0x14001c23a
mov sil, 1
mov byte [rbp], sil
jmp 0x14001c74f
xor sil, sil
mov byte [rbp], sil
jmp 0x14001c24c
test sil, sil
jne 0x14001c74f
test rbx, rbx
je 0x14001c74f
cmp byte [0x1401d80f1], r12b
je 0x14001c3f9
mov ecx, dword [0x1401d80f4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001c3f9
test r14b, r14b
jne 0x14001c3f9
cmp dword [reloc.WLDAP32.dll_Ordinal_30], r12d
mov r14b, 1
mov edi, r12d
jle 0x14001c3be
movabs rsi, 0x7ffffffffff0bdbf
nop dword [rax]
mov eax, dword [0x1401884e4]
lea rdx, [rbp + 0x130]
mov r8d, Ordinal_45
mov dword [rbp + 0x130], r12d
mov dword [rbp + 0x138], eax
mov dword [rbp + 0x13c], r12d
mov qword [rbp + 0x144], 1
lea ecx, [r8 - 0x27]
mov qword [rbp + 0x150], r12
call qword [sym.imp.USER32.dll_SendInput]
test r14b, dil
jne 0x14001c3ac
lea rcx, [rbp + 0xd0]
call fcn.140005490
mov rax, qword [rbp + 0xd0]
cmp rax, rsi
jge 0x14001c310
add rax, 0xf4240
mov qword [rbp + 0x28], rax
jmp 0x14001c314
mov qword [rbp + 0x28], r13
lea rcx, [rbp + 0x28]
call fcn.14002aff0
mov eax, dword [0x1401884fc]
lea rdx, [rbp + 0x158]
mov r8d, Ordinal_45
mov dword [rbp + 0x158], r12d
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x164], r12d
mov qword [rbp + 0x16c], 1
lea ecx, [r8 - 0x27]
mov qword [rbp + 0x178], r12
call qword [sym.imp.USER32.dll_SendInput]
movsxd rbx, dword [reloc.WS2_32.dll_getpeername]
lea rcx, [rbp + 0x80]
call fcn.140005490
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0x10], rcx
test rbx, rbx
jle 0x14001c3a3
imul rdx, rbx, 0xf4240
mov rax, r13
sub rax, rdx
cmp rcx, rax
jge 0x14001c39f
lea rax, [rdx + rcx]
mov qword [rbp + 0x10], rax
jmp 0x14001c3a3
mov qword [rbp + 0x10], r13
lea rcx, [rbp + 0x10]
call fcn.14002aff0
inc edi
cmp edi, dword [reloc.WLDAP32.dll_Ordinal_30]
jl 0x14001c2a0
movzx esi, byte [rbp]
lea rcx, [rbp + 0x88]
call fcn.140005490
mov rax, qword [rbp + 0x88]
movabs rcx, 0x7fffffffff67697f
cmp rax, rcx
jge 0x14001c3ec
add rax, 0x989680
mov qword [rbp + 0x30], rax
jmp 0x14001c3f0
mov qword [rbp + 0x30], r13
lea rcx, [rbp + 0x30]
call fcn.14002aff0
cmp byte [0x1401d80e7], r12b
je 0x14001c6a8
mov ecx, dword [0x1401d80f8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001c6a8
mov eax, dword [reloc.WS2_32.dll_send]
mov edi, r12d
test eax, eax
jle 0x14001c568
movabs rsi, 0x7ffffffffff0bdbf
nop word [rax + rax]
mov eax, dword [reloc.WS2_32.dll_ntohs]
lea rdx, [rbp + 0x180]
mov dword [rbp + 0x188], eax
mov r8d, Ordinal_45
mov eax, dword [0x1401d80ec]
neg eax
mov dword [rbp + 0x180], r12d
mov dword [rbp + 0x18c], eax
lea ecx, [r8 - 0x27]
mov qword [rbp + 0x194], 1
mov qword [rbp + 0x1a0], r12
call qword [sym.imp.USER32.dll_SendInput]
test dil, 1
jne 0x14001c554
lea rcx, [rbp + 0x90]
call fcn.140005490
mov rax, qword [rbp + 0x90]
cmp rax, rsi
jge 0x14001c4b8
add rax, 0xf4240
mov qword [rbp + 0x38], rax
jmp 0x14001c4bc
mov qword [rbp + 0x38], r13
lea rcx, [rbp + 0x38]
call fcn.14002aff0
mov eax, dword [reloc.WS2_32.dll_sendto]
lea rdx, [rbp + 0x1a8]
mov r8d, Ordinal_45
mov dword [rbp + 0x1a8], r12d
mov dword [rbp + 0x1b0], eax
mov dword [rbp + 0x1b4], r12d
mov qword [rbp + 0x1bc], 1
lea ecx, [r8 - 0x27]
mov qword [rbp + 0x1c8], r12
call qword [sym.imp.USER32.dll_SendInput]
movsxd rbx, dword [reloc.WS2_32.dll_getpeername]
lea rcx, [rbp + 0x98]
call fcn.140005490
mov rcx, qword [rbp + 0x98]
mov qword [rbp + 0x18], rcx
test rbx, rbx
jle 0x14001c54b
imul rdx, rbx, 0xf4240
mov rax, r13
sub rax, rdx
cmp rcx, rax
jge 0x14001c547
lea rax, [rdx + rcx]
mov qword [rbp + 0x18], rax
jmp 0x14001c54b
mov qword [rbp + 0x18], r13
lea rcx, [rbp + 0x18]
call fcn.14002aff0
mov eax, dword [reloc.WS2_32.dll_send]
inc edi
cmp edi, eax
jl 0x14001c440
movzx esi, byte [rbp]
mov edi, r12d
test eax, eax
jle 0x14001c6a8
movabs rsi, 0x7ffffffffff0bdbf
nop dword [rax]
mov eax, dword [reloc.WS2_32.dll_ntohs]
lea rdx, [rbp + 0x1d0]
neg eax
mov dword [rbp + 0x1d0], r12d
mov r8d, Ordinal_45
mov dword [rbp + 0x1d8], eax
mov eax, dword [0x1401d80ec]
mov dword [rbp + 0x1dc], eax
mov qword [rbp + 0x1e4], 1
lea ecx, [r8 - 0x27]
mov qword [rbp + 0x1f0], r12
call qword [sym.imp.USER32.dll_SendInput]
test dil, 1
jne 0x14001c696
lea rcx, [rbp + 0xa0]
call fcn.140005490
mov rax, qword [rbp + 0xa0]
cmp rax, rsi
jge 0x14001c5f8
add rax, 0xf4240
mov qword [rbp + 0x40], rax
jmp 0x14001c5fc
mov qword [rbp + 0x40], r13
lea rcx, [rbp + 0x40]
call fcn.14002aff0
mov eax, dword [reloc.WS2_32.dll_sendto]
lea rdx, [rbp + 0x1f8]
mov r8d, Ordinal_45
mov dword [rbp + 0x1f8], r12d
neg eax
mov dword [rbp + 0x204], r12d
mov dword [rbp + 0x200], eax
mov qword [rbp + 0x20c], 1
lea ecx, [r8 - 0x27]
mov qword [rbp + 0x218], r12
call qword [sym.imp.USER32.dll_SendInput]
movsxd rbx, dword [reloc.WS2_32.dll_getpeername]
lea rcx, [rbp + 0xa8]
call fcn.140005490
mov rcx, qword [rbp + 0xa8]
mov qword [rbp + 0x20], rcx
test rbx, rbx
jle 0x14001c68d
imul rdx, rbx, 0xf4240
mov rax, r13
sub rax, rdx
cmp rcx, rax
jge 0x14001c689
lea rax, [rdx + rcx]
mov qword [rbp + 0x20], rax
jmp 0x14001c68d
mov qword [rbp + 0x20], r13
lea rcx, [rbp + 0x20]
call fcn.14002aff0
inc edi
cmp edi, dword [reloc.WS2_32.dll_send]
jl 0x14001c580
movzx esi, byte [rbp]
cmp byte [0x1401d80e4], r12b
je 0x14001c70a
mov ecx, dword [0x1401d80e0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001c70a
test r15b, r15b
jne 0x14001c70a
mov r15b, 1
call fcn.140005c00
lea rcx, [rbp + 0xb0]
call fcn.140005490
mov rax, qword [rbp + 0xb0]
movabs rcx, 0x7ffffffffd050f7f
cmp rax, rcx
jge 0x14001c6fd
add rax, 0x2faf080
mov qword [rbp + 0x48], rax
jmp 0x14001c701
mov qword [rbp + 0x48], r13
lea rcx, [rbp + 0x48]
call fcn.14002aff0
lea rcx, [rbp + 0xb8]
call fcn.140005490
mov rax, qword [rbp + 0xb8]
movabs rcx, 0x7fffffffff67697f
cmp rax, rcx
jge 0x14001c738
add rax, 0x989680
mov qword [rbp + 0x50], rax
jmp 0x14001c73c
mov qword [rbp + 0x50], r13
lea rcx, [rbp + 0x50]
call fcn.14002aff0
movabs rdi, 0x7ffffffff70f2e7f
lea rcx, [rbp + 0xc0]
call fcn.140005490
mov rax, qword [rbp + 0xc0]
movabs rcx, 0x7ffffffffa0a1eff
cmp rax, rcx
jge 0x14001c781
add rax, 0x5f5e100
lea rcx, [rbp + 0x58]
mov qword [rbp + 0x58], rax
jmp 0x14001c7b7
mov qword [rbp + 0x58], r13
lea rcx, [rbp + 0x58]
jmp 0x14001c7b7
lea rcx, [rbp + 0xc8]
call fcn.140005490
mov rax, qword [rbp + 0xc8]
cmp rax, rdi
jge 0x14001c7af
add rax, 0x8f0d180
mov qword [rbp + 0x60], rax
jmp 0x14001c7b3
mov qword [rbp + 0x60], r13
lea rcx, [rbp + 0x60]
call fcn.14002aff0
mov ecx, dword [0x1401d80f4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1401d80f8]
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ecx, r14b
mov edx, r12d
test bx, bx
cmovs edx, ecx
mov ecx, dword [0x1401d80e0]
movzx r14d, dl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ecx, r15b
mov edx, r12d
test ax, ax
cmovs edx, ecx
movzx r15d, dl
jmp 0x14001c039
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret