Function at 0x140042200
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140129040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov eax, dword [0x1406c7ffc]
cmp eax, 1
jbe 0x14004224e
cmp eax, 2
jne 0x14004223d
mov ebx, 0x55ffff
jmp 0x140042253
cmp eax, 3
jne 0x140042249
mov ebx, 0x6a63fe
jmp 0x140042253
mov ebx, dword [rbp - 9]
jmp 0x140042253
mov ebx, 0xfe69eb
mov ecx, dword [0x14066ae1c]
mov eax, dword [0x1406c5760]
cdq
sub eax, edx
sar eax, 1
mov esi, eax
sub esi, ecx
lea r15d, [rax + rcx]
mov ecx, dword [0x14066ae50]
mov eax, dword [0x1406c5754]
cdq
sub eax, edx
sar eax, 1
mov r14d, eax
sub r14d, ecx
lea edi, [rax + rcx]
mov ecx, dword [0x14066ae10]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140042558
cmp byte [0x1406c8000], 0
je 0x140042558
mov qword [rsp + 0xd0], r12
xor ecx, ecx
mov qword [rsp + 0xd8], r13
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ecx, ecx
mov dword [rbp + 7], 0x28
mov r12, rax
mov dword [rsp + 0x28], ecx
xorps xmm0, xmm0
mov dword [rbp + 0x2b], ecx
mov qword [rbp - 0x11], rcx
lea r9, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 7]
sub edi, r14d
mov qword [rbp + 0x13], 0x200001
mov eax, edi
sub r15d, esi
neg eax
mov dword [rbp + 0xb], r15d
xor r8d, r8d
mov dword [rbp + 0xf], eax
mov rcx, r13
movdqu xmmword [rbp + 0x1b], xmm0
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x140042534
mov rdx, rax
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, r15d
mov dword [rsp + 0x38], r14d
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
mov qword [rsp + 0x28], r13
mov rcx, r12
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
imul edi, r15d
movsxd r10, edi
test edi, edi
jle 0x14004252a
mov r8, qword [rbp - 0x11]
xor edi, edi
mov r9d, edi
movzx r11d, bl
inc r8
movzx ecx, byte [r8 + 1]
sub ecx, r11d
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x5a
jge 0x1400423c7
movzx ecx, byte [r8]
movzx eax, bx
shr eax, 8
sub ecx, eax
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x5a
jge 0x1400423c7
movzx edx, byte [r8 - 1]
mov eax, ebx
shr eax, 0x10
movzx ecx, al
sub edx, ecx
mov eax, edx
neg eax
cmovs eax, edx
cmp eax, 0x5a
jl 0x1400423d8
inc r9
add r8, 4
cmp r9, r10
jl 0x140042380
jmp 0x14004252a
mov ebx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14004252a
mov rcx, qword [0x14066ad90]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004242e
mov edx, dword [0x14066ad88]
lea r9d, [rbx + 0xb]
mov qword [rsp + 0x38], rdi
lea r8, [rbp - 9]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov qword [rbp - 9], rdi
mov word [rbp - 1], bx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbp - 9]
call fcn.140041330
mov rbx, qword [rbp - 9]
movabs rax, 0x7ffffffffff0bdbf
cmp rbx, rax
jge 0x140042453
add rbx, 0xf4240
jmp 0x14004245d
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp - 9]
call fcn.140041330
mov rax, qword [rbp - 9]
cmp rax, rbx
jge 0x1400424d1
movabs rsi, 0x4e94914f0000
movabs r14, 0x431bde82d7b634db
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jl 0x140042495
mov ecx, 0x5265c00
jmp 0x1400424ba
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400424b8
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp - 9]
call fcn.140041330
mov rax, qword [rbp - 9]
cmp rax, rbx
jl 0x140042483
mov rcx, qword [0x14066ad90]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140042516
mov edx, dword [0x14066ad88]
lea r8, [rbp - 9]
mov eax, 2
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rbp - 9], rdi
lea r9d, [rax + 0xa]
mov word [rbp - 1], ax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movsxd rax, dword [0x14066ae5c]
lea rcx, [rbp - 9]
mov qword [rbp - 9], rax
call fcn.1400441e0
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r13, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400543c0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret