Function at 0x1400392a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401e56c8]
xor rax, rsp
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
lea rax, [0x1401ec898]
mov qword [rsp + 0x40], rax
lea rax, [0x1401ec838]
mov qword [rsp + 0x48], rax
lea rax, [0x1401ec850]
mov qword [rsp + 0x50], rax
lea rax, [0x1401ec6e8]
mov qword [rsp + 0x58], rax
lea rax, [0x1401ec7d8]
mov qword [rsp + 0x60], rax
lea rax, [0x1401ec880]
mov qword [rsp + 0x68], rax
lea rax, [0x1401ec790]
mov qword [rsp + 0x70], rax
lea rax, [0x1401ec760]
mov qword [rsp + 0x78], rax
lea rax, [0x1401ec700]
mov qword [rbp - 0x80], rax
lea rax, [0x1401ec820]
mov qword [rbp - 0x78], rax
lea rax, [0x1401ec6b8]
mov qword [rbp - 0x70], rax
lea rax, [0x1401ec910]
mov qword [rbp - 0x68], rax
lea rax, [0x1401ec8c8]
mov qword [rbp - 0x60], rax
lea rax, [0x1401ec7c0]
mov qword [rbp - 0x58], rax
lea rax, [0x1401ec730]
mov qword [rbp - 0x50], rax
lea rax, [0x1401ec8f8]
mov qword [rbp - 0x48], rax
lea rax, [0x1401ec8b0]
mov qword [rbp - 0x40], rax
lea rax, [0x1401ec958]
mov qword [rbp - 0x38], rax
lea rax, [0x1401ec778]
mov qword [rbp - 0x30], rax
lea rax, [0x1401ec808]
mov qword [rbp - 0x28], rax
lea rax, [0x1401ec718]
mov qword [rbp - 0x20], rax
lea rax, [0x1401ec7a8]
mov qword [rbp - 0x18], rax
lea rax, [0x1401ec748]
mov qword [rbp - 0x10], rax
lea rax, [0x1401ec6d0]
mov qword [rbp - 8], rax
lea rax, [0x1401ec7f0]
mov qword [rbp], rax
lea rax, [0x1401ec928]
mov qword [rbp + 8], rax
lea rax, [0x1401ec940]
mov qword [rbp + 0x10], rax
lea rax, [0x1401ec868]
mov qword [rbp + 0x18], rax
movdqu xmmword [rbp + 0x38], xmm0
xor r13d, r13d
mov qword [rbp + 0x48], r13
mov ecx, 0xe0
call fcn.14015be00
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
lea rbx, [rax + 0xe0]
mov qword [rbp + 0x48], rbx
mov r8d, 0xe0
lea rdx, [rsp + 0x40]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x40], rbx
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov qword [rbp + 0x30], r13
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, qword [rbp + 0x28]
cmp rax, qword [0x1401ea1f0]
jne 0x140039629
mov edi, r13d
mov rax, qword [rbp + 0x40]
sub rax, qword [rbp + 0x38]
sar rax, 3
test rax, rax
je 0x14003952d
xorps xmm6, xmm6
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax + rdi*8]
mov rdx, qword [rcx]
movss xmm0, dword [rdx + 4]
ucomiss xmm0, xmm6
jp 0x1400394b7
je 0x140039515
mov rax, qword [rbp + 0x20]
cmp rax, rbx
je 0x1400394e2
movss xmm1, dword [rdx]
movd xmm0, dword [rax]
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
jp 0x1400394d2
je 0x1400394dd
add rax, 4
cmp rax, rbx
je 0x1400394e2
jmp 0x1400394c4
cmp rax, rbx
jne 0x140039515
cvttss2si eax, dword [rdx]
mov dword [rsp + 0x20], eax
cmp rbx, qword [rbp + 0x30]
je 0x140039500
mov dword [rbx], eax
mov rbx, qword [rbp + 0x28]
add rbx, 4
mov qword [rbp + 0x28], rbx
jmp 0x140039515
lea r8, [rsp + 0x20]
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.14002dbb0
mov rbx, qword [rbp + 0x28]
inc rdi
mov rax, qword [rbp + 0x40]
sub rax, qword [rbp + 0x38]
sar rax, 3
cmp rdi, rax
jb 0x1400394a0
mov rsi, rbx
sub rsi, qword [rbp + 0x20]
sar rsi, 2
sub esi, 1
js 0x140039629
movsxd rax, esi
lea rdi, [rax*4]
mov r14, rdi
movabs r15, 0x7ffffffffff0bdbf
movabs r12, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x20]
mov ecx, dword [rcx + rdi]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [rbp + 0x20]
test ax, ax
jne 0x14003959a
add rcx, r14
lea rdx, [rcx + 4]
mov r8, qword [rbp + 0x28]
sub r8, rdx
call sub.VCRUNTIME140.dll_memmove
mov rbx, qword [rbp + 0x28]
sub rbx, 4
mov qword [rbp + 0x28], rbx
jmp 0x140039618
mov ecx, dword [rcx + rdi]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140039614
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400395c6
imul rax, rax, 0x64
jmp 0x1400395e1
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jge 0x1400395f3
add rax, 0xf4240
mov qword [rsp + 0x20], rax
jmp 0x1400395f8
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0x20]
call fcn.140010f20
mov rcx, qword [rbp + 0x20]
mov ecx, dword [rcx + rdi]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400395a8
mov rbx, qword [rbp + 0x28]
sub r14, 4
sub rdi, 4
sub esi, 1
jns 0x140039563
mov rsi, r13
mov rax, qword [rbp + 0x40]
sub rax, qword [rbp + 0x38]
sar rax, 3
test rax, rax
je 0x140039797
movabs r14, 0x3fffffffffffffff
nop dword [rax + rax]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r13
sub rbx, qword [rbp + 0x20]
sar rbx, 2
mov r8, r13
test rbx, rbx
je 0x1400396bd
cmp rbx, r14
ja 0x140039873
mov rdx, rbx
call fcn.1400105e0
mov rdi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea rcx, [rax + rbx*4]
mov qword [rsp + 0x38], rcx
mov rbx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
sub rbx, rdx
mov r8, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
sar rbx, 2
lea r8, [rdi + rbx*4]
mov rdx, r8
mov qword [rsp + 0x30], rdx
jmp 0x1400396c2
mov rdx, qword [rsp + 0x30]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax + rsi*8]
mov rax, qword [rcx]
cvttss2si r9d, dword [rax]
mov rbx, qword [0x1401e5a68]
cvttss2si eax, dword [rax + 4]
test eax, eax
je 0x140039718
test r9d, r9d
je 0x14003970f
mov rcx, qword [rsp + 0x28]
cmp rcx, r8
je 0x140039721
mov r8d, r9d
call fcn.14015bcd0
cmp rax, qword [rsp + 0x30]
je 0x14003971c
mov eax, r13d
cmp dword [rbx + rsi*4], r13d
sete al
mov dword [rbx + rsi*4], eax
jmp 0x14003971c
mov dword [rbx + rsi*4], 1
jmp 0x14003971c
mov dword [rbx + rsi*4], r13d
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140039760
mov rax, qword [rsp + 0x38]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003975b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039790
call fcn.14015c094
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x20]
call fcn.140010860
inc rsi
mov rax, qword [rbp + 0x40]
sub rax, qword [rbp + 0x38]
sar rax, 3
cmp rsi, rax
jae 0x140039797
mov rbx, qword [rbp + 0x28]
jmp 0x140039650
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x20]
call fcn.140010860
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140039800
mov rax, qword [rbp + 0x30]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400397ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400397ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015c094
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140039841
mov rdx, qword [rbp + 0x48]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003983c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003983c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015c094
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.14015bde0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140010560
nop
int3