Function at 0x140001400
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14004f040]
xor rax, rsp
mov qword [rbp - 0x18], rax
cmp byte [0x14004f0c0], 0
mov rbx, rcx
je 0x140001724
mov qword [rsp + 0x78], rsi
xor esi, esi
movaps xmmword [rsp + 0x50], xmm6
xorps xmm6, xmm6
mov qword [rsp + 0x80], rdi
cmp byte [0x14004f98b], sil
jne 0x140001458
mov qword [rbp - 0x28], 0x14
jmp 0x1400016fc
mov ecx, dword [0x14004f0bc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x14004f990]
shr eax, 0xf
and al, 1
test ecx, ecx
jne 0x140001484
test al, al
jne 0x1400014c2
mov qword [rbp - 0x28], 0xa
jmp 0x1400016fc
cmp ecx, 1
jne 0x1400014c2
test al, al
je 0x1400014ac
cmp byte [0x14004f994], sil
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x28], 0xc8
sete byte [0x14004f994]
call fcn.140001740
cmp byte [0x14004f994], sil
jne 0x1400014c2
mov qword [rbp - 0x28], 0xa
jmp 0x1400016fc
mov rdx, qword [0x14004f980]
lea r8, [rbp - 0x20]
mov rcx, qword [rbx + 8]
add rdx, 0x17c17f0
mov r9d, 8
mov qword [rbp - 0x20], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp - 0x20]
lea r8, [rbp - 0x2b]
mov rcx, qword [rbx + 8]
mov r9d, 1
mov byte [rbp - 0x2b], sil
mov qword [rsp + 0x20], rsi
lea rdx, [rdi + 0x3c3]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x14004f98c], sil
jne 0x140001558
mov rcx, qword [rbx + 8]
lea rdx, [rdi + 0x135c]
mov r9d, 4
mov dword [rbp - 0x30], esi
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp - 0x30]
comiss xmm0, xmm6
jbe 0x140001558
mov qword [rbp - 0x28], 0xa
jmp 0x1400016fc
mov rcx, qword [rbx + 8]
lea rdx, [rdi + 0x13a8]
mov r9d, 4
mov dword [rbp - 0x30], esi
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [rbp - 0x30]
test edi, edi
je 0x140001705
mov rdx, qword [0x14004f980]
lea r8, [rbp - 0x20]
mov rcx, qword [rbx + 8]
add rdx, 0x1954568
mov r9d, 8
mov qword [rbp - 0x20], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x20]
lea r8, [rbp - 0x28]
mov eax, edi
mov qword [rbp - 0x28], rsi
sar eax, 9
add rdx, 0x10
shl eax, 3
mov r9d, 8
movsxd rcx, eax
add rdx, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbx + 8]
lea r8, [rbp - 0x20]
and edi, 0x1ff
mov qword [rbp - 0x20], rsi
imul edx, edi, 0x78
mov r9d, 8
mov qword [rsp + 0x20], rsi
add rdx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x140001705
cmp byte [0x14004f0c1], sil
je 0x140001655
mov rcx, qword [rbx + 8]
lea rdx, [rdi + 0x3c3]
mov r9d, 1
mov byte [rbp - 0x2c], sil
lea r8, [rbp - 0x2c]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp - 0x2c]
cmp byte [rbp - 0x2b], al
je 0x140001705
mov rcx, qword [rbx + 8]
lea rdx, [rdi + 0x324]
mov r9d, 4
mov dword [rbp - 0x30], esi
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [rbp - 0x30], esi
jle 0x140001705
mov rdx, qword [0x14004f980]
lea r8, [rbp - 0x30]
mov rcx, qword [rbx + 8]
add rdx, 0x17ba020
mov r9d, 4
mov dword [rbp - 0x30], 0x10001
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsxd rax, dword [0x14004f0b8]
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x28], rax
call fcn.140001740
mov rdx, qword [0x14004f980]
lea r8, [rbp - 0x30]
mov rcx, qword [rbx + 8]
add rdx, 0x17ba020
mov r9d, 4
mov dword [rbp - 0x30], pe_nt_image_headers64
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsxd rax, dword [0x14004f0b8]
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.140001740
cmp byte [0x14004f0c0], sil
jne 0x140001442
movaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140040db0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret