Function at 0x14003cf50
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140126040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, dword [0x14012caec]
cmp eax, 1
jbe 0x14003cf9a
cmp eax, 2
jne 0x14003cf88
mov edi, 0x55ffff
jmp 0x14003cf9f
cmp eax, 3
jne 0x14003cf94
mov edi, 0x6a63fe
jmp 0x14003cf9f
mov edi, dword [rsp + 0x50]
jmp 0x14003cf9f
mov edi, 0xfe69eb
mov ecx, dword [0x140126104]
mov eax, dword [0x14012a250]
cdq
sub eax, edx
sar eax, 1
mov ebp, eax
sub ebp, ecx
lea r15d, [rax + rcx]
mov ecx, dword [0x140126138]
mov eax, dword [0x14012a244]
cdq
sub eax, edx
sar eax, 1
mov r14d, eax
sub r14d, ecx
lea esi, [rax + rcx]
mov ecx, dword [0x1401260f8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003d247
cmp byte [0x14012caf0], 0
je 0x14003d247
mov qword [rsp + 0xd0], rbx
xor ecx, ecx
mov qword [rsp + 0xd8], r12
mov qword [rsp + 0xe0], r13
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ebx, ebx
mov dword [rsp + 0x68], 0x28
mov r12, rax
mov dword [rsp + 0x28], ebx
xorps xmm0, xmm0
mov dword [rsp + 0x8c], ebx
sub esi, r14d
mov qword [rsp + 0x74], 0x200001
mov eax, esi
mov qword [rsp + 0x58], rbx
neg eax
mov qword [rsp + 0x20], rbx
sub r15d, ebp
mov dword [rsp + 0x70], eax
lea r9, [rsp + 0x58]
mov dword [rsp + 0x6c], r15d
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, r13
movdqu xmmword [rsp + 0x7c], xmm0
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14003d21b
mov rdx, rax
mov rcx, r12
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, r15d
mov dword [rsp + 0x38], r14d
xor r8d, r8d
mov dword [rsp + 0x30], ebp
xor edx, edx
mov qword [rsp + 0x28], r13
mov rcx, r12
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_BitBlt]
imul esi, r15d
movsxd r9, esi
test esi, esi
jle 0x14003d210
mov r8, qword [rsp + 0x58]
inc r8
movzx r10d, dil
nop dword [rax]
movzx ecx, byte [r8 + 1]
sub ecx, r10d
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x5a
jge 0x14003d127
movzx ecx, byte [r8]
movzx eax, di
shr eax, 8
sub ecx, eax
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x5a
jge 0x14003d127
movzx edx, byte [r8 - 1]
mov eax, edi
shr eax, 0x10
movzx ecx, al
sub edx, ecx
mov eax, edx
neg eax
cmovs eax, edx
cmp eax, 0x5a
jl 0x14003d138
inc rbx
add r8, 4
cmp rbx, r9
jl 0x14003d0e0
jmp 0x14003d210
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14003d210
lea rcx, [rsp + 0x50]
call fcn.14003c2c0
mov rbx, qword [rsp + 0x50]
movabs rax, 0x7ffffffffff0bdbf
cmp rbx, rax
jge 0x14003d173
add rbx, 0xf4240
jmp 0x14003d17d
movabs rbx, 0x7fffffffffffffff
lea rcx, [rsp + 0x50]
call fcn.14003c2c0
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jge 0x14003d1f5
movabs rdi, 0x4e94914f0000
movabs rsi, 0x431bde82d7b634db
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jl 0x14003d1b7
mov ecx, 0x5265c00
jmp 0x14003d1dc
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003d1da
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x50]
call fcn.14003c2c0
mov rax, qword [rsp + 0x50]
cmp rax, rbx
jl 0x14003d1a5
call fcn.140051240
movsxd rax, dword [0x140126144]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
call fcn.14003ee00
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r13, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140051cc0
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret