Function at 0x14001cd40
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x18]
sub rsp, 0x110
mov rax, qword [0x1403d3080]
xor rax, rsp
mov qword [rbp - 0x20], rax
cmp byte [0x1403de1d0], 0
jne 0x14001d41d
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
xor esi, esi
mov qword [r11 + 0x20], r12
mov qword [r11 - 0x10], r14
movabs r14, 0x7fffffffffffffff
mov qword [r11 - 0x18], r15
movabs r15, 0x7ffffffffa0a1efe
movaps xmmword [r11 - 0x28], xmm6
xorps xmm6, xmm6
mov qword [r11 + 0x18], rdi
mov r12d, 4
nop word [rax + rax]
mov eax, dword [0x1403de1e0]
lea rcx, [rsp + 0x48]
inc eax
movsxd rbx, eax
call fcn.140001c50
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x80], rax
cmp rbx, 1
jl 0x14001cdf4
imul rdx, rbx, 0xf4240
mov rcx, r14
sub rcx, rdx
cmp rax, rcx
jge 0x14001cdf0
lea rcx, [rdx + rax]
mov qword [rbp - 0x80], rcx
jmp 0x14001cdf4
mov qword [rbp - 0x80], r14
lea rcx, [rbp - 0x80]
call fcn.140004c20
mov r8, qword [0x140416008]
test r8, r8
je 0x14001d3d8
cmp byte [0x1403de194], sil
je 0x14001cec8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r12 + rcx]
cmp dword [0x140416070], eax
jle 0x14001ce7f
lea rcx, [0x140416070]
call fcn.140161b40
cmp dword [0x140416070], 0xffffffff
jne 0x14001ce78
mov rcx, qword [0x140416008]
test rcx, rcx
jne 0x14001ce58
movaps xmm0, xmm6
jmp 0x14001ce64
add rcx, qword [0x140415760]
call fcn.14001d440
lea rcx, [0x140416070]
movss dword [0x14041606c], xmm0
call fcn.140161ad4
mov r8, qword [0x140416008]
test r8, r8
je 0x14001cec8
mov rcx, qword [0x140415820]
movss xmm0, dword [0x14041606c]
movss dword [rbp - 0x78], xmm0
test rcx, rcx
je 0x14001cecf
cmp dword [0x14041578c], esi
je 0x14001cecf
lea rdx, [r8 + 0x280]
mov qword [rsp + 0x20], rsi
lea r8, [rbp - 0x78]
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8, qword [0x140416008]
mov rcx, qword [0x140415820]
cmp byte [0x1403de197], sil
je 0x14001cf49
test r8, r8
jne 0x14001cee2
mov rdx, rsi
jmp 0x14001cf19
test rcx, rcx
je 0x14001cf15
cmp dword [0x14041578c], esi
je 0x14001cf15
mov rdx, qword [0x140415738]
mov r9d, 8
add rdx, r8
mov qword [rsp + 0x20], rsi
lea r8, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140415820]
mov rdx, qword [rbp - 0x70]
mov dword [rbp - 0x80], 0x42c40000
test rcx, rcx
je 0x14001cf49
cmp dword [0x14041578c], esi
je 0x14001cf49
add rdx, qword [0x140415748]
lea r8, [rbp - 0x80]
mov r9d, 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x1403de19c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001cf5f
call fcn.14001c960
mov rbx, qword [0x140416008]
movzx edi, byte [0x1403de195]
mov r10, qword [0x140415820]
test rbx, rbx
je 0x14001cfff
test r10, r10
je 0x14001cfb0
cmp dword [0x14041578c], esi
je 0x14001cfb0
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x68]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
bts rcx, 8
btr rax, 8
test dil, dil
cmove rcx, rax
mov qword [rbp - 0x60], rcx
test r10, r10
je 0x14001cfff
cmp dword [0x14041578c], esi
je 0x14001cfff
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x140415820]
mov rcx, qword [0x140416008]
test rcx, rcx
je 0x14001d169
test r10, r10
je 0x14001d045
cmp dword [0x14041578c], esi
je 0x14001d045
mov rdx, qword [0x140415740]
lea r8, [rbp - 0x58]
add rdx, rcx
mov qword [rsp + 0x20], rsi
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x14001d169
test r10, r10
je 0x14001d088
cmp dword [0x14041578c], esi
je 0x14001d088
mov rdx, qword [0x140415758]
lea r8, [rbp - 0x50]
add rdx, rbx
mov qword [rsp + 0x20], rsi
mov r9d, 8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
mov rax, qword [0x140416008]
cmp qword [rbp - 0x50], rax
jne 0x14001d187
mov byte [0x1404156f0], 1
test r10, r10
je 0x14001d0d0
cmp dword [0x14041578c], esi
je 0x14001d0d0
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x48]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
mov rax, qword [rbp - 0x48]
mov qword [0x1404156e8], rax
mov qword [0x1404156f8], rbx
test r10, r10
je 0x14001d112
cmp dword [0x14041578c], esi
je 0x14001d112
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x40]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
mov rax, qword [rbp - 0x40]
mov qword [0x1404156e0], rax
test r10, r10
je 0x14001d151
cmp dword [0x14041578c], esi
je 0x14001d151
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
lea r8, [rsp + 0x58]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
movsd xmm0, qword [rsp + 0x58]
mov eax, dword [rsp + 0x60]
movsd qword [0x140415ca0], xmm0
mov dword [0x140415ca8], eax
cmp byte [0x1404156f0], sil
jne 0x14001d28e
mov rdx, qword [0x140416008]
test rdx, rdx
jne 0x14001d190
mov rax, rsi
jmp 0x14001d1c4
mov byte [0x1404156f0], sil
jmp 0x14001d176
test r10, r10
je 0x14001d1c0
cmp dword [0x14041578c], esi
je 0x14001d1c0
add rdx, 0x20
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x38]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
mov rax, qword [rbp - 0x38]
mov rdx, qword [0x140416008]
mov qword [0x1404156e8], rax
mov qword [0x1404156f8], rdx
test rdx, rdx
jne 0x14001d1e3
mov rax, rsi
jmp 0x14001d217
test r10, r10
je 0x14001d213
cmp dword [0x14041578c], esi
je 0x14001d213
add rdx, 0x30
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
mov rax, qword [rbp - 0x30]
cmp qword [0x140416008], rsi
mov qword [0x1404156e0], rax
jne 0x14001d23b
movaps xmm0, xmm6
movss dword [rsp + 0x38], xmm6
unpcklps xmm0, xmm6
movsd qword [rsp + 0x30], xmm0
jmp 0x14001d276
test r10, r10
je 0x14001d276
cmp dword [0x14041578c], esi
je 0x14001d276
mov rdx, qword [0x140416008]
lea r8, [rsp + 0x30]
add rdx, 0x90
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
movsd xmm0, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
movsd qword [0x140415ca0], xmm0
mov dword [0x140415ca8], eax
mov rdx, qword [0x140415f40]
test rdx, rdx
je 0x14001d302
test r10, r10
je 0x14001d2cd
cmp dword [0x14041578c], esi
je 0x14001d2cd
add rdx, 0x3c0
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp - 0x28]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x140415820]
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14001d302
test r10, r10
je 0x14001d30b
cmp dword [0x14041578c], esi
je 0x14001d30b
add rdx, 0x40
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
lea r8, [rsp + 0x3c]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14001d30b
mov qword [rsp + 0x3c], rsi
mov dword [rsp + 0x44], esi
movsd xmm0, qword [rsp + 0x3c]
lea rcx, [rsp + 0x70]
mov eax, dword [rsp + 0x44]
movsd qword [rsp + 0x70], xmm0
mov dword [rsp + 0x78], eax
call fcn.14001c520
cmp byte [0x1403de1a5], sil
mov rbx, qword [0x140416008]
je 0x14001d3a8
nop dword [rax]
xor r8d, r8d
mov edx, 0x156
mov rcx, rbx
call fcn.14001c390
mov r8b, 1
mov edx, 0xfc
mov rcx, rbx
call fcn.14001c390
mov r8b, 1
mov edx, Ordinal_143
mov rcx, rbx
call fcn.14001c390
lea rcx, [rsp + 0x50]
call fcn.140001c50
mov rax, qword [rsp + 0x50]
cmp rax, r15
jg 0x14001d390
add rax, 0x5f5e100
mov qword [rbp - 0x80], rax
jmp 0x14001d394
mov qword [rbp - 0x80], r14
lea rcx, [rbp - 0x80]
call fcn.140004c20
cmp byte [0x1403de1a5], sil
jne 0x14001d340
jmp 0x14001d3d8
mov r8b, 1
mov edx, 0x156
mov rcx, rbx
call fcn.14001c390
xor r8d, r8d
mov edx, 0xfc
mov rcx, rbx
call fcn.14001c390
xor r8d, r8d
mov edx, Ordinal_143
mov rcx, rbx
call fcn.14001c390
cmp byte [0x1403de1d0], sil
je 0x14001cdb0
movaps xmm6, xmmword [rsp + 0xf0]
mov r15, qword [rsp + 0x100]
mov r14, qword [rsp + 0x108]
mov r12, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x130]
mov rsi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x120]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1401617c0
add rsp, 0x110
pop rbp
ret