Function at 0x7ff6989ec9d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x68
mov rdx, qword [0x7ff698a89638]
lea rax, [rbp - 0x30]
mov rcx, qword [0x7ff698a897b8]
lea r8, [rbp + 0x38]
add rdx, 0x1458
mov qword [rsp + 0x20], rax
mov r9d, 8
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x38]
lea rax, [rbp + 0x30]
mov rcx, qword [0x7ff698a897b8]
lea r8, [rbp + 0x28]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 0x588]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rcx, qword [0x7ff698a897b8]
lea rax, [rbp + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x28]
lea rdx, [rbx + 0x7e8]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rcx, qword [0x7ff698a897b8]
lea rax, [rbp + 0x30]
lea rdx, [rbx + 0xd5c]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x28]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rdx, qword [0x7ff698a89638]
lea rax, [rbp - 0x28]
mov rcx, qword [0x7ff698a897b8]
lea r8, [rbp + 0x40]
add rdx, 0x820
mov qword [rsp + 0x20], rax
mov r9d, 8
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rsi, qword [rbp + 0x40]
lea rax, [rbp + 0x30]
mov rcx, qword [0x7ff698a897b8]
lea r8, [rbp + 0x28]
mov r9d, 1
mov qword [rsp + 0x20], rax
lea rdx, [rsi + 0x361]
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rdx, qword [0x7ff698a89638]
lea rax, [rbp - 0x20]
mov rcx, qword [0x7ff698a897b8]
lea r8, [rbp - 0x38]
add rdx, 0x390
mov qword [rsp + 0x20], rax
mov r9d, 8
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
cmp byte [0x7ff698a898e4], 0
je 0x7ff6989ecb48
mov rdx, qword [0x7ff698a89638]
lea rax, [rbp - 0x18]
mov rcx, qword [0x7ff698a897b8]
lea r8, [rbp + 0x30]
add rdx, 0x2178
mov dword [rbp + 0x30], 0x3c23d70a
mov r9d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
cmp byte [0x7ff698a898f1], 0
je 0x7ff6989ecb90
mov rdx, qword [rbp - 0x38]
lea rax, [rbp + 0x30]
mov rcx, qword [0x7ff698a897b8]
lea r8, [rbp + 0x28]
add rdx, 0x7d8
mov qword [rsp + 0x20], rax
cmp byte [rbp + 0x28], 0
mov r9d, 4
mov dword [rbp + 0x28], 0x4479c000
jne 0x7ff6989ecb8a
mov dword [rbp + 0x28], 0x3f800000
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test rbx, rbx
je 0x7ff6989ecc4a
cmp byte [0x7ff698a89886], 0
je 0x7ff6989ecc4a
mov ecx, dword [0x7ff698a896f8]
call qword [sym.imp.user32.dll_GetAsyncKeyState]
mov rcx, qword [0x7ff698a897b8]
lea r8, [rbp + 0x28]
test ax, ax
mov r9d, 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
jns 0x7ff6989ecc36
lea rdx, [rbx + 0x804]
mov dword [rbp + 0x28], 0x4479c000
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
mov rcx, qword [0x7ff698a897b8]
lea rax, [rbp + 0x30]
lea rdx, [rbx + 0x80c]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov dword [rbp + 0x28], 0x4479c000
lea r8, [rbp + 0x28]
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
mov rcx, qword [0x7ff698a897b8]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x28]
mov dword [rbp + 0x28], 0xc1200000
mov r9d, 4
jmp 0x7ff6989ecc3d
mov dword [rbp + 0x28], 0x3f800000
lea rdx, [rbx + 0x7e8]
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
cmp byte [0x7ff698a89887], 0
je 0x7ff6989eccb6
mov rdx, qword [0x7ff698a89658]
lea rax, [rbp + 0x30]
mov rcx, qword [0x7ff698a897b8]
lea r8, [rbp + 0x28]
add rdx, 0xc0
mov dword [rbp + 0x28], 0xbf800000
mov r9d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
mov rcx, qword [0x7ff698a897b8]
lea rax, [rbp + 0x30]
lea rdx, [rsi + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov dword [rbp + 0x28], 0x7f7fffff
lea r8, [rbp + 0x28]
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
add rsp, 0x68
pop rdi
pop rsi
pop rbx
pop rbp
ret