Function at 0x14007c740
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
mov rax, qword [0x14009b040]
xor rax, rsp
mov qword [rbp - 0x40], rax
mov rdi, rcx
cmp byte [0x14009c144], 1
jne 0x14007c9f9
cmp byte [0x14009c124], 1
jne 0x14007c9f9
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
mov rbx, qword [rdx]
mov qword [rbp - 0x78], rbx
xorps xmm9, xmm9
movdqu xmmword [rbp - 0x70], xmm9
xorps xmm8, xmm8
movdqu xmmword [rbp - 0x60], xmm8
xorps xmm7, xmm7
movdqu xmmword [rbp - 0x50], xmm7
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14007c928
movups xmm6, xmmword [rdi]
movups xmm2, xmm6
lea rdx, [rbx + 0x173b568]
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 8]
lea r8, [rsp + 0x70]
psrldq xmm2, 8
movq rcx, xmm2
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x70]
add rdx, 0x318
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 8]
lea r8, [rbp - 0x80]
psrldq xmm6, 8
movq rbx, xmm6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x80]
add rdx, 0x1e0
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 8]
lea r8, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x60], edi
mov rdx, qword [rsp + 0x68]
add rdx, 0xc0
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm6, dword [rsp + 0x60]
movss dword [rsp + 0x70], xmm6
mov rdx, qword [rsp + 0x68]
add rdx, 4
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm10, dword [rsp + 0x60]
movss dword [rsp + 0x74], xmm10
mov rdx, qword [rsp + 0x68]
add rdx, 4
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rsp + 0x60]
movss dword [rsp + 0x78], xmm0
mov rdx, qword [0x14009b1f8]
cmp rdx, qword [0x14009b200]
je 0x14007c91e
movss dword [rdx], xmm6
movss dword [rdx + 4], xmm10
movss dword [rdx + 8], xmm0
add qword [0x14009b1f8], 0xc
jmp 0x14007c928
lea r8, [rsp + 0x70]
call fcn.140061cc0
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14007ca3e
mov r8, qword [0x14009b1f8]
mov rcx, r8
sub rcx, qword [0x14009b1f0]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 1
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x14007ca33
xorps xmm0, xmm0
psrldq xmm0, 8
movq rcx, xmm0
test rcx, rcx
je 0x14007c9b9
psrldq xmm7, 8
movq rdx, xmm7
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c9b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007caca
call fcn.14007d56c
movq rcx, xmm9
test rcx, rcx
je 0x14007c9f9
movq rdx, xmm8
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c9f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007caca
call fcn.14007d56c
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.14007d3d0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rbp
ret
lea rax, [r8 - 0xc]
mov qword [0x14009b1f8], rax
xorps xmm0, xmm0
psrldq xmm0, 8
movq rcx, xmm0
test rcx, rcx
je 0x14007ca87
psrldq xmm7, 8
movq rdx, xmm7
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ca82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007caca
call fcn.14007d56c
movq rcx, xmm9
test rcx, rcx
je 0x14007c9f9
movq rdx, xmm8
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c9f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c9f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3