Function at 0x100024d68
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xc0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r9
mov rdi, r8
mov r12d, edx
mov rsi, rcx
mov rax, qword [rsp + 0x100]
mov dword [rax], 1
mov rcx, qword [rcx + 0xc0]
xor r13d, r13d
mov qword [rsp + 0x40], r13
cmp rcx, r13
je 0x100024dcf
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x10006b1d0]
call qword [rax]
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rsp + 0x40]
mov r10, qword [rcx]
lea r9, [rsi + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea edx, [r8 - 4]
call qword [r10 + 0x58]
mov r11, qword [rsi + 0xc0]
mov rcx, r13
mov qword [rsp + 0x100], rcx
cmp r11, r13
je 0x100024e43
mov rax, qword [r11]
lea r8, [rsp + 0x100]
lea rdx, [0x10006bdc8]
mov rcx, r11
call qword [rax]
mov rcx, qword [rsp + 0x100]
mov ebx, 1
cmp rcx, r13
je 0x100025210
mov dword [rsp + 0x90], r12d
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rbp
cmp di, 8
je 0x100024e96
cmp di, 0xd
je 0x100024e96
cmp di, 0x10
je 0x100024e96
cmp di, 0x11
je 0x100024e96
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + 0x28]
mov ebx, eax
jmp 0x1000251c7
mov qword [rsp + 0x50], r13
mov qword [rsp + 0xe0], r13
mov rcx, qword [rsi + 0xd8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x50]
movsxd rbx, eax
cmp ebx, r13d
jge 0x100024f09
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100024edd
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x100024ef1
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x100024f01
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, rbx
jmp 0x1000252c7
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x1000251a8
mov rax, qword [rcx]
lea rdx, [rsp + 0xe0]
call qword [rax + 0x70]
cmp eax, r13d
jge 0x100024f79
movsxd rbx, eax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100024f4d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x100024f61
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x100024f71
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, rbx
jmp 0x1000252c7
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, r13d
jbe 0x100024faa
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov edx, eax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.USER32.dll_CharLowerBuffW]
lea rdx, str.textarea
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r13d
jne 0x100025158
mov rcx, qword [rsp + 0x100]
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + 0x28]
mov rbx, r13
mov qword [rsp + 0x58], rbx
mov rcx, r13
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x50]
cmp rax, r13
je 0x1000250f7
mov qword [rsp + 0x48], r13
mov r9, qword [rax]
lea r8, [rsp + 0x48]
lea rdx, [0x100069478]
mov rcx, rax
call qword [r9]
mov rcx, qword [rsp + 0x48]
cmp rcx, r13
je 0x1000250f7
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r13w
jge 0x10002508b
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r13w
jge 0x10002508b
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [0x10006c2e8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, r13
jne 0x100025073
mov ecx, 0x8007000e
call fcn.1000242f0
int3
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x268]
mov rcx, qword [rsp + 0x48]
jmp 0x1000250f7
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r13w
jge 0x1000250f2
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r13w
jge 0x1000250f2
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [0x10006c2f0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, r13
jne 0x1000250da
mov ecx, 0x8007000e
call fcn.1000242f0
int3
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x268]
mov rcx, qword [rsp + 0x48]
jmp 0x1000250f7
mov rcx, qword [rsp + 0x48]
cmp rcx, r13
je 0x100025103
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x10002512d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x100025141
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x100025151
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
jmp 0x1000252c7
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100025178
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x10002518c
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x10002519c
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rax, 1
jmp 0x1000252c7
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x1000251c7
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, r13d
jne 0x1000251f7
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x1000251e0
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x1000251f0
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
jmp 0x1000252c7
cmp ebx, 1
jne 0x100025206
mov rcx, qword [rsp + 0x100]
jmp 0x100025210
mov rcx, qword [rsp + 0x100]
jmp 0x10002521d
movzx eax, di
cmp eax, 9
je 0x100025244
cmp eax, 0x75
je 0x100025244
movsxd rbx, ebx
cmp rcx, r13
je 0x10002522c
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x10002523c
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rax, rbx
jmp 0x1000252c7
lea rdx, [rsp + 0x60]
mov rcx, qword [0x100090140]
call fcn.1000035f0
nop
mov rcx, qword [rsp + 0x68]
cmp rcx, r13
je 0x100025276
xor r9d, r9d
xor r8d, r8d
mov edx, 0x900
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rcx, qword [rsp + 0x60]
lock add dword [rcx], 0xffffffff
jne 0x1000252a1
mov rcx, qword [rsp + 0x68]
cmp rcx, r13
je 0x100025296
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 8]
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x1000252b5
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x1000252c5
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret