Function at 0x7ff6cc7d5ac0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov r15d, r9d
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x201
je 0x7ff6cc7d5afe
cmp r8d, 0x204
jne 0x7ff6cc7d5b04
call qword [sym.imp.USER32.dll_SetFocus]
mov r14d, dword [rbp + 0x70]
mov eax, esi
mov byte [rbp + 0x60], 0
mov r12d, 1
sub eax, 0x201
je 0x7ff6cc7d5cfa
sub eax, r12d
je 0x7ff6cc7d5ce5
cmp eax, 2
jne 0x7ff6cc7d5b3a
test byte [rdi + 0x40], al
je 0x7ff6cc7d5b44
mov rcx, rdi
call fcn.7ff6cc7d74a0
test byte [rdi + 0x40], 2
jne 0x7ff6cc7d6075
mov ebx, dword [rbp + 0x78]
lea rdx, [rsp + 0x58]
mov rcx, rdi
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x158], r13
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x60], 3
call fcn.7ff6cc7d90d0
mov r13d, dword [rsp + 0x64]
mov eax, r15d
and eax, 8
mov dword [rsp + 0x50], eax
mov eax, r15d
mov r15, qword [rsp + 0x68]
and eax, 4
mov dword [rsp + 0x40], eax
and r13d, 0x20
je 0x7ff6cc7d5bb1
cmp esi, 0x201
jne 0x7ff6cc7d5bb1
mov r8d, dword [r15]
mov rdx, r15
shr r8d, 2
mov rcx, rdi
not r8b
and r8b, r12b
call fcn.7ff6cc7d8c50
mov r8, qword [rsp + 0x70]
xor r12d, r12d
mov qword [rsp + 0x78], r8
test r13d, r13d
jne 0x7ff6cc7d5f8a
cmp esi, 0x201
je 0x7ff6cc7d5bdb
cmp esi, 0x204
jne 0x7ff6cc7d5f8a
mov rcx, qword [rdi + 0x38]
or ebx, 0xffffffff
test rcx, rcx
je 0x7ff6cc7d5c0f
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41c
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rsp + 0x70]
mov dword [rdi + 0x160], ebx
mov dword [rdi + 0x164], ebx
mov dword [rdi + 0x190], ebx
mov eax, dword [rsp + 0x64]
mov ecx, eax
and ecx, 0x10
mov dword [rsp + 0x48], ecx
je 0x7ff6cc7d5cb9
test byte [rdi + 0x4c], 1
mov ebx, r12d
mov qword [rdi + 0xa0], r15
je 0x7ff6cc7d5c85
test byte [r15], 2
jne 0x7ff6cc7d5c85
cmp byte [rbp + 0x60], bl
jne 0x7ff6cc7d5c85
mov edx, dword [r15 + 0x2c]
lea rax, [rbp - 0x70]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.7ff6cc7d8d70
test al, al
je 0x7ff6cc7d5c85
mov eax, dword [rbp - 0x70]
mov ebx, 1
test al, 4
je 0x7ff6cc7d5c70
cmp r14d, dword [rbp - 0x3c]
jl 0x7ff6cc7d5c70
cmp r14d, dword [rbp - 0x34]
cmovl ebx, r12d
and eax, 0x18
cmp al, 0x18
jne 0x7ff6cc7d5c85
cmp r14d, dword [rbp - 0x1c]
jl 0x7ff6cc7d5c85
cmp r14d, dword [rbp - 0x14]
cmovl ebx, r12d
mov r9d, dword [rsp + 0x40]
mov eax, r12d
mov r8d, dword [rsp + 0x50]
cmp esi, 0x204
mov rdx, r15
mov rcx, rdi
sete al
mov dword [rsp + 0x20], eax
call fcn.7ff6cc7d9680
test ebx, ebx
je 0x7ff6cc7d5f82
mov eax, dword [rsp + 0x64]
or ebx, 0xffffffff
xor r13b, r13b
mov byte [rsp + 0x44], r12b
test al, 0xf
jne 0x7ff6cc7d5edc
cmp byte [rbp + 0x60], r12b
jne 0x7ff6cc7d5edc
test r15, r15
je 0x7ff6cc7d5d67
mov r15d, dword [r15 + 0x2c]
jmp 0x7ff6cc7d5d6a
test byte [rdi + 0x40], 2
je 0x7ff6cc7d5b44
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x7ff6cc7d5b3a
mov ecx, dword [rdi + 0x40]
test cl, 0x20
je 0x7ff6cc7d5b3a
mov edx, dword [rdi + 0x90]
lea eax, [rdx - 8]
cmp r14d, eax
jl 0x7ff6cc7d5b3a
lea eax, [rdx + 8]
cmp r14d, eax
jge 0x7ff6cc7d5b3a
or ecx, 2
mov byte [rbp + 0x60], r12b
mov dword [rdi + 0x40], ecx
mov rcx, rbx
mov dword [rdi + 0x124], r14d
mov dword [rdi + 0x128], edx
call qword [sym.imp.USER32.dll_SetCapture]
xor r9d, r9d
mov rdx, r12
mov rcx, rbx
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x7ff6cc7d5b44
mov r15d, ebx
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x7ff6cc7d5d77
mov ebx, dword [rax + 4]
mov r8d, dword [rbp + 0x78]
lea rax, [rbp + 0x60]
mov edx, r14d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.7ff6cc7dca90
or edx, 0xffffffff
movzx r8d, al
cmp r15d, edx
jne 0x7ff6cc7d5da0
mov r15, r12
jmp 0x7ff6cc7d5dbb
mov rax, qword [rdi + 0x130]
cmp r15d, dword [rax]
jae 0x7ff6cc7d606d
mov rax, qword [rax + 8]
mov ecx, r15d
mov r15, qword [rax + rcx*8]
cmp ebx, edx
je 0x7ff6cc7d5de6
cmp ebx, dword [rdi + 0xdc]
jae 0x7ff6cc7d606d
mov rax, qword [rdi + 0xd0]
mov ecx, ebx
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x7ff6cc7d606d
test r8b, r8b
je 0x7ff6cc7d5e0a
mov bl, 1
cmp dword [rsp + 0x48], r12d
je 0x7ff6cc7d5ee1
test byte [rdi + 0x4c], bl
je 0x7ff6cc7d5ee1
mov edx, dword [r15 + 0x2c]
jmp 0x7ff6cc7d5ee1
cmp esi, 0x201
jne 0x7ff6cc7d5e20
cmp dword [rbp + 0x60], 0x202
je 0x7ff6cc7d5e39
jmp 0x7ff6cc7d5edf
cmp esi, 0x204
jne 0x7ff6cc7d5edf
cmp dword [rbp + 0x60], 0x205
jne 0x7ff6cc7d5edf
cmp dword [rsp + 0x48], r12d
je 0x7ff6cc7d5e59
movzx eax, byte [rdi + 0x4c]
mov ecx, dword [rsp + 0x44]
and al, 1
mov eax, 1
movzx ecx, cl
cmovne ecx, eax
mov dword [rsp + 0x44], ecx
mov rbx, qword [rdi]
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx edx, ax
mov rcx, rbx
shr eax, 0x10
cwde
mov dword [rsp + 0x48], edx
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x4c], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [rsp + 0x48], r14d
jne 0x7ff6cc7d5ec2
mov eax, dword [rbp + 0x78]
cmp dword [rsp + 0x4c], eax
jne 0x7ff6cc7d5ec2
mov ecx, dword [rbp + 0x68]
cmp esi, 0x201
mov dword [rsp + 0x30], ecx
mov r9d, eax
mov rcx, qword [rsp + 0x78]
setne r12b
mov qword [rsp + 0x28], rcx
mov r8d, r14d
mov rcx, rdi
mov qword [rsp + 0x20], r15
lea edx, [r12 + 0xd]
call fcn.7ff6cc7d78f0
cmp esi, 0x204
movzx r13d, r13b
mov eax, 1
cmove r13d, eax
cmp byte [rsp + 0x44], 0
jne 0x7ff6cc7d5f57
or edx, 0xffffffff
xor bl, bl
cmp dword [rsp + 0x50], 0
jne 0x7ff6cc7d5f44
cmp dword [rsp + 0x40], 0
jne 0x7ff6cc7d5f44
lea rax, [rbp + 0x60]
mov r9d, 4
mov qword [rsp + 0x28], rax
mov r8d, edx
lea rax, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.7ff6cc7d9300
mov r8d, dword [rbp + 0x60]
lea rax, [rbp - 0x80]
mov edx, dword [rsp + 0x40]
mov r9b, 1
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.7ff6cc7d9010
test al, al
je 0x7ff6cc7d5f44
mov rcx, qword [rbp + 0x50]
lea rdx, [rbp - 0x80]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
test bl, bl
je 0x7ff6cc7d5f57
mov r8d, dword [rbp + 0x78]
mov edx, r14d
mov rcx, rdi
call fcn.7ff6cc7dcbe0
test r13b, r13b
je 0x7ff6cc7d606d
mov rbx, qword [rdi]
call qword [sym.imp.USER32.dll_GetMessagePos]
mov r9d, eax
mov r8, rbx
mov edx, 0x7b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x7ff6cc7d606d
mov ebx, dword [rbp + 0x78]
mov r8, qword [rsp + 0x70]
or edx, 0xffffffff
cmp esi, 0x201
je 0x7ff6cc7d5ffd
cmp esi, 0x204
je 0x7ff6cc7d5ffd
cmp esi, 0x202
je 0x7ff6cc7d5fcb
cmp esi, 0x205
je 0x7ff6cc7d5fcb
cmp esi, 0x203
jne 0x7ff6cc7d5fbc
mov edx, 0xf
jmp 0x7ff6cc7d602c
cmp esi, 0x206
jne 0x7ff6cc7d602c
mov edx, 0x10
jmp 0x7ff6cc7d602c
mov eax, dword [rdi + 0xb0]
test eax, eax
je 0x7ff6cc7d5ff4
cmp dword [rdi + 0xb4], r14d
jne 0x7ff6cc7d5ff4
cmp dword [rdi + 0xb8], ebx
jne 0x7ff6cc7d5ff4
cmp eax, 0x201
mov edx, r12d
setne dl
add edx, 0xd
mov dword [rdi + 0xb0], r12d
jmp 0x7ff6cc7d602c
mov eax, dword [rdi + 0xb0]
test eax, eax
je 0x7ff6cc7d6019
cmp eax, esi
je 0x7ff6cc7d6019
cmp eax, 0x201
mov edx, r12d
setne dl
add edx, 0xd
mov dword [rdi + 0xb0], esi
mov dword [rdi + 0xb4], r14d
mov dword [rdi + 0xb8], ebx
test r13d, r13d
jne 0x7ff6cc7d606d
cmp edx, 0xffffffff
je 0x7ff6cc7d606d
mov ecx, dword [rbp + 0x68]
xor r9d, r9d
mov rax, qword [rdi + 0xc8]
mov dword [rsp + 0x70], ecx
mov rcx, qword [rdi]
mov qword [rsp + 0x68], r8
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x20], rax
call qword [rdi + 0xc0]
mov r13, qword [rsp + 0x158]
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret