Function at 0x14001f660
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r12
push r13
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movzx ebx, dl
mov r13, r9
movzx edi, r8w
movzx eax, bx
mov r12d, ecx
or ax, r8w
je 0x14001fc45
mov qword [r11 + 8], rsi
mov qword [r11 - 0x30], r14
mov r14d, dword [rbp + 0xb8]
mov eax, 0xffc3d44d
test r14d, r14d
mov qword [r11 - 0x38], r15
cmove r14d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1401286cc]
sete sil
cmp dword [0x14012a6e0], 0
je 0x14001f6d2
test sil, sil
jne 0x14001f6d2
mov r15b, 1
jmp 0x14001f6d5
xor r15b, r15b
cmp dword [0x14012a6e0], 1
mov byte [rbp + 0xa0], r15b
je 0x14001f6ea
test sil, sil
je 0x14001f6f1
mov byte [rbp + 0xb0], 0
test bl, bl
jne 0x14001f702
movzx ecx, di
call fcn.140023820
movzx ebx, al
jmp 0x14001f714
test di, di
jne 0x14001f714
xor edx, edx
movzx ecx, bl
call fcn.1400234b0
movzx edi, ax
xor ecx, ecx
movzx eax, di
lea rdx, [0x140000000]
shr ax, 8
test al, al
setne cl
cmp dword [0x14012a6e0], 2
mov dword [rsp + 0x38], ecx
jne case.default.0x14001f74f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14001f74f
cdqe
mov ecx, dword [rdx + rax*4 + 0x1fc54]
add rcx, rdx
jmp rcx
mov bl, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x14001f74f
mov bl, reloc.WSOCK32.dll_recv
jmp case.default.0x14001f74f
mov bl, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r13, r13
je 0x14001f88f
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.1400223a0
test al, al
je 0x14001f81b
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test r12d, r12d
jne 0x14001f794
movzx eax, bl
or byte [rsp + rax + 0x50], 0x80
jmp 0x14001f7a2
cmp r12d, 1
jne 0x14001f7a2
movzx eax, bl
and byte [rsp + rax + 0x50], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14001f7c2
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1fc6c]
add rcx, rdx
jmp rcx
test byte [rbp - 0xe], 0x80
jne 0x14001f7d7
test byte [rbp - 0xd], 0x80
jne 0x14001f7d7
and byte [rsp + 0x61], 0x7f
jmp case.default.0x14001f7c2
or byte [rsp + 0x61], 0x80
jmp case.default.0x14001f7c2
test byte [rbp - 0x10], 0x80
jne 0x14001f7f1
test byte [rbp - 0xf], 0x80
jne 0x14001f7f1
and byte [rsp + 0x60], 0x7f
jmp case.default.0x14001f7c2
or byte [rsp + 0x60], 0x80
jmp case.default.0x14001f7c2
test byte [rbp - 0xc], 0x80
jne 0x14001f80b
test byte [rbp - 0xb], 0x80
jne 0x14001f80b
and byte [rsp + 0x62], 0x7f
jmp case.default.0x14001f7c2
or byte [rsp + 0x62], 0x80
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, di
shl eax, 0x10
movsxd rdi, eax
cmp r12d, 1
je 0x14001f843
mov r9, rdi
movzx r8d, bl
mov edx, 0x100
or r9, 1
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xb0], 0
je 0x14001f866
cmp r12d, 2
jne 0x14001f866
mov rax, qword [0x1401245a8]
mov ecx, dword [rax + 0x84]
call fcn.140021460
jmp 0x14001f86f
test r12d, r12d
je 0x14001fc04
mov r9d, 0xc0000001
movzx r8d, bl
mov edx, 0x101
or r9, rdi
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001fc04
cmp byte [0x14012a598], 0
mov dword [0x14012888c], r12d
mov byte [0x14012a60a], bl
je 0x14001f8cf
cmp bl, 0x12
je 0x14001f8b4
cmp bl, 0xa4
je 0x14001f8b4
cmp bl, 0xa5
jne 0x14001f8cf
test sil, sil
jne 0x14001f8cf
xor ecx, ecx
mov byte [rsp + 0x33], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14012a598], sil
jmp 0x14001f8d4
mov byte [rsp + 0x33], 0
test sil, sil
lea rax, [0x140128888]
lea r13, [rsp + 0x48]
cmove r13, rax
cmp bl, 0xa5
jne 0x14001f8ff
test r15b, r15b
jne 0x14001f8ff
cmp qword [0x140129b60], 0
je 0x14001f8ff
mov al, 1
jmp 0x14001f901
xor al, al
mov byte [rbp + 0x98], al
mov byte [rsp + 0x31], al
test al, al
je 0x14001f979
test sil, sil
jne 0x14001f922
mov rax, qword [0x140128890]
mov qword [rsp + 0x40], rax
jmp 0x14001f946
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call fcn.1400226a0
xor edx, edx
mov rcx, rax
mov r15, rax
mov qword [rsp + 0x40], rax
call fcn.140022870
mov dword [r13], eax
cmp dword [r13], 0
je 0x14001f954
mov byte [rsp + 0x31], 0
jmp 0x14001f983
mov ecx, 0xa2
mov byte [rsp + 0x30], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [0x140129a54], r14d
movzx r15d, ax
shr r15d, 0xf
and r15b, 1
jmp 0x14001f996
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
movzx eax, byte [rbp + 0x98]
movzx r15d, byte [rbp + 0x98]
mov byte [rsp + 0x30], al
movzx ecx, byte [rbp + 0xa0]
test cl, cl
je 0x14001f9c0
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.1400223a0
movzx ecx, byte [rbp + 0xa0]
movzx r10d, al
mov byte [rsp + 0x34], al
jmp 0x14001f9c8
xor r10b, r10b
mov byte [rsp + 0x34], r10b
test sil, sil
jne 0x14001f9ee
mov eax, dword [0x14012a6e0]
cmp eax, 2
je 0x14001f9ee
cmp qword [0x140129b60], 0
je 0x14001f9e7
cmp eax, 1
jne 0x14001f9ee
mov byte [rsp + 0x32], 1
jmp 0x14001f9f3
mov byte [rsp + 0x32], 0
cmp r12d, 1
je 0x14001face
test cl, cl
je 0x14001fa27
mov r9d, dword [rsp + 0x38]
movzx r8d, di
movzx edx, bl
movzx ecx, r10b
mov dword [rsp + 0x20], r14d
call fcn.140020ee0
movzx esi, byte [rbp + 0x98]
jmp 0x14001fab7
movzx esi, byte [rbp + 0x98]
test sil, sil
je 0x14001fa48
mov eax, dword [0x140129a58]
cmp dword [r13], 3
cmove eax, r14d
mov dword [0x140129a58], eax
mov r8d, dword [rsp + 0x38]
mov r9d, r14d
movzx edx, dil
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
xor r11d, r11d
mov dword [0x140129a58], r11d
cmp byte [rsp + 0x31], r11b
je 0x14001fab7
cmp dword [0x140129a54], r11d
mov byte [rsp + 0x31], r11b
je 0x14001fa89
mov dword [0x140129a54], r11d
lea edx, [r11 + 4]
jmp 0x14001faa9
test r15b, r15b
jne 0x14001fab7
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
and ax, cx
neg ax
sbb edx, edx
add edx, 4
mov rcx, qword [rsp + 0x40]
call fcn.140022870
mov dword [r13], eax
cmp byte [rsp + 0x32], 0
je 0x14001fad5
movzx r8d, di
movzx edx, bl
xor ecx, ecx
call fcn.140021670
jmp 0x14001fad5
movzx esi, byte [rbp + 0x98]
cmp byte [rbp + 0xb0], 0
je 0x14001fb0e
cmp r12d, 2
jne 0x14001fb0e
cmp dword [0x14012a6e0], r12d
mov rax, qword [0x1401245a8]
jne 0x14001fb01
mov ecx, dword [rax + 0x88]
call fcn.140021460
jmp 0x14001fb17
mov ecx, dword [rax + 0x84]
call fcn.140021460
jmp 0x14001fb17
test r12d, r12d
je 0x14001fbeb
mov ecx, dword [rsp + 0x38]
or ecx, 2
cmp byte [rbp + 0xa0], 0
je 0x14001fb42
mov r9d, ecx
movzx ecx, byte [rsp + 0x34]
movzx r8d, di
movzx edx, bl
mov dword [rsp + 0x20], r14d
call fcn.140020ee0
jmp 0x14001fbbe
test sil, sil
je 0x14001fb5c
mov eax, dword [0x140129a5c]
cmp dword [r13], 3
cmove eax, r14d
mov dword [0x140129a5c], eax
mov r8d, ecx
mov r9d, r14d
movzx edx, dil
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
xor esi, esi
mov dword [0x140129a5c], esi
cmp byte [rsp + 0x31], sil
je 0x14001fbbe
cmp dword [0x140129a54], esi
je 0x14001fb91
mov dword [0x140129a54], esi
lea edx, [rsi + 4]
jmp 0x14001fbb0
test r15b, r15b
je 0x14001fbbe
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
setne sil
lea edx, [rsi + 3]
mov rcx, qword [rsp + 0x40]
call fcn.140022870
mov dword [r13], eax
cmp dword [r13], 0
je 0x14001fbd6
mov eax, 0x138
cmp di, ax
jne 0x14001fbd6
and byte [0x14012886b], 0xfe
cmp byte [rsp + 0x32], 0
je 0x14001fbeb
movzx r8d, di
movzx edx, bl
mov cl, 1
call fcn.140021670
cmp byte [rsp + 0x33], 0
je 0x14001fc04
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x14012a598], 1
cmp byte [rbp + 0xb0], 0
mov r15, qword [rsp + 0x150]
mov r14, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x190]
je 0x14001fc45
cmp dword [0x14012a6e0], 2
mov rax, qword [0x1401245a8]
jne 0x14001fc3d
mov ecx, dword [rax + 0x80]
jmp 0x14001fc40
mov ecx, dword [rax + 0x7c]
call fcn.140021460
add rsp, 0x160
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret