Function at 0x140053a40
Capabilities:
Log keystrokes via polling

Disassembly:
test dl, 0x1f
je 0x140053c78
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
mov edi, edx
test rcx, rcx
je 0x140053bdc
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x140053bdc
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r12d, edi
mov cl, 0x80
and r12d, 0x10
je 0x140053aa3
or byte [rsp + 0x7b], cl
mov r13d, edi
and r13d, 2
je 0x140053ab7
mov eax, dword [rbx + 0x30]
or byte [rsp + 0x30], cl
or byte [rsp + rax + 0x20], cl
mov r14d, edi
and r14d, 4
je 0x140053acb
or byte [rsp + 0x30], cl
or byte [rsp + 0xc1], cl
mov esi, edi
and esi, 8
je 0x140053ad6
or byte [rsp + 0x31], cl
mov ebp, edi
and ebp, 1
je 0x140053ae1
or byte [rsp + 0x32], cl
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
mov r15d, 0x100
test r12d, r12d
je 0x140053b18
movzx eax, byte [rbx + 0x2d]
mov rcx, qword [rbx + 0x20]
mov r8d, 0x5b
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test r13d, r13d
je 0x140053b3c
movzx eax, byte [rbx + 0x2b]
mov r8d, dword [rbx + 0x30]
mov rcx, qword [rbx + 0x20]
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test r14d, r14d
je 0x140053b62
movzx eax, byte [rbx + 0x2c]
mov rcx, qword [rbx + 0x20]
mov r8d, reloc.WSOCK32.dll_recv
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test esi, esi
je 0x140053b87
movzx eax, byte [rbx + 0x28]
mov rcx, qword [rbx + 0x20]
mov r8d, reloc.WSOCK32.dll_recvfrom
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test ebp, ebp
je 0x140053c50
test esi, esi
jne 0x140053bb1
bt edi, 0xb
jb 0x140053bb1
movzx eax, byte [rbx + 0x29]
mov edx, 0x104
shl eax, 0x10
movsxd r9, eax
or r9, 0x20000001
jmp 0x140053bca
test ebp, ebp
je 0x140053c50
movzx eax, byte [rbx + 0x29]
mov edx, r15d
shl eax, 0x10
movsxd r9, eax
or r9, 1
mov rcx, qword [rbx + 0x20]
mov r8d, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140053c50
test dil, 0x10
je 0x140053bf3
mov dl, byte [rbx + 0x2d]
xor r9d, r9d
xor r8d, r8d
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 2
je 0x140053c0b
mov dl, byte [rbx + 0x2b]
mov cl, byte [rbx + 0x30]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 4
je 0x140053c22
mov dl, byte [rbx + 0x2c]
xor r9d, r9d
xor r8d, r8d
mov cl, RegisterTypeLib
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 8
je 0x140053c39
mov dl, byte [rbx + 0x28]
xor r9d, r9d
xor r8d, r8d
mov cl, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 1
je 0x140053c50
mov dl, byte [rbx + 0x29]
xor r9d, r9d
xor r8d, r8d
mov cl, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rbx
call fcn.140045020
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret