Function at 0x1400026f2
Capabilities:
Log keystrokes
Log keystrokes via polling
Parse pe header

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xe0], ecx
mov qword [rbp + 0xe8], rdx
mov qword [rbp + 0xf0], r8
cmp dword [rbp + 0xe0], 0
jne 0x140002cfb
cmp qword [rbp + 0xe8], 0x100
jne 0x140002cfa
mov rax, qword [rbp + 0xf0]
mov qword [rbp + 0xc0], rax
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_MapVirtualKeyA]
call rax
mov edx, eax
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
lea r8, [rbp + 0xbe]
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_ToAscii]
call rax
cmp eax, 1
sete al
test al, al
je 0x1400027b1
movzx eax, word [rbp + 0xbe]
mov byte [rbp + 0xcf], al
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x1b
jne 0x14000287a
mov eax, dword [0x14003d044]
and eax, 1
test eax, eax
jne 0x1400027e7
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.select_button_mouse_down__widget_t__int__int_
jmp 0x140002850
mov edx, dword [0x14003d044]
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
add edx, eax
and edx, 1
sub edx, eax
mov eax, edx
cmp eax, 1
jne 0x140002850
call sym.get_plan__
test eax, eax
sete al
test al, al
je 0x14000283b
mov eax, dword [0x14003d044]
lea edx, [rax + 1]
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
add edx, eax
and edx, 1
sub edx, eax
mov eax, edx
mov dword [0x14003d044], eax
mov eax, 0
jmp 0x140002d26
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.highlight_select_button_mouse_down__widget_t__int__int_
mov eax, dword [0x14003d044]
lea edx, [rax + 1]
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
add edx, eax
and edx, 1
sub edx, eax
mov eax, edx
mov dword [0x14003d044], eax
mov ecx, 1
call sym.redraw_bool_
mov eax, dword [0x14002d004]
test eax, eax
je 0x14000288f
mov eax, dword [0x14002d004]
cmp eax, 0xb
jne 0x140002899
mov eax, 0
jmp 0x140002d26
mov eax, dword [0x14002d004]
cmp eax, 6
jne 0x14000290e
mov rax, qword [0x14003d088]
test rax, rax
je 0x1400028e2
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x1b
jne 0x1400028e2
mov rax, qword [0x14003d088]
mov rcx, rax
call sym.text_tool_release_honey_text_tool_t_
mov qword [0x14003d088], 0
mov eax, 0
jmp 0x140002d26
mov rax, qword [0x14003d088]
test rax, rax
je 0x14000290e
movsx edx, byte [rbp + 0xcf]
mov rax, qword [0x14003d088]
mov rcx, rax
call sym.text_tool_keydown_honey_text_tool_t__char_
mov eax, 0
jmp 0x140002d26
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x50
jne 0x140002940
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.pen_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x4c
jne 0x140002972
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.line_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x52
jne 0x1400029a4
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.rectangle_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x45
jne 0x1400029d6
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.ellipse_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x41
jne 0x140002a08
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.arrow_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x54
jne 0x140002a3a
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.text_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x58
jne 0x140002a6c
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.eraser_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x53
jne 0x140002a9e
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.screenshot_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x43
jne 0x140002ad0
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.clear_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x5a
jne 0x140002b02
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.undo_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x57
jne 0x140002b34
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.whiteboard_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x42
jne 0x140002b66
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.blackboard_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x32
jne 0x140002b98
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.width_2_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x36
jne 0x140002bca
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.width_6_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x38
jne 0x140002bfc
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.width_8_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x31
jne 0x140002c2e
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.timer_1s_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x33
jne 0x140002c60
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.timer_3s_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x35
jne 0x140002c8f
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.timer_5s_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x4e
jne 0x140002cbe
mov r8d, 0
mov edx, 0
mov ecx, 0
call sym.timer_no_button_mouse_down__widget_t__int__int_
mov ecx, 1
call sym.redraw_bool_
jmp 0x140002cfa
mov rax, qword [rbp + 0xc0]
mov eax, dword [rax]
cmp eax, 0x4d
jne 0x140002cfa
mov rax, qword [0x140031e70]
movzx eax, byte [rax]
test al, al
je 0x140002ceb
mov rax, qword [0x14003d0c8]
mov rcx, rax
call sym.toolbox_maximize__toolbox_t_
jmp 0x140002cfa
mov rax, qword [0x14003d0c8]
mov rcx, rax
call sym.toolbox_minimize__toolbox_t_
nop
mov rcx, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov eax, dword [rbp + 0xe0]
mov r9, rcx
mov r8, rdx
mov edx, eax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CallNextHookEx]
call rax
nop
add rsp, 0x150
pop rbp
ret