Function at 0x1400d5860
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x2b0
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
movzx eax, word [rdx + 0x18]
mov rdi, rcx
add eax, 0xfffffff8
cmp eax, 0x50
ja case.default.0x1400d58b1
lea rdx, [0x140000000]
mov qword [rsp + 0x2c8], rbx
cdqe
movzx eax, byte [rdx + rax + 0xd5c28]
mov ecx, dword [rdx + rax*4 + 0xd5c04]
add rcx, rdx
jmp rcx
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x1400d58f2
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400d58f2
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400d58f2
mov edx, 1
mov rcx, rdi
call fcn.1400c9a80
jmp case.0x1400d58b1.9
xor edx, edx
mov rcx, rdi
call fcn.1400c9a80
jmp case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, rdi
test al, al
jns 0x1400d5922
mov edx, 1
call fcn.1400d4300
jmp case.0x1400d58b1.9
xor edx, edx
call fcn.1400d4300
jmp case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x1400d5a0d
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400d5a0d
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400d5a0d
mov rcx, qword [rdi + 0xa50]
mov qword [rsp + 0x2d0], rsi
mov rax, qword [rcx]
call qword [rax + 0x70]
lea rdx, [rsp + 0x90]
mov r8d, 0x8000
mov rcx, rax
mov rsi, rax
call fcn.140092ff0
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x30], 0
call fcn.140094590
mov r10, qword [rdi + 0x38]
mov rdx, qword [rsp + 0x30]
lea rcx, [rdi + 0x38]
xor r9d, r9d
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0
mov ebx, eax
mov dword [rsp + 0x20], 0
call qword [r10 + 0x50]
test ebx, ebx
js 0x1400d59f7
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0x2d0]
jmp case.0x1400d58b1.9
mov rcx, rdi
call fcn.1400c5310
jmp case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
mov rbx, qword [rdi + 0x12c0]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xb]
mov rcx, rbx
mov dword [rdi + 0xf3c0], 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rsp + 0x40]
or r8, 0xffffffffffffffff
mov edx, 0x102b
mov rcx, rbx
mov dword [rsp + 0x50], 2
mov dword [rsp + 0x4c], 2
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea edx, [r9 + 0xb]
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x12c0]
call qword [sym.imp.USER32.dll_SetFocus]
jmp case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
mov edx, 1
jmp 0x1400d5bd7
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
mov eax, dword [rdi + 0xf3d0]
mov rcx, qword [rdi + 0x12c0]
mov dword [rdi + 0xf3c8], 1
mov dword [rdi + 0xf3d4], eax
call fcn.140090460
mov rcx, qword [rdi + 0x12c0]
call qword [sym.imp.USER32.dll_SetFocus]
jmp case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
mov rcx, rdi
call fcn.1400d34c0
jmp case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js case.0x1400d58b1.9
xor edx, edx
mov rcx, rdi
call fcn.1400d3630
mov rbx, qword [rsp + 0x2c8]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x2b0
pop rdi
ret