Function at 0x14005bd58
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
mov rbp, rdx
mov edi, eax
mov r12d, eax
mov rsi, rcx
call fcn.140059cc8
mov ecx, InitCommonControls
mov rbx, rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr rax, 8
mov ecx, reloc.COMCTL32.dll_InitCommonControls
movzx r15d, al
call qword [sym.imp.USER32.dll_GetKeyState]
mov edx, 8
mov rcx, rsi
movzx r13d, ax
shr r13, 8
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov rcx, rbp
mov r14, rax
call qword [sym.imp.GDI32.dll_SaveDC]
mov rdx, rbx
mov rcx, rbp
mov dword [rsp + 0x50], eax
call qword [sym.imp.GDI32.dll_SelectObject]
mov r8d, dword [0x140097010]
lea r11, [0x1400b8b00]
mov edx, dword [0x140096f9c]
xor ecx, ecx
mov rbx, rax
mov r10d, 1
test r8d, r8d
jne 0x14005be16
lea ecx, [rdx - 0x17]
cmp ecx, r10d
jbe 0x14005be14
mov edi, r10d
jmp 0x14005bf26
xor ecx, ecx
cmp edx, 0x13
jg 0x14005c0e4
cmp edx, 0x12
jge 0x14005c0c3
cmp edx, 9
je 0x14005c02b
cmp edx, 0xa
je 0x14005c00f
cmp edx, 0xb
je 0x14005c02b
jle 0x14005bf26
cmp edx, 0xf
jle 0x14005bfe1
cmp edx, 0x10
jne 0x14005bf26
mov eax, dword [0x1400b8b20]
cmp dword [0x1400a7798], eax
jne 0x14005be77
mov eax, dword [0x1400b8b24]
cmp dword [0x1400a779c], eax
je 0x14005bebf
call qword [sym.imp.USER32.dll_GetMessageTime]
mov ecx, dword [0x140096fe4]
add ecx, 0x12c
cmp eax, ecx
jge 0x14005bec2
mov eax, dword [0x1400a7798]
sub eax, dword [0x1400b8b20]
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jge 0x14005bec2
mov eax, dword [0x1400a779c]
sub eax, dword [0x1400b8b24]
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jge 0x14005bec2
mov r10d, 1
mov edi, r10d
mov rcx, qword [0x140096fe8]
test rcx, rcx
je 0x14005bee9
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor ecx, ecx
mov dword [rax + 0x12c], ecx
mov rcx, qword [0x140096fe8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [0x1400b7fa4]
mov dword [rsp + 0x38], eax
mov eax, dword [0x1400b7fa0]
mov dword [rsp + 0x30], eax
lea rax, [0x1400b8b00]
mov qword [rsp + 0x28], rax
xor edx, edx
movzx ecx, word [0x1400b8b30]
movzx r9d, word [0x1400b8b32]
mov dword [rsp + 0x20], ecx
mov rcx, rbp
call fcn.1400354a8
xor eax, eax
mov rdx, rbx
mov dword [0x140097010], eax
mov rcx, rbp
mov dword [0x14009700c], eax
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_RestoreDC]
mov rcx, qword [0x140097000]
xor ebx, ebx
test rcx, rcx
je 0x14005bf61
call qword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [0x140096f9c]
mov qword [0x140097000], rbx
cmp ecx, 0x12
jg 0x14005c2c5
je 0x14005c3a2
cmp ecx, 9
jl 0x14005c483
cmp ecx, 0xb
jle 0x14005c29c
cmp ecx, 0xd
jle 0x14005c284
cmp ecx, 0xe
je 0x14005c261
cmp ecx, 0xf
je 0x14005c20f
cmp ecx, 0x10
je 0x14005c1c0
cmp ecx, 0x11
jne 0x14005c483
movzx edx, word [0x1400b8b32]
lea eax, [rcx - 0x10]
mov rcx, qword [0x140096ff0]
xor r9d, r9d
mov r8d, r15d
mov dword [rsp + 0x20], eax
call fcn.1400348fc
jmp 0x14005c483
mov eax, dword [0x1400b8b20]
cmp dword [0x1400a7798], eax
jne 0x14005bfff
mov eax, dword [0x1400b8b24]
cmp dword [0x1400a779c], eax
cmove edi, r10d
mov rdx, r11
mov rcx, rbp
call fcn.14007a330
jmp 0x14005bf26
mov rdx, qword [0x140097000]
test rdx, rdx
je 0x14005c02b
mov rcx, rbp
call qword [sym.imp.GDI32.dll_InvertRgn]
lea r11, [0x1400b8b00]
mov rdx, r11
mov rcx, rbp
call fcn.14007a330
xor eax, eax
lea rcx, [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetRect]
mov r12d, dword [0x140096f20]
xor eax, eax
or dword [0x1400b8b28], 0xffffffff
mov rcx, rsi
mov word [0x1400b8b30], ax
lea edx, [rax + 8]
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
test rax, rax
je 0x14005c08d
mov r9, rax
lea rdx, [rsp + 0x58]
mov r8d, 1
mov rcx, rbp
call fcn.14005a64c
xor eax, eax
cmp word [0x1400b8b2a], ax
jge 0x14005bf28
mov rcx, rsi
lea edi, [rax + 1]
call fcn.14005bcc8
xor eax, eax
cmp word [0x1400b8b30], ax
jne 0x14005bf28
lea ecx, [rdi + 0x1d]
call fcn.140055b80
jmp 0x14005bf26
mov eax, dword [0x1400a779c]
mov edx, r10d
mov dword [rsp + 0x38], eax
mov eax, dword [0x1400a7798]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r11
jmp 0x14005bf0b
sub edx, 0x14
je 0x14005bec2
sub edx, r10d
je 0x14005c184
sub edx, r10d
je 0x14005bec2
sub edx, r10d
je 0x14005c176
cmp edx, r10d
jne 0x14005bf26
test r8d, r8d
je 0x14005c121
mov rdx, r11
mov rcx, rbp
call fcn.14007a330
xor ecx, ecx
jmp 0x14005c124
mov edi, r10d
cmp dword [0x14009700c], ecx
je 0x14005bf26
mov dword [rsp + 0x20], ecx
xor r9d, r9d
lea rcx, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetRect]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
test rax, rax
je 0x14005bf26
mov r9, rax
lea rdx, [rsp + 0x58]
xor r8d, r8d
mov rcx, rbp
call fcn.14005a64c
jmp 0x14005bf26
test r8d, r8d
je 0x14005be0c
jmp 0x14005bfff
mov eax, dword [0x1400b8b20]
cmp dword [0x1400a7798], eax
jne 0x14005c1a2
mov eax, dword [0x1400b8b24]
cmp dword [0x1400a779c], eax
cmove edi, r10d
mov eax, dword [0x1400b7fa4]
mov dword [rsp + 0x38], eax
mov eax, dword [0x1400b7fa0]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r11
jmp 0x14005bf09
movzx edx, word [0x1400b8b32]
mov r9d, ebx
mov rcx, qword [0x140096ff0]
mov eax, 1
test edi, edi
mov dword [rsp + 0x20], eax
mov r8d, r15d
sete r9b
call fcn.1400348fc
mov r8d, dword [0x1400b8b24]
mov rcx, rsi
mov edx, dword [0x1400b8b20]
sub r8d, dword [0x1400a779c]
sub edx, dword [0x1400a7798]
call fcn.14002da48
jmp 0x14005c483
test edi, edi
jne 0x14005c483
mov eax, dword [0x1400a7798]
sub dword [0x1400b8b20], eax
mov eax, dword [0x1400a779c]
sub dword [0x1400b8b24], eax
test r14, r14
je 0x14005c48c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, qword [0x1400b8b20]
mov rcx, rsi
mov rdx, rax
call fcn.1400103c4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x14005c483
test edi, edi
jne 0x14005c483
mov r9d, dword [0x1400b8b24]
sub r9d, dword [0x1400a779c]
mov rcx, rsi
call fcn.1400098e0
jmp 0x14005c483
test edi, edi
jne 0x14005c483
mov r9d, dword [0x1400b8b20]
sub r9d, dword [0x1400a7798]
jmp 0x14005c277
test edi, edi
jne 0x14005c483
mov rcx, rsi
call fcn.14005bcc8
mov r8d, dword [0x1400b8b28]
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.140008cc4
jmp 0x14005c483
sub ecx, 0x13
je 0x14005c465
sub ecx, 1
je 0x14005c42c
sub ecx, 1
je 0x14005c3eb
sub ecx, 1
je 0x14005c34d
sub ecx, 1
je 0x14005c340
cmp ecx, 1
jne 0x14005c483
test edi, edi
jne 0x14005c483
mov rcx, rsi
test r13b, r13b
je 0x14005c30d
call fcn.140074014
jmp 0x14005c483
mov rdx, rbp
call fcn.140025f78
mov edx, 8
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
test rax, rax
je 0x14005c483
mov rdx, rax
lea rcx, [0x1400b8b00]
call fcn.140034bac
jmp 0x14005c483
test edi, edi
jne 0x14005c483
mov rcx, rsi
jmp 0x14005c303
mov rcx, qword [0x140096fe8]
test rcx, rcx
je 0x14005c483
call qword [sym.imp.KERNEL32.dll_GlobalLock]
movsxd rcx, dword [rax + 0x138]
lea rdx, [rcx + rcx*4]
mov rcx, qword [0x140096fe8]
add rdx, rdx
mov ebx, dword [rax + rdx*8 + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
jns 0x14005c3a2
mov ecx, 0x28
call fcn.140055b80
mov rcx, qword [0x140096fe8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14005c483
mov rdx, qword [0x1400a7798]
call fcn.1400356cc
movzx edx, word [0x1400b8b32]
lea r8, [0x1400b8b00]
mov r9d, eax
mov rcx, rsi
mov eax, dword [0x140096fd8]
mov dword [rsp + 0x30], eax
mov eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [0x140096fe8]
mov qword [rsp + 0x20], rax
call fcn.14002ced0
jmp 0x14005c483
movzx edx, word [0x1400b8b32]
mov r9d, ebx
mov rcx, qword [0x140096ff0]
mov eax, 1
test edi, edi
mov dword [rsp + 0x20], eax
mov r8d, r15d
sete r9b
call fcn.1400348fc
test edi, edi
jne 0x14005c390
movzx edx, word [0x1400b8b32]
mov rcx, rsi
call fcn.14002dc30
jmp 0x14005c483
mov rcx, qword [0x140096fe8]
test rcx, rcx
je 0x14005c483
call qword [sym.imp.KERNEL32.dll_GlobalLock]
movsxd rcx, dword [rax + 0x138]
lea rdx, [rcx + rcx*4]
mov rcx, qword [0x140096fe8]
add rdx, rdx
mov ebx, dword [rax + rdx*8 + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
js 0x14005c386
mov rdx, qword [0x1400a7798]
call fcn.1400356cc
movzx edx, word [0x1400b8b32]
mov r9d, eax
mov rcx, rsi
call fcn.14002d55c
xor eax, eax
mov qword [0x140096fe8], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008a940
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret